{ "Event": { "published": true, "date": "2026-03-11", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-11", "timestamp": 1773273782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d48453d2-9703-4535-a511-3587fea6ed88", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b37b176-1d55-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773238705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238705, "uuid": "6a266483-96e3-42e3-b638-78c209e1d9c0", "comment": "Malware payload (Mirai)", "value": "67664aa8b17519ef2d0ab814b6d3b391", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238705, "uuid": "d8fa9f5c-2379-40cc-8802-71bf577780c4", "comment": "Malware payload (Mirai)", "value": "00927b54b5a546bc909ba4a9eb1e6006fd801c301451e33e637f2a4622b488cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238705, "uuid": "7e8a8db3-f39b-4fb9-9e4d-351d208899e7", "comment": "Malware payload (Mirai)", "value": "ad168f950a3d5611473f6d4e590d0a584ec329a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238705, "uuid": "e36f2c6c-ed62-4454-8efa-66d7fab4edce", "comment": "Malware payload (Mirai)", "value": "1cb8db88d5a710a83df09b58ccd0d41575231195db3e937745672f90a57d18b1439b0eaf6f3457ad5d0963ae053d4f99", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773238705, "uuid": "fadc1075-2fb3-410a-a37a-a91f36712844", "value": "T12CD31A07B98080FDC8E9C1784BFEB136D932B5AD127C710B2784BE366A5DE205F6DA15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773238705, "uuid": "0364ef70-4d67-45be-b2b8-48b525725347", "value": "3072:rYXH3S0qgdHT/pqCxhQJfxc0Zi2u0M3QMox:rYDzJx+60us", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773238705, "uuid": "e82a16f5-8954-4e34-b740-f986719bcc59", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773238705, "uuid": "de29d140-6b26-42bd-bb80-864d74d0707a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773238705, "uuid": "e3f0a8b7-b660-428f-9702-81024faff4af", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf1e419-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249822, "uuid": "394824de-e2ed-4562-a548-08db1d0d569b", "comment": "Malware payload (WannaCry)", "value": "7d5f9e9d4da809bcded53ec68f94b2ac", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249822, "uuid": "a227e2f6-c00a-4912-bd0e-f586071d1e06", "comment": "Malware payload (WannaCry)", "value": "00be6929b54eee6e70889792e2ba0ce69113b815427dc385ae290db9114d24df", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249822, "uuid": "1ce35b0f-3077-4258-b086-1ae09a118eb5", "comment": "Malware payload (WannaCry)", "value": "eb2481586eb38afe8296eb7f710d8074b7ff5230", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249822, "uuid": "a8a74dd9-7df6-42f1-9026-6e4974c3ab4d", "comment": "Malware payload (WannaCry)", "value": "125e1cda929531b6342d2cbfb05c4c90075f6ff323a3d113a69f799e4bc22a36bfe89e4b94334f529d3daab9966a450e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249822, "uuid": "5b745e61-845d-4280-8ae6-8635fcb32f84", "value": "T1C036122771AC80F4C20AB230A0774A26E6F77D3E2179660FDFA08F652D13751B668B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249822, "uuid": "fbeaabf3-c27e-4069-b5b2-cfb2bfb77406", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249822, "uuid": "8242289a-a276-435c-9771-fd3411d9175b", "value": "12288:11bLgmluCf62rIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+:nbLgut3dmMSirYbcMNgef0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249822, "uuid": "f2406f3d-4040-4491-ba03-56e6a71ca4c9", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249822, "uuid": "de280f62-0bc1-4a42-86e8-ed645008ebd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249822, "uuid": "9ca25f0b-fd49-4035-a53b-ede07ce28ba7", "value": "00be6929b54eee6e70889792e2ba0ce69113b815427dc385ae290db9114d24df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233de486-1d74-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773252006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252006, "uuid": "591d3889-55e0-4e10-a04c-a9679fc3ad17", "comment": "Malware payload (WannaCry)", "value": "928765bf46b1e554454c45b6cec1a8fd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252006, "uuid": "9f555451-22e7-409f-82e7-262b9e542167", "comment": "Malware payload (WannaCry)", "value": "011e16a72ac0a2cb71d4f3a001bac0047f9578b176452ae3041942575a00a8a2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252006, "uuid": "82848eb0-b845-44f0-bcbc-dc0eed513388", "comment": "Malware payload (WannaCry)", "value": "fec57d7257a6d8fa5984bfcba8da7e05e3aca7ae", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252006, "uuid": "d0bbe940-56cf-4b1a-83c3-af15b04392ef", "comment": "Malware payload (WannaCry)", "value": "f4d2e4057be9f9b8fcfb269a13615da6ef9b30be3ee411499513c344b6893dcb323bdf5f3154f58d9067b8f30dbb8733", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252006, "uuid": "f19b2216-efe8-42ad-ba76-92d8793471d4", "value": "T17E3612A6719C40F4C20A7230E4774A16F6B77C3E21B9960FEF908F652D53B92B624B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252006, "uuid": "ef4e0b4b-4282-4424-93e6-664c447ca3c7", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252006, "uuid": "af14f8ab-4c97-449a-957b-bb0fac9ba846", "value": "12288:T1bLgmluCti62lIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D:RbLguripdmMSirYbcMNgef0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773252006, "uuid": "557228cf-3bc7-4b2f-8a6d-03f3488ce306", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773252006, "uuid": "effab3f9-b501-48e1-a5bd-3713fb013f3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252006, "uuid": "5e0d315a-b164-404d-ad34-47c7402ff548", "value": "011e16a72ac0a2cb71d4f3a001bac0047f9578b176452ae3041942575a00a8a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da70d935-1d8d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773263051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773263051, "uuid": "c725a6b2-05b0-4b55-a912-4e34d6a994b8", "comment": "Malware payload", "value": "d57e6e87e209a90a3843fffca7399862", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773263051, "uuid": "0b6638f1-6899-4e0a-9f23-f5e58651343e", "comment": "Malware payload", "value": "01ee4903603f1ebe92f0a1321a6c336b6b24f0e9925efc743e83995499bcfd59", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773263051, "uuid": "9a06d42a-97d1-4744-baaa-6d6253a425ea", "comment": "Malware payload", "value": "fc6b88dbed61f1c61b4a9a3f5b3b269779b37ce4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773263051, "uuid": "4b4ac131-95c4-4b91-937d-c401c29ee95e", "comment": "Malware payload", "value": "115566b2e9f9e1b6959c472b38dd23510eb12f7139e66578a79bd6f6f58078eb3b0d3e0e0e0e605a60969f2c2944865d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773263051, "uuid": "0853dcd2-74eb-40d3-a7b5-9bab72847b96", "value": "T106925CB906496C79FBC0CE799F3C7F0CAEE582C42128E39DBA1F39705A2165DC609359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773263051, "uuid": "1b11630d-2550-4f0f-b607-448020817b79", "value": "384:TencuxOLnVYMSZzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:TduQL+ZzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773263051, "uuid": "e5f74d6b-f539-4311-97e2-225d4af121d1", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773263051, "uuid": "09e5dbcd-c7a4-4b2b-957d-a39ec5cecd4f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773263051, "uuid": "d869528f-722a-407d-92ef-3c44df65842b", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f146778f-1d19-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1773213268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213268, "uuid": "0a3ffb12-d5d1-4c23-9265-2fddc38b5f91", "comment": "Malware payload (SalatStealer)", "value": "6f38631b29f4f8df8f6e4ffef067ffeb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213268, "uuid": "c24efb25-5273-451f-8ec4-11e391372a71", "comment": "Malware payload (SalatStealer)", "value": "029a0752ff7980c7548f57db44d530214e4c61783b81c0f66e4e8b52987a9031", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213268, "uuid": "54af0d11-9649-4fcd-9969-8356be79d839", "comment": "Malware payload (SalatStealer)", "value": "6e1eb69902802df830d395996f983e593881d6b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213268, "uuid": "c10db933-f72f-4ac9-bf08-1ea5f4ae568f", "comment": "Malware payload (SalatStealer)", "value": "8b0e4d3843c6991e571f2fe1212331e3ea64a15fc9b3da2091bcf24464d380b2284fc9daa20f616df51cc1d4fe617925", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213268, "uuid": "370d3e0b-84bb-447f-b168-869b0beebf63", "value": "T131B65955FACB44F6ED032831416FB27F23315D058B28DB9BEB547A2BF87BA811C26605", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213268, "uuid": "d787d0f0-c45c-42f6-8e4f-91603b0f2d6f", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213268, "uuid": "62afd3a3-4b59-4e5f-824e-69ca8b30f3d1", "value": "98304:sg6/jOu1Ok+WtlsOaNR7LAMPRLTbYrmCoMB8J+vPochZs9/t:7uI3NA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773213268, "uuid": "daa736ae-e981-4bce-a6ca-3484e6c171f9", "value": 11418112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773213268, "uuid": "785f384c-d0f2-46df-8782-fa3142fc0523", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213268, "uuid": "997d6b1c-c15e-48c2-aecd-c013f47f7505", "value": "1993976e4022846c1d560bd349859d38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b89e1c-1d6e-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249784, "uuid": "a901d32a-932a-4b16-ad0c-ee3dd96cb6a0", "comment": "Malware payload (WannaCry)", "value": "5b42025d683c37d59b8ea668a3d0a76e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249784, "uuid": "08f8388b-600c-41c9-b4f8-45dd1c29b8d0", "comment": "Malware payload (WannaCry)", "value": "02dd7dea62299b207a1d4ce542334f2a5ea05fc9e02efbceb5dc4c67c8e05ddb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249784, "uuid": "9414d3d3-cae4-406e-afbc-c369b0f5d836", "comment": "Malware payload (WannaCry)", "value": "31f9fb0fde6098e277f4de71d2f58413aef83803", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249784, "uuid": "acb02540-63d2-45bf-8903-567f8a79e48b", "comment": "Malware payload (WannaCry)", "value": "db5da4cbf0ae62b8a0f5a06b2c0023cb899934da759107ffa401cb37034d2e0e3ed3c22a1180ae9cee992a8277c3fc0a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249784, "uuid": "d256e9a8-05f3-486a-aa90-c1f1cbd6b96a", "value": "T112363348717CA1FCD14509B904A78E57B6F33C5E67FA5A0F8F80862B1C53B49EFA4A42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249784, "uuid": "237f63d4-d7a0-4ee2-8c71-aa8a1404c6ea", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249784, "uuid": "0bcb537f-3289-4816-919f-c944a491080c", "value": "98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9xAVp2H:+DqPe1Cxcxk3ZAEUaPc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249784, "uuid": "e59c047b-d4f4-48b0-99f8-18260cc69093", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249784, "uuid": "c1764720-58de-4acc-be3f-4fa4250a24b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249784, "uuid": "42e9a5f5-4e27-4e4b-b401-e59f4248d6c0", "value": "02dd7dea62299b207a1d4ce542334f2a5ea05fc9e02efbceb5dc4c67c8e05ddb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204a95e2-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249854, "uuid": "919360a8-e73b-48e8-a4eb-c19d81718da0", "comment": "Malware payload (WannaCry)", "value": "4dd15bbe24d368f6e3a094ad6aad4bea", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249854, "uuid": "662ea83d-3777-468f-b933-d9fec567df98", "comment": "Malware payload (WannaCry)", "value": "0308b9d0951fd5b576d4fc570fad2749a39d307d2042b6b8184b6402d0494976", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249854, "uuid": "e8a9f312-76c6-448b-93cc-e7f4cd286435", "comment": "Malware payload (WannaCry)", "value": "feafd3840ef0f44c49cef62e7ecc5a87d8795cf3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249854, "uuid": "972a68e0-6148-467a-93c1-db9f7fa0509e", "comment": "Malware payload (WannaCry)", "value": "c41f0bd8f408c4aa103928af9433594dfc006e4b6fdca3fec2aaa2c5e4f97b00d9888f5b96c16602d4b5761c16944958", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249854, "uuid": "53d277f2-f9e0-4e50-ac0d-7d4974913596", "value": "T19A3633E46A8C21F8F1A51AB0D4324928B6BB3C7D72368B1FA3D087650D537D37B94B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249854, "uuid": "ec29ca72-d1fa-4c3f-b298-93b6716c5052", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249854, "uuid": "e1af0b1b-d52b-4780-855c-31534d46fd30", "value": "49152:SnGMSPbcBVvJM0H9PAMEcaEau3R8yAH1plAH:+GPoBhWa9P593R8yAVp2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249854, "uuid": "5e17a9f2-90d7-4597-a0ba-61ff03e2b67a", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249854, "uuid": "9e2a9b9c-967a-44a6-b55b-d4df5f1b5b98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249854, "uuid": "fcd558af-a79b-4b56-8711-af875c805b86", "value": "0308b9d0951fd5b576d4fc570fad2749a39d307d2042b6b8184b6402d0494976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab8ebb9-1cec-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773193956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773193956, "uuid": "42c09923-12ff-4c26-b627-a72e25f2fbf1", "comment": "Malware payload", "value": "d5bd6fb40e3705220c6e8d62dac0a8d0", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773193956, "uuid": "8633431e-c139-4676-a5d9-cd754013cf55", "comment": "Malware payload", "value": "030bf8872400f13bab468d4e32b57326548efd1c70c18a584677e0c56d342038", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773193956, "uuid": "9d99607b-85f8-4055-9074-56b623d097fd", "comment": "Malware payload", "value": "5094e70fae52b087804a5a0dc654cf56ea3fe5c4", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773193956, "uuid": "cd51453a-8c44-4ed9-b7db-2541afdaa5e7", "comment": "Malware payload", "value": "7fb0824db06a5b60745e467ffa2534a205afd58407c53e17b163a4c6bada83356666ffaa7d96b788bb305541d0a040e2", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773193956, "uuid": "bf1f175a-09b9-4f3c-a54e-7c6f97f66b77", "value": "T1100146DCB1BC8FA10A9DC68AF6B051048482D0C7E1F657C5F34E0820AF00F8D3A6368D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773193956, "uuid": "cef83320-2487-42f2-a893-455c9b91c508", "value": "12:FzY8id/7JAC7akxGWi2jX0KTkkjtij1Qjhpnv:FzY8k1/sWi2jkwt01Cr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773193956, "uuid": "1e280520-faf4-459b-988d-67265b64ced3", "value": 667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773193956, "uuid": "811952d1-30af-4969-8b53-bf25145cc698", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773193956, "uuid": "058a214e-abc0-4176-8e41-082824cc25c9", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fc101cb-1d0e-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773208219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773208219, "uuid": "14747bf0-f2ef-473e-bfd0-ae2cafcd0831", "comment": "Malware payload (ValleyRAT)", "value": "55ee7cf1d37a864d672147f371003a64", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773208219, "uuid": "94d6d59f-90a8-4c9d-b218-6600115363f5", "comment": "Malware payload (ValleyRAT)", "value": "05095dad171a9a8a6e628fb429304fa1211921ff87203c7766cfa17d3e27e94a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773208219, "uuid": "320cbebe-9b76-40ab-967b-b55f39cd0eed", "comment": "Malware payload (ValleyRAT)", "value": "8d63280f5353f62f7ec1bfd21716545258c98552", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773208219, "uuid": "cc8b5c89-663d-4785-b4bf-822547f845b7", "comment": "Malware payload (ValleyRAT)", "value": "9d68df3caf6acb855f42cdc570e8b9ecd22d5b67e1866230175ddf08ce143cacbd2ea6b632fcf51af0451fe2c5b0bc0a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773208219, "uuid": "fdb459fb-c8c7-4428-a364-c645bb401300", "value": "T12B0512167D1BD136FB885C709026DBF38A316C62CFE16697DB86BE8E4C315C1A234B49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773208219, "uuid": "9b0fe8cd-ca28-4fde-a54c-af6b9ad4eaf1", "value": "b15035de0874191bbda1e93d484ec77f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773208219, "uuid": "f68a0eec-44f0-40bb-8915-4cc1dec9056f", "value": "24576:Y8drt8ZxeMegwx4MXSeZwjtEIANq/+QaE:VrbMExXtKBEhNq/raE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773208219, "uuid": "7f427ecf-2c1e-44be-b4be-130c7dd9ea99", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773208219, "uuid": "3e88956e-8a8d-450c-aa25-c9a448542e52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773208219, "uuid": "16c8514c-f97d-464f-9416-1024fbfe8bfe", "value": "05095dad171a9a8a6e628fb429304fa1211921ff87203.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ec3485-1d6e-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249748, "uuid": "ea3b4abc-fb69-4053-9cf6-1dbdd6a9ae08", "comment": "Malware payload (WannaCry)", "value": "56fd3342b2996306982bcbb578115e33", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249748, "uuid": "c76953c6-276a-412e-a7bb-032faae62a18", "comment": "Malware payload (WannaCry)", "value": "052ed6a0c5614c413ebcd9bb4175c68fec906b911c4da5c002dabbc60f3c9950", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249748, "uuid": "d800f7d6-1bb3-48a6-8f9c-d847e30a8826", "comment": "Malware payload (WannaCry)", "value": "f7e23ee247113149a92062aab6586b6ffa86bd74", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249748, "uuid": "3ae5b33d-de6d-4f5e-a52f-050791ce18ec", "comment": "Malware payload (WannaCry)", "value": "ecc3457ff175f97ae03ed1e17880312d9d37983721f2f3f1639730dbd65b0a6d0e355aa538d10a9bc000692d8f30fd64", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249748, "uuid": "722dcda3-cf60-4648-9b41-bff59458aa9a", "value": "T1683633D4626C62FCF1440EF444778A1AB7B73C6D66FA4E1F97C086660D43B9BABC0A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249748, "uuid": "59856922-a24c-4f0d-a884-70434ece9d08", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249748, "uuid": "52752c32-b184-45ef-941b-fd5d6ac7169b", "value": "98304:afPoBhz1aRxcSUDk36SAEdhvxWK9P593R8yAVp2H:afPe1Cxcxk3ZAEUKdzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249748, "uuid": "b2d6a7a7-b251-48c7-80b2-70e488169182", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249748, "uuid": "b5353cc0-a66b-46d7-9e4e-8f51b0431add", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249748, "uuid": "4e416ca8-265a-4745-aaa9-559114ed4696", "value": "052ed6a0c5614c413ebcd9bb4175c68fec906b911c4da5c002dabbc60f3c9950", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14996fb6-1cfa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773199583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199583, "uuid": "0fd4cfe7-28b2-4bcc-9229-d69c8e6561ae", "comment": "Malware payload", "value": "a0304248a740d984cb11ede184210269", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199583, "uuid": "fdb1a63e-e64a-42c4-be82-747318e01dec", "comment": "Malware payload", "value": "0576ce6546d7d0c2d22603d956ef49b0197e9fd0fd82409b132b6427b5128058", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199583, "uuid": "2fe99c0e-1122-4b7d-9cd6-fc1a6cf441a4", "comment": "Malware payload", "value": "add2fc7a2829f6f5bced2225a5facff9ff7dcc4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199583, "uuid": "fec28633-c3c1-4e98-976d-11e00a93f31e", "comment": "Malware payload", "value": "5a61643e6e297c141c832847b9018438077b0f179679064a35049143abbaddafb9d70a048e7a1dba9d9b1177d3db6b4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MalGeneric", "colour": "#1F31D0", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773199583, "uuid": "1807cf44-6e9e-46c2-874f-d49b4c17256a", "value": "T1C07523D4F6C08EE3C57A1B384423999178E37A1CAE15936F441A67DF6E71AD8CD388B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773199583, "uuid": "f3175a99-aca1-4afb-afc6-77a1bdfd1cb1", "value": "0ddb4c08073295d50c871b00d3ab92f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773199583, "uuid": "4c784200-8a98-40bd-a2b2-cfe0f89f3f3b", "value": "49152:yW+p+usWQIPkpQznzGY0gEmAGKU+3wX60n:yPpUIPpnDlEunn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773199583, "uuid": "1f30757b-d450-4c2c-bea0-68a2e6f6b0b0", "value": 1667072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773199583, "uuid": "16448d1c-cb4d-4239-835b-07246182ec7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773199583, "uuid": "86dfab1a-b43c-4290-b3a4-7a462369f099", "value": "2026.03.10\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af70136-1d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773256449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256449, "uuid": "1880d540-f96f-49ac-a881-0949e477fd0e", "comment": "Malware payload (Mirai)", "value": "a09ad21419eab90a8b94c7ebf072b368", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256449, "uuid": "db3e7c26-3d7b-4738-8efb-8aba345748fd", "comment": "Malware payload (Mirai)", "value": "058bc4b2ede9d6b4b2dad5fb5ae06db271d3d9cc655ec73045cf6b493e88c24d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256449, "uuid": "251d22c3-2108-417d-bd18-9802c8f0cda3", "comment": "Malware payload (Mirai)", "value": "3cff2cbd882c91f8e43d38467c6dd0344f9cbadc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256449, "uuid": "4053b78f-3433-4072-a3d1-f9830099710a", "comment": "Malware payload (Mirai)", "value": "343da804c3391f9370f6ceca5cde8332874a5d2e473688bc6258370c67234a82fd353b3ef5f630e00d869c21bb7734fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256449, "uuid": "883a7d30-9476-4557-a312-5f318f191693", "value": "T1A4F2E125B08B3AB1FA490C71FB7903EA57D01EB160CB76610AC28B64258F51B7AF56C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256449, "uuid": "a528ae90-2ccf-4a2d-9ee0-f7afd0863b29", "value": "768:aa8LMCvVxSCNhwU2NxRmN8tZIQrwpyTuIT6s3UozH:w/90C72FxtSQrw8TuILzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773256449, "uuid": "53cc34d7-cdfa-4199-b724-0953b246cd52", "value": 34732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773256449, "uuid": "99e0d3e9-96e7-4127-9828-4e711650e255", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256449, "uuid": "1f5b3f9e-eeb8-4b71-ac78-02d41f98baa9", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d19bb99-1d72-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773251164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251164, "uuid": "f4b595ba-253d-4310-bdbb-dbe97c9c1872", "comment": "Malware payload (WannaCry)", "value": "ed3c9a5042ce0473c46e6fead8306bc3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251164, "uuid": "a214b6f0-ca9d-4577-bd35-c1462112ddbf", "comment": "Malware payload (WannaCry)", "value": "05ce8786ae5bc76199cedcee8b5257d6339d5c4fb72e26bf255f1f454749170f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251164, "uuid": "b2bd8f81-fde7-4e48-8e3a-bce9cb339f38", "comment": "Malware payload (WannaCry)", "value": "0cc1703f32e774fdd693a1f214cfc97b3d8bee72", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251164, "uuid": "28013d7d-9d25-4570-8edd-f9783f26f0bc", "comment": "Malware payload (WannaCry)", "value": "6b9ea737a438c245012d1801cfebc0599e799dc63800a49999811de332dd6801e5ca720fc67f47e2e5d346d4996e3ffd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251164, "uuid": "ed5d0219-8edf-4cac-81f2-2bb4e867f9c8", "value": "T1B136239631A8D1B8C1041574CCABCAFEA1B23C59ADB9990B7BC07F5F3D33755AB40A42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251164, "uuid": "9675d8ad-b07e-49fd-8bad-99e8bce58eac", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251164, "uuid": "1573195f-5e25-4f09-ad91-20b2f2c5f315", "value": "49152:RnREMSPbcBVQej/1INRx+TSqTdX1HkQo6SA:1SPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773251164, "uuid": "e310adf3-f5d1-4cc1-ab0a-7726e2f994a3", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773251164, "uuid": "82e645d8-2c97-4d33-ad1a-495489d11056", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251164, "uuid": "330a15b2-b979-452f-851e-5b0984c4ec2e", "value": "05ce8786ae5bc76199cedcee8b5257d6339d5c4fb72e26bf255f1f454749170f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97942b90-1d1f-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1773215694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215694, "uuid": "ab0bd2e3-650a-4aff-b17a-dfa30ca64455", "comment": "Malware payload (DCRat)", "value": "b38421fe842066c51f08f4f9d4cb38a8", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215694, "uuid": "cac1b18c-8ec2-4c26-8d27-b9b452fa8420", "comment": "Malware payload (DCRat)", "value": "07ca3c1f8d2a424f1873cf6eda6df16e69569aa98c5d152734668ea9d1f4c374", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215694, "uuid": "643349a2-eb6d-4238-98c3-92b9df82e6ae", "comment": "Malware payload (DCRat)", "value": "be17723b4a980ef8657ef1cfd37334a8581b4ca1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215694, "uuid": "0a64537f-a07e-4659-ab5f-ec224c805fcf", "comment": "Malware payload (DCRat)", "value": "f6964ae8cd49663b9dbef4d96f51f2d6d5e48b5cc51ac9ec7a759b2c2194d961d5d0664ecb7a8d53ad241f179e19f518", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215694, "uuid": "b9c97f43-298c-4e28-bbdc-2b1acf8bd59c", "value": "T17E06031040CB33A56474F167100E6DEB8F9AD2D3F671694C3D2A2A9FF46C8DAD8C1DA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215694, "uuid": "9a3aab7d-9a77-4f50-9800-97fd6e04717e", "value": "384:bFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFZ:QbjknbF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773215694, "uuid": "5e3bbcb4-61ad-40a1-bb2a-75fb47139709", "value": 3679077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773215694, "uuid": "07313a0e-7968-41bd-8ef5-897c3e8f900a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215694, "uuid": "961d6938-b41a-40e6-a4ce-1388e6aef98b", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a2e206-1d21-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773216384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216384, "uuid": "4746c91e-5981-4646-8100-8d0d664e4119", "comment": "Malware payload (RemcosRAT)", "value": "b8f4df5aedc8eb364ff53c157b94451d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216384, "uuid": "8d2bfb15-71da-4601-8ee8-df9255b80bbf", "comment": "Malware payload (RemcosRAT)", "value": "093ede1caec2dfbe8eacaeec091fad7f27b5c206503ca0b645f3c79167121094", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216384, "uuid": "a284d61c-0e8c-41cc-97c5-22b6fdb792ac", "comment": "Malware payload (RemcosRAT)", "value": "371e55a7374e005420e8ef6cc5b8c72861f54f05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216384, "uuid": "33252b48-3ada-4e45-bf70-70cd5b72e50c", "comment": "Malware payload (RemcosRAT)", "value": "03250eaadd0d9c35155448fa2d3d6977d5aba079966d482f525f883586baf6136935ee25a9ed1f56896ebd5f5dfd2dc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216384, "uuid": "74c6b8bd-d536-4a77-b69e-9536064b1dd3", "value": "T15A15129361F0CAB5CB08D5F0A5E655734F782D7F6A946633B140BAA384F781C980E2DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216384, "uuid": "19c5aeab-aa46-457e-ad54-590fa33c994e", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216384, "uuid": "04a5939d-c889-4b9e-a1dd-7e8d3a59d135", "value": "12288:8+JMGi9jZwd6IFMJIlfdZRU5Kl2njTs3dG+JtBoT+yGPMyJYKSlFoxuxAcE8IsIh:8+OocIFMJUl/UK2ns3dDJtBo2PqNXiuA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216384, "uuid": "cfdc34eb-28ff-441d-bf5d-87e5b6957955", "value": 901960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216384, "uuid": "6aefa749-1c6f-40bc-b0f9-ea2516bf6b1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216384, "uuid": "0fc13a2f-2372-4085-8c31-fbf167c35e1d", "value": "First_Tranche_Payment_Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e30428-1d23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217160, "uuid": "b038491a-f6c3-44c3-a688-8178f9c5069e", "comment": "Malware payload", "value": "7878151a6590fba532e5749af0fbf5e4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217160, "uuid": "eba5f8a7-b4e5-486d-a931-fecf73bae37a", "comment": "Malware payload", "value": "095c1b7f468d9ef7a0d3161327c448a076350377aa3213ad7ca8135472d2f956", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217160, "uuid": "f4d39657-3def-4d6b-8e4a-7ac24b5112a7", "comment": "Malware payload", "value": "2a5cce5e0926ffd2f11526fd68ff4ad0358fd073", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217160, "uuid": "04a478c5-043b-4bbe-9441-fd7cada2f510", "comment": "Malware payload", "value": "a7cae3b0099b810ba0c6030be64631d52910d07f89c6170ff3fd15a68727d04813c4560ae70cd90e699b9327c2bcf328", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217160, "uuid": "51c000ed-912e-4778-814a-e51a20b4b21c", "value": "T10BE2941E8779CF48F57C8A20950B0784349CD45601E27F67864C7FDAAF5A5B32A7ACE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217160, "uuid": "d1e3400b-ab0b-4c7d-9f6c-85ba84906894", "value": "192:acDU7+jmKsTp1WDIlzkPwzCXIFPc7I5g2FhQnz2h3wTCG/YcZSNk9SEeCQDpyxhs:aZMUlsN4F+ULua1+ob2Jz77xFL3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217160, "uuid": "b2aa29f1-724e-4940-bae3-327dac7c2c61", "value": 33443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217160, "uuid": "3fc99ddb-071e-4c94-913f-823257db634a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217160, "uuid": "dfd2d3bf-52b6-4117-91de-faff6599645e", "value": "sleaked.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b971b2d-1ce6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773191193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191193, "uuid": "c91f3230-1780-4891-86e6-b8a154c57668", "comment": "Malware payload (Mirai)", "value": "f7c92d8a4b26991501504740eda5bb43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191193, "uuid": "eb5937fb-bc05-4131-8afd-3570ebd95b33", "comment": "Malware payload (Mirai)", "value": "0966580098f016ee4499ef66fd202e54126d6211ba0cd1fa16d8d7f0f0e4c4ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191193, "uuid": "eac65edc-ccac-4714-ad17-2c4c6047abc0", "comment": "Malware payload (Mirai)", "value": "c64e1fbb665b34f7cf15e8f5a1c8ac3e48e3b556", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191193, "uuid": "ebf0da54-382c-4363-9869-1c6cd3424e91", "comment": "Malware payload (Mirai)", "value": "73b500c012d4fd15e53ea246aab294ca11616f070b64a9c07b52f0d9b3faad05822cfb071c3211b4038c7785ee549405", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191193, "uuid": "40dbe638-1a47-42a6-a1c2-1d821b9cd729", "value": "T1D8837C32BA751D27C4D0687A61F30721F2F6479B25EC8A1A7DB20D8EBF2564032477B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191193, "uuid": "35716400-5121-409d-ac11-c9cae64bcee4", "value": "1536:BqjSIdmh69OHkGvTdN5zoa5XzQKt0qrNM5owQovwVY4t/7o9VNNus73:sWTlEG3V9JScN8vQKkK+s73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773191193, "uuid": "af634c95-1d8f-4a43-9fea-92de2b833e3f", "value": 85512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773191193, "uuid": "35ba4e36-9977-4c75-8858-5abdae9809ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191193, "uuid": "4f6dc493-d245-48fa-b800-a3feb153b487", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ced375a-1d61-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773243943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243943, "uuid": "71839433-4a44-4e65-9ba4-2879bf5ebd4b", "comment": "Malware payload (XWorm)", "value": "373bde311a9b25417a8d740e5025f2ca", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243943, "uuid": "fe31f486-83a6-473f-8d0f-e8fb632d5b51", "comment": "Malware payload (XWorm)", "value": "0a8d0b4d92673dc7e1b38332e637282d271d28f58ec019c2f96be69f38d2a8bc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243943, "uuid": "3c7f7fe6-6373-426a-8cad-bca486ec8d4a", "comment": "Malware payload (XWorm)", "value": "01963ffc889e43c4237a830a16a3063aa26614c1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243943, "uuid": "afc627eb-a680-412f-9ca3-1c0d09db2ed1", "comment": "Malware payload (XWorm)", "value": "927ec4a612b9b37aa2ae9b13b52ed2ac8b3fd0efb51301c179e184d9d57c137382257a70fb0af07b5818c1f62bca55de", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243943, "uuid": "4ca5319b-7cd4-431f-aa5f-6f9ce36670ab", "value": "T17245DFA5A6627050BAA40B0CFF9BBE84DE39437670F8CD4AAFA646EF074350F815D171", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243943, "uuid": "79c69625-ca69-415a-9634-7d97dca9ad4c", "value": "96:bQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQv:cww1gD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243943, "uuid": "7f3c27cd-6fc7-40fd-8eac-f7891c7f1afb", "value": 1216469, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243943, "uuid": "2e579401-92ac-410d-b11d-8e3f70ba5845", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243943, "uuid": "b4f92ddd-ff2d-47af-b884-312c28dd5dc3", "value": "373bde311a9b25417a8d740e5025f2ca.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7bf24f3-1d8a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773261705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773261705, "uuid": "358781ab-131f-489e-8a89-7940913fd05f", "comment": "Malware payload", "value": "5417163e487b9de92cf6187edce77d81", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773261705, "uuid": "139e7953-7b98-42a9-ba7c-5189e2137efe", "comment": "Malware payload", "value": "0b17532e1af027f0f34536876af6aa614a11eebf844ca2df7caf00f878ca246c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773261705, "uuid": "244d57bc-06fc-4cc7-a339-cf26f3128036", "comment": "Malware payload", "value": "25b068e1354f0ca3b47101accf107bdf71bd815d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773261705, "uuid": "d98d2089-9c36-47d6-b107-197019401867", "comment": "Malware payload", "value": "95081d4105129ff98d8af96abf4b68e1c9ad179772a70d143e9ce1613d2eea0b948c1904731d4567005c5d184d26605f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773261705, "uuid": "73ff5574-a941-454c-8068-4467fae0bdfd", "value": "T15AC3C85DE49F82CA4112BE285B4B486B9733908F070AC261732CCE6CEFDFD26A5957D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773261705, "uuid": "f982fd72-b838-4d36-9504-c9ff8114e4c6", "value": "768:S1GSdxqp/Q7fS3bSQSV9M7iEHwWwr6RPT0gtLhFid64ldZGNLwzwxR/TNjgwG3I0:1Yk3OV6cSZBi4IRJDoL6hArD5jCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773261705, "uuid": "24c851ea-c420-40d7-ac2d-a247dde570a0", "value": 123586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773261705, "uuid": "668101ae-2eb1-4e45-91b0-8a0e858d6059", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773261705, "uuid": "fcb7168b-da1e-4458-bb43-33eb543bf43f", "value": "Beta_Report_Winter_9029.webp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ef15bd-1d6e-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249733, "uuid": "7d813234-42cf-478a-94e7-c1866d11c99d", "comment": "Malware payload (WannaCry)", "value": "47bc7c8f1ac38746f74e543a4c421d75", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249733, "uuid": "eceeeefb-38d1-42e7-9179-c448a4c6a1b5", "comment": "Malware payload (WannaCry)", "value": "0b4e88fc1c9432ae79d167598aa1e26669698d7579c0e7d2e54555c953b19540", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249733, "uuid": "866c4f03-f634-4fc8-aaa1-da7cf0e9f377", "comment": "Malware payload (WannaCry)", "value": "684f0685aa6082b4d11b6eda6444163a2b3963dd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249733, "uuid": "daa8b537-5489-403a-bc54-1cbb568f4cc8", "comment": "Malware payload (WannaCry)", "value": "4eee4ebb95133a9bd2f7c1df4c246df4918b07bc15f033fb87f0d8c0fdb09825344ca6c5bf7c8eba2ccc2108fb02f1c8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249733, "uuid": "5180189b-7dfe-4992-b39e-e9dd14349c5d", "value": "T1123623F674EC80B4D106367594778E22F6BA7C39217AA94FAF804E311E13B96E718743", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249733, "uuid": "9116fe6e-afac-40f6-950c-2fab8bf85779", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249733, "uuid": "c5660ea4-3e71-4d58-a84f-188b5f833996", "value": "24576:RbLguriIfAMSirYbcMNgef0QeQjG/D8kIqRYoAdNLK:RnpAMSPbcBVQej/1IN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249733, "uuid": "0a1fe6e9-bb8b-42aa-a9ea-851691a87640", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249733, "uuid": "2b6474fc-0cf2-4492-9925-3b8330ec1dfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249733, "uuid": "766f28bc-7442-4a7a-86f7-080aefa1330e", "value": "0b4e88fc1c9432ae79d167598aa1e26669698d7579c0e7d2e54555c953b19540", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a0ca1e7-1d81-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773257655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773257655, "uuid": "cef9d6d0-2d8a-4acb-b1c2-f32550c0d524", "comment": "Malware payload", "value": "346dc46cb22dcbe0839d7c415cf0a18e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773257655, "uuid": "4f2a45e7-12a3-44d1-8d0d-b18854ecb5be", "comment": "Malware payload", "value": "0ba7e5de76c5e671e3bc5730dd5adb42dda536b249ce8c2e738391da9faf275c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773257655, "uuid": "bafcc193-4975-4d35-a957-cf79f9018f87", "comment": "Malware payload", "value": "e68fadcf13cd4d2ccc19980ebcf48b2aa32fd087", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773257655, "uuid": "f3928ee5-9eb7-4fdb-942a-d653c7de3d34", "comment": "Malware payload", "value": "0fc41b32a57e82ba073928a2e663866d3a1d471581fd548f11d7abf135b0de1dea783779c507ecd9456e064407a6b45d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773257655, "uuid": "467fd552-cb86-4dc5-b6be-4db850f0a205", "value": "T168D7331CA9245022F2A5D73A684344F0222DBF57D7469DBBA9D33C39134944A7FEB3AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773257655, "uuid": "f5eb0ff7-87cf-4ac9-9edb-29724fbbd079", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773257655, "uuid": "04c794a8-0ed5-4f61-bcb5-05cb628702a8", "value": "1572864:XiJkWNWvyhHmWLEow2Hjw9iQy5qPfaIGRF8zM0Cnze7IFp4wOyiJ1sC:XiPNWvyheyE9U6f1lCnz/AjyiJ1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773257655, "uuid": "888f5d18-02ad-4fdf-90a8-893ab266e242", "value": 60025601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773257655, "uuid": "c6c11217-33c2-43a0-8952-90f2fc3dd9b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773257655, "uuid": "f2134c01-6097-4602-8550-3da9ca72be2f", "value": "0ba7e5de76c5e671e3bc5730dd5adb42dda536b249ce8c2e738391da9faf275c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02801337-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249804, "uuid": "046c5eae-509e-43d9-b2e1-5157133de8e6", "comment": "Malware payload (WannaCry)", "value": "a775708ee00618a2fd4a22a2ccf4e5f2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249804, "uuid": "53f4f064-6ff0-45bd-be58-72b82f7aa17e", "comment": "Malware payload (WannaCry)", "value": "0bd60941229332da6a701443d9488421392a94e7e8703a0e134fcb02890fc173", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249804, "uuid": "076f1dd3-9e4e-4186-bced-a88ccf043ad3", "comment": "Malware payload (WannaCry)", "value": "e773b49215492c34b7c8842e8415f026582fa56d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249804, "uuid": "f8ec9015-648e-4b53-b3e4-f14130f5b9bd", "comment": "Malware payload (WannaCry)", "value": "28fa37c4d0028e7196715d64ccd277b351c41e1c33c53ace5495036bd23a01df9470c1a0d395b7eb582f2989e7dc8004", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249804, "uuid": "4dd01f66-1f4a-4658-9701-4b0b523df2ae", "value": "T1E2363358622CA1FCE0450EF40473896AB7B73C6966FE5E0F9BC086660D53B5BAFD0A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249804, "uuid": "f0c95d3a-8ff6-4d94-9cdc-f5aad7e53b30", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249804, "uuid": "b2024dc8-c746-4c52-9364-e3e48fcb4e28", "value": "98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P593RHp2H:+DqPe1Cxcxk3ZAEUadzRH4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249804, "uuid": "73cb9e5d-0605-4d52-8cb3-b75b130fedbb", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249804, "uuid": "b7da61ea-4dc1-4e57-a183-162fdb49f16c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249804, "uuid": "8f0ec79d-c1b2-4372-ac83-622771b68fd0", "value": "0bd60941229332da6a701443d9488421392a94e7e8703a0e134fcb02890fc173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ab7844-1d25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773218082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218082, "uuid": "4ef97b1b-d429-4b69-b73f-422f5fd52f5b", "comment": "Malware payload", "value": "262c2a45d48f39dbe4530a2f697d9b18", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218082, "uuid": "877d9106-cead-4358-a456-a322d7d6b134", "comment": "Malware payload", "value": "0bda489214bea8a58813dbf894ac6582c66e0640b736431b97ef26ccb4c8df99", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218082, "uuid": "75fb226b-6011-4aae-ae69-4d74170a8bce", "comment": "Malware payload", "value": "c26ab29d8017a8788bff4282d3ad61a0d8254cc5", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218082, "uuid": "d870df00-053e-46d1-a413-928933aeb96d", "comment": "Malware payload", "value": "73b6d1d351f448278791824392072b98d12ce96c26e111e4ee9ac7bef30a7d65eee4e035aaeb8c8c275d988ee83cf1e3", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218082, "uuid": "2dfb553b-25b7-48bd-a8ac-9e44f12515ae", "value": "T11B94F0B396C6BE7EC8AC55F7801775B0B1499E879874B0B2682317DD8C4270DA9460FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218082, "uuid": "50f707d3-69fe-488a-a603-07d41153e49d", "value": "12288:lktl/NXlQBkUK1DvgdMnLO5bcDtvVWqoypf083ROFT:Ax6k71D4SnLcbc5tWryp38p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773218082, "uuid": "39425531-fdf2-4007-8df6-3f2c31492650", "value": 421222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773218082, "uuid": "31b48da2-93a0-4a36-897f-a2a235bcb355", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218082, "uuid": "128f21b1-aee7-498a-b386-5ac82cb20d2d", "value": "PI A20626103 with support OPD15.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eda841b-1d53-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773237906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773237906, "uuid": "3b0be2a5-2adf-4d13-ad78-96b76f89fbd3", "comment": "Malware payload", "value": "e0554cebdbe763e88c5d5ff931ce92b7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773237906, "uuid": "88a4b16b-670e-4d61-9009-ef153e3b9616", "comment": "Malware payload", "value": "0c36ec4871d8ae00db587505d63a8b1e5eff2a8bc4813e33921d5f7d95e9257e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773237906, "uuid": "0bd7b54c-86b9-48f5-b902-9330b69e39ed", "comment": "Malware payload", "value": "02325f36a71d351fce420d810dc4fa54dec5885d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773237906, "uuid": "cd2a83b6-901e-4e8f-944e-2b73942657af", "comment": "Malware payload", "value": "a82a76bcd03b5f920a3258b40cf8fafedafa6a8d60e0b11296b0f321410a1419e7bfb101adcdf242810745f28a7cf470", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773237906, "uuid": "6699c6f9-0d5c-478c-bac3-a05169736f75", "value": "T1D9925DB512896C79FBD0CE399F3C7F4DADE8C2C42124A3ACBA4F39205A1166DC70535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773237906, "uuid": "b3fea59f-0aa2-498c-ad70-2456ccf9dd56", "value": "384:+SFcuQpWx+BL0SWL0gKzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:zF8i+BL0SI0FzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773237906, "uuid": "c342652c-4254-4c62-8068-eca7da660ec9", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773237906, "uuid": "495a9d4a-11b8-4009-b5d2-a55369efbc33", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773237906, "uuid": "81b21582-a59d-4e58-87c1-d15f80d508ce", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03431c1f-1d92-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773264838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773264838, "uuid": "abf7248f-33f5-429d-b73b-d0770a22b20e", "comment": "Malware payload (Mirai)", "value": "1cf651d9efdacc1351b76873420ceaa6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773264838, "uuid": "37e22b8b-b22e-43a8-9001-f239499b77cb", "comment": "Malware payload (Mirai)", "value": "0c55f2a946b94ed32f57442ad1476a9eac57f28be75c345c5b2db1964b445793", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773264838, "uuid": "782b3a95-7aef-4961-86ba-6a391fbd3a31", "comment": "Malware payload (Mirai)", "value": "8361eed27c2cbc9cdbee3df4f885fe6ed2d20af1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773264838, "uuid": "9647b91d-a2b7-4c6a-9710-4773b7152c50", "comment": "Malware payload (Mirai)", "value": "f3a252b1279e3d73a44b25c5eaa21f7756ee9640ce16155d6b13479b62df5791ffef05e7c9457ace957287667636b976", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773264838, "uuid": "b69a82ce-c7c2-46e9-a83b-7034217b1d0e", "value": "T1D901D8853530607076BBDCE64E33AC5C31E5909A3D867DFC7867A0DAA5B5C00B8624BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773264838, "uuid": "87d0ccc4-7475-44b7-afdd-02d09525bad4", "value": "12:YkF1kcClZF70SAZ/HFKZ/HFTZ/HFWjLbFSrLnFM5gFiLyjLbFSVLnFMDgFiL+A1B:ZDkH/FbkHFCHFVHFWjnF6rFM5gFiOjnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773264838, "uuid": "a5e970a3-b6c4-4b5e-96a6-421dcdca459c", "value": 744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773264838, "uuid": "dcc7ea4e-65bf-46ae-8f37-7da2d9ca62a1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773264838, "uuid": "dfaae8a4-38b6-4a35-9780-068b5b518537", "value": "all.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c17615-1d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773255415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255415, "uuid": "cf5dab4c-f8d9-41f0-8404-57a4aba37f49", "comment": "Malware payload (Mirai)", "value": "41e6a22ec0c82422a1735a46d98fe3aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255415, "uuid": "301cbfac-786a-444c-afa5-b013e4f84f07", "comment": "Malware payload (Mirai)", "value": "0c6b4044ccdd355bbe74aa9c512f163f5087f245219777bf36e39672ffb4f123", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255415, "uuid": "23e2fe24-9eff-4fb5-85b4-bf6ab2561e61", "comment": "Malware payload (Mirai)", "value": "d4d0d791f6b1cdda3d1394838a4dcf340e9b5974", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255415, "uuid": "b14e71cc-af95-40e7-ad39-373256b82245", "comment": "Malware payload (Mirai)", "value": "257bfdecf53b64cc25a2e646b6a503299f5ccc215e7bd8f5306233062ae30ff036634dfe7ca0837cc6792f8c66bf81c8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255415, "uuid": "6043c525-8a96-42d6-8379-f5c86a861d98", "value": "T1CA734B1332280F57D0534AB014FF5AF087BAFDD119E2B245A51EAFA84636FB62845F58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255415, "uuid": "9b315866-912c-48e1-86bb-8d09f9fcebc7", "value": "1536:ZlA8ruppHFxyEE3Mh9dLQ5OnxXvDqxu6toNGq:nzq7zEI9txtDqgyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773255415, "uuid": "6144425e-da2b-4028-93fa-9469a6c336db", "value": 78855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773255415, "uuid": "85edb876-7dca-432f-838c-ce282fe38ebe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255415, "uuid": "e267b002-9b36-4256-b8d8-0e237b572d12", "value": "xdlol.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23f8619-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217081, "uuid": "1a51cf53-e222-4783-8190-79e86a820a10", "comment": "Malware payload", "value": "d0334cab9f4791a8d420045f43c886e4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217081, "uuid": "a17e20b6-5989-4c2b-a44f-5f5a1347f47a", "comment": "Malware payload", "value": "0c6ec88dde105d5ecd9ae77d7d1e31da4115561f828a56b0056f695f157d3c50", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217081, "uuid": "e604cf1b-0dc5-4c88-83aa-774acdf2694d", "comment": "Malware payload", "value": "f5179c7483a86621051fb6c74cdda5bbd70c26bd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217081, "uuid": "4abc0519-5586-450b-946e-68aeea196d3b", "comment": "Malware payload", "value": "050160fb36f65afc406392fc13872d088bdf9b068c840dcc9f88ac01270585907d981e480737bd541ccdb544bf49d79d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217081, "uuid": "d294fbcc-ad27-4934-a1a0-35cf8941e0e5", "value": "T1E8C1C67DD2E4A7714A2F48EDB538014DA625C79813263E540B4F8C2AEFC8874DD3D5AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217081, "uuid": "183d90dd-a611-4fbe-8040-45a4f4ac077e", "value": "96:6FJ8QDcq/NrN9MtOPVxQsGraYu14OqJXymDpzvyaBr:H1q/NR9MsPVirzu14OoXymFzvdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217081, "uuid": "79a20eae-e3e9-4015-9561-63ad3a3b9910", "value": 5755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217081, "uuid": "af7c78f7-17b3-44ae-a6d3-e8e5e724cc19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217081, "uuid": "cd7f1bd8-8b78-45a3-8070-d81f76a78d87", "value": "d0334cab9f4791a8d420045f43c886e4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23aca7e-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217860, "uuid": "43e9b223-7603-4710-b0da-2c94f91dde18", "comment": "Malware payload (Mirai)", "value": "a4f87e224311957182dc722bc634c56b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217860, "uuid": "cca09e7c-6fa3-4819-8ac0-c980ee32d2b9", "comment": "Malware payload (Mirai)", "value": "0d49688edbdc33256695826bd036b55f7b8eb84b93f006642c6fd4865fc63592", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217860, "uuid": "bfd77365-1008-4099-a9c6-4b764488b42a", "comment": "Malware payload (Mirai)", "value": "ee120acb1f8c421d67c9b541fe855360eee25117", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217860, "uuid": "9ab6fa59-1ee0-4f0d-bde1-ac35e2fd6ec5", "comment": "Malware payload (Mirai)", "value": "2b40a492e50b23bd7f96b934263fac81553b56757284d9ebaa5f5c1a8df251c5c59c82e0dc5ed637e2b4f49db12f5ca2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217860, "uuid": "78504d7a-455a-4d81-8192-828faebeb823", "value": "T187863840FECB14F6EA031D3154ABB22F23355D068B24DBD7EA447F2AF97B6911932249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217860, "uuid": "c7f18f4b-244d-47b0-9db1-670fc2670e63", "value": "49152:x5XsInMz+omYd7YsDlhdFrCZp/C8EHrhDu4UKZhDXb3IBIM+hiulgIkN3bhxbP6l:HsInMzKkYkz5hDuVKZp3DmGrgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217860, "uuid": "15892505-4f39-43b9-a82c-2f5870622562", "value": 7972928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217860, "uuid": "7d6f4991-dffc-420a-9b2d-3070917db839", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217860, "uuid": "76d60d7e-169c-4664-895c-58b96618b151", "value": "kworkerd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13125807-1d29-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773219767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773219767, "uuid": "47c6aa23-e9cc-4912-99f6-15a0037fca8c", "comment": "Malware payload", "value": "d4b26b83696c62f3333119ad53696a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773219767, "uuid": "992996ad-9214-486a-b335-bb4cfaac1928", "comment": "Malware payload", "value": "0d9fdc3349e9997db430d4ff9b4985dd05319c4430e751d07af3ae659c73cf51", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773219767, "uuid": "a49dbe98-5e09-404a-8870-f4899ae4f660", "comment": "Malware payload", "value": "b595a6de0f6a18975b29e6f8ebe604956a173478", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773219767, "uuid": "ad6b10c4-f3f9-43b9-aded-785cdc041d98", "comment": "Malware payload", "value": "3d1ec8c47b4360d6b6efa602aa87b58c342772ea3b00d3f162cfe26bf0614ae5c9c394a8d9ada85b595aa329d3792859", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773219767, "uuid": "62bdd243-4d8c-40ed-948c-3b5ed5da75a1", "value": "T16EA65B07ECA248E5C1EDD1308A769252BE71BC495B3123D72B90F7682F73BD06AB9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773219767, "uuid": "eab51ee2-7a55-4838-8366-6b078ad78cd1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773219767, "uuid": "dacb71ca-fb86-4a0c-977d-ae5f685d271c", "value": "98304:nQzVkeWFptqwXe5cWokKkqqrHfskEGCn+E:nQSFFzqwSKkqqrHfskEGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773219767, "uuid": "462c177a-ee70-4554-8ad8-a494c4ca91e6", "value": 9772544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773219767, "uuid": "e8ded10f-9ec1-4687-8518-0470d98eeb32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773219767, "uuid": "011064b5-6c63-49ec-9ad0-3d0d11e7518d", "value": "me.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cbd1038-1d8c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773262384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773262384, "uuid": "6407bf0f-0476-4555-a0e5-d10104fa013b", "comment": "Malware payload", "value": "54299eae5c893a500930cce6efcd311f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773262384, "uuid": "f9b01d08-e5e4-44f3-8e8d-35ab135904c0", "comment": "Malware payload", "value": "0e3451d9e10093f8980f2799ea2f2838df8b75395ec17e5f40c63d06decc63df", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773262384, "uuid": "bd3e8e7d-15ec-4f99-bd3b-c8d586bc0f3e", "comment": "Malware payload", "value": "0a6fedf0e8fea5969a200af894f6c2e748e7274c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773262384, "uuid": "eec5b6ff-569c-4ab1-942b-8b6d17bc70b5", "comment": "Malware payload", "value": "21af2afdcbb78ccdca6723bda226b4c3ffc10aaead4557d7bb4ace24d1500df0db43c22de497c7f4daa9a69a6c275bdb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773262384, "uuid": "ea4fb6b9-11b8-479a-ae10-db1466d82851", "value": "T1EAF1F03B21F08B71D3C021C9526656664E72A75B996A14B8F4BF533ADF2DA0330E7B34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773262384, "uuid": "90596c78-beaf-4250-9083-c3e6ec3f0a50", "value": "96:cCu/mB657sht+O+v1fsn+h4+tIicqbA/GsGOMbSm3uC:cCu/K65C4hvZ5mzjy+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773262384, "uuid": "b317007f-52a8-4232-b55f-777f29ad3115", "value": 7757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773262384, "uuid": "d13b4d5f-8862-48ca-a55e-f81c30396072", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773262384, "uuid": "802de1de-b7ef-4e71-983d-0754eae94f23", "value": "0e3451d9e10093f8980f2799ea2f2838df8b75395ec17e5f40c63d06decc63df.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e2ef14-1d21-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773216336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216336, "uuid": "03ab166d-8a9f-41b2-a80e-e4270df8ee36", "comment": "Malware payload (Formbook)", "value": "863fc344559496b5edac4af4a1ed9706", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216336, "uuid": "0fb72af8-1334-4c78-b4a4-bf3b134385a0", "comment": "Malware payload (Formbook)", "value": "0e6a0dda6d54291452adeb1d7515cc8edad2705807d5a0343340ce7122cef8b1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216336, "uuid": "f7b3a54d-2b2a-4aa6-99f4-0e41ecae4bb4", "comment": "Malware payload (Formbook)", "value": "0143999e3fbf5c1e2f3416937d2c94be01c95124", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216336, "uuid": "e2a66566-bc38-40a9-9e0e-49c6478fb003", "comment": "Malware payload (Formbook)", "value": "dfecbe12788894359fa0832bbba0cb91a33496aafe9986f9efbf3dea86395dca0e97f6a1a54a47861eeea42972be8775", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216336, "uuid": "7efd7f2a-b1d4-4a4b-8889-90d59adcc744", "value": "T118550B1E237FE046D97BAB368AE620F0F57FB4BA119163D81BE705B14D8A2D9C353112", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216336, "uuid": "e6ecbdb5-2dfb-4279-bdba-a1949e5892c8", "value": "96:rGU4x40iTVmutLhQolaFeDEnGgaPr94H0vz346DZm:rGYXr9Jzo6tm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216336, "uuid": "e46b5a38-3ea6-4fd7-a1b7-4897afde3738", "value": 1294887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216336, "uuid": "0d4894ed-a9e0-4e99-b378-326619e3c759", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216336, "uuid": "0b5fa92f-5491-468d-b9fa-c2879f3f6637", "value": "863fc344559496b5edac4af4a1ed9706.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a6cbc0-1d23-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773217169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217169, "uuid": "61839daf-44e6-4716-b965-7598670c4419", "comment": "Malware payload (AgentTesla)", "value": "47ad19c5ca2c7d4f54da637e2157a1be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217169, "uuid": "c02e2d66-9491-4d46-a8db-37c975b5d39a", "comment": "Malware payload (AgentTesla)", "value": "111a5814de1debb5cdfb6d9b8b4fde44aada700c7a78e002111ffe07fbd21f16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217169, "uuid": "0e236495-1686-478a-acd6-c31d87a5fa8f", "comment": "Malware payload (AgentTesla)", "value": "12130f77d9832de6b66dfdcae138a68f438189fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217169, "uuid": "113e6caa-73f1-47da-9898-4d66333b6dfb", "comment": "Malware payload (AgentTesla)", "value": "2c97c9a8d641d7a891ab36e667ae400389019d3c72c957481d409677620cceafccfa038774b19fbd7db102b22ac9e914", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217169, "uuid": "b5a8803b-e223-4a2c-a6ca-861004b79cbb", "value": "T1DC558E0551E91E618FC63A299C7A30069767D49B2673284BEE9B598F0CFFB48017B337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217169, "uuid": "47693699-04a0-4849-95fd-0c66fbbaac28", "value": "12288:zx2unvxMSrfF2BEhSzMLju+MsMSOXHGtjOnK0XL0/hlD+v/GjrhufyWlsW:lnvxRoss6qToQ0/zD+KrhufNsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217169, "uuid": "b5bdb992-e2bf-43a9-b402-92ba524ef32d", "value": 1340975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217169, "uuid": "f2e3ab3f-815b-4945-a1d7-7c454cab5c84", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217169, "uuid": "b08027e7-3bb6-49b5-8651-e32a5dfb402f", "value": "47ad19c5ca2c7d4f54da637e2157a1be.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd946210-1d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773256587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256587, "uuid": "fb297866-05b4-44ad-83c1-0f6f3759a802", "comment": "Malware payload (Mirai)", "value": "3f89e54f8abd2d44d68f6296bc029c20", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256587, "uuid": "f373e80e-3497-4f58-85ea-e418b240074d", "comment": "Malware payload (Mirai)", "value": "12312bc7cf6ec1db36cef76354f4ed420f484d9b333e912d90671d59247c7a5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256587, "uuid": "c650c14c-08ce-4b23-9967-04e4e4a876cd", "comment": "Malware payload (Mirai)", "value": "c633ab1452d941f43420c92028994e9333d6c481", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256587, "uuid": "a95e7878-2387-49e5-afcf-8f6195dd02b9", "comment": "Malware payload (Mirai)", "value": "f4c054f61dff9abf962bcde467b9cbbbc47041c5da070634f52cb136b01c62bd44b68d79e914244cf2619d2317be0347", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256587, "uuid": "1fa96d20-07bc-4cbc-9a90-473f8d16c633", "value": "T150437CC4AA83E4F5FC9701751033A73B5A72F4351069DA87C369D93BBC52A11EA2B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256587, "uuid": "f219b7d9-85c1-47d7-83a3-6f5b74db7336", "value": "1536:ZyN5z8bAOpvnd02e98v2POtI7inBDu+JSz0RZ17+v2nzhNKSM:0N5wUOpvnReO2WtI+gz0r1K+nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773256587, "uuid": "93632b82-faac-44a4-9344-cdcdbf72ed8b", "value": 59152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773256587, "uuid": "7304ccc3-760a-4eab-9552-4885f94d004a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256587, "uuid": "77efe98d-05ea-4068-92aa-5d2d4844bf28", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3c796d-1d78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773254092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773254092, "uuid": "1f9ce617-ea4d-4a6c-acfe-3b873f28ea44", "comment": "Malware payload", "value": "56aca1bb5385a7e1750c97aff1867ebe", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773254092, "uuid": "98e618aa-6ba9-4491-a798-7244b73e0590", "comment": "Malware payload", "value": "138b6970f055ba44f3cc67cc6a8ac7a073bb121f7ee8ac8382049bcaec24dcee", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773254092, "uuid": "d3beae10-4abb-4ade-8546-71f45b72c8b5", "comment": "Malware payload", "value": "205fdebf9dce22eae812c678c08f2d2b84d71172", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773254092, "uuid": "ae343a7e-b722-4a85-a52f-f9c995c117ea", "comment": "Malware payload", "value": "af4c019500a5dbe37679e9f5ada13803359614ae4ba425f55eeed7795d45deeed280cff7ae7a654c3af9ff170fae5235", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773254092, "uuid": "68e91733-4a76-4b4f-8686-cfa88360acf8", "value": "T16086020EAC5209F7C499777988E2A660BAB0B8480F347BD31B5875B83E753E16D7178C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773254092, "uuid": "85362353-dbd3-4ae3-bcd3-33271781b870", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773254092, "uuid": "49906a6f-6729-4733-8676-f7641919e65d", "value": "196608:Ifce4YwKLu2tYg59qU0Putx2QIr+h6Feyrca:IEf4us9qtPutx2x++eyca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773254092, "uuid": "a367b1cf-92d9-41c7-8079-b565171df5cc", "value": 8310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773254092, "uuid": "42124df2-d063-452c-8eb4-c5853f5b4d90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773254092, "uuid": "0b394317-76f6-4133-a72c-bdee436bf728", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9114f838-1d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773256486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256486, "uuid": "d8a2301c-3dc6-477e-b039-a1445958b3fe", "comment": "Malware payload (Mirai)", "value": "6a3bdfab1788db8d621775d6a4355e8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256486, "uuid": "366e8af1-12b5-4639-9b19-ca6367bd2f6c", "comment": "Malware payload (Mirai)", "value": "13ce1b0a3f6e140e1dccba525abbc2c603107697321526a145c69e022a87956c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256486, "uuid": "62b66787-fc76-4dfd-a69a-1a2ff756c87b", "comment": "Malware payload (Mirai)", "value": "c5cd6d5ec7b43a98ce53e54c71bf263a529cd39e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256486, "uuid": "685bd3af-a709-43a4-902d-fda3027ec50f", "comment": "Malware payload (Mirai)", "value": "05f97cb94f150563100b77a12d9dc3f74127ce3e973eccc4b6b8d485ff1eeb09e655576ca6f4d1dafbdcc47f9935f44b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256486, "uuid": "b704211a-b4b1-4d40-8f98-893630169b56", "value": "T11CE33A46E6408B13C0D6177ABADF42453323AB64D3EB73059928BFB43F8679E0E67605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256486, "uuid": "129f89ba-d432-4cd0-be8c-a14bfb82702b", "value": "3072:7F6tU9eEaDTzbx8PhGWNFYX7QfK8EBLzrUDM/9kS:7F6fEaDTzbx8PnNE7cKHBLzgDM/9kS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773256486, "uuid": "5fb25de9-1be4-493f-bcb6-27f70d205adb", "value": 154295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773256486, "uuid": "f9147590-371f-433d-b397-ac11085af494", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256486, "uuid": "c1ffdf23-8d34-4111-b67b-30404d9de463", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc83716-1d60-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773243647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243647, "uuid": "1322cca6-395e-4727-a8c8-bdcf2062c24d", "comment": "Malware payload (Vidar)", "value": "2de3786404c6afe8cb3f60c66fa6db5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243647, "uuid": "9ab5abd4-c35c-4fb0-850a-22fa4a19270c", "comment": "Malware payload (Vidar)", "value": "14824eb52d914d4c74d4ae481c6514464836381a347751c55d1380e3cc7c5391", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243647, "uuid": "eb868453-ef53-47b8-b6c6-6ad70705ba13", "comment": "Malware payload (Vidar)", "value": "0949adbf5f7322c99078f10920e95ff2ede37b10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243647, "uuid": "509b3ae9-25ed-4b57-9bcc-3dc8feba13b0", "comment": "Malware payload (Vidar)", "value": "1a29adb66f4f926909a3d0e19505595f8ca85c339bcba82a58c6fa74a9c08cc0ca12e5fec9503c8f17dd7d856b5fcd15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243647, "uuid": "4c685f9e-fb6f-4f79-b6b7-5abda5e42d7e", "value": "T18EB57B0BBCA508F6D46A97328DB762913B75FC490B3223D31E61BA782F726D09D79704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243647, "uuid": "69acb25a-1e38-4ab3-8d35-d2ef7a5171b4", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243647, "uuid": "fc7cb879-d260-4385-8317-2ede8346a778", "value": "24576:55/fJWGPSvPTwSrupHojyhYPtOrS+6H2WoG//L5bJGlVuaJx5QEHUUB4pzAVt/Gf:55/hWGPSvbT7jM6k/R5bHUYOzAka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243647, "uuid": "277fd611-167b-45cf-9ba5-b22f7b252067", "value": 2269184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243647, "uuid": "b8512972-9900-4756-b033-4a1153d1ab35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243647, "uuid": "a4d2002d-70a2-4c13-9d39-55273ca781d7", "value": "14824eb52d914d4c74d4ae481c6514464836381a347751c55d1380e3cc7c5391.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d82bace1-1d25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773218380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218380, "uuid": "ef33666d-cbaf-4f20-aacf-624c3f3dfae8", "comment": "Malware payload", "value": "68ff472d8ff5625b9f717156ae8817ec", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218380, "uuid": "d08f7afe-e517-4df3-ba8d-7fb7b20e1dfd", "comment": "Malware payload", "value": "14c5eda6afe6fd71a01a35d791c60cd4684474ee403c15ae584a1efb23b05069", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218380, "uuid": "a0b6439a-154e-4904-8e8d-3e2389fbb693", "comment": "Malware payload", "value": "90379f0c9f73ff908b58d3aa02f20298d186cb59", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218380, "uuid": "75bc02df-a91f-412e-a952-31b1d105521e", "comment": "Malware payload", "value": "a2b56e400090652dc906005d2fcc9e23f0442c825513c715603a0ed6200152facb078428d91a5f02ba0dbf5cbbe82c95", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218380, "uuid": "719a5d0b-c483-4d4a-a3d6-3c260f4a175a", "value": "T147D5338C6B5B3454918157375E50E3AFAD846FF9D8DD2611B9C27300EE40E9727284FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218380, "uuid": "b4f65fbd-01bd-4aec-baca-b81b8c730d27", "value": "49152:L8bCZMriDgUfl8WC/cZEb3jAwQad3wGQ+hDLfL/smwJKpilTsMEIF:g2aclVNEb3TQq9ZLrsmwJKOsBIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773218380, "uuid": "833a88aa-d015-426b-ba96-217157b0213b", "value": 2759914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773218380, "uuid": "29ecb1f7-0ddd-458c-be7b-96a489bbc9f3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218380, "uuid": "9e864f69-793d-4a91-abfe-bc1b8a329f76", "value": "android\u7248.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b23087-1d23-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773217470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217470, "uuid": "319db695-85a5-44d6-b9c8-7a03c9f7a2a8", "comment": "Malware payload (AgentTesla)", "value": "0eeb973dea4655c7ddf7ce9871c284d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217470, "uuid": "c29b658e-bf75-47a1-bd2c-f1d7685987dd", "comment": "Malware payload (AgentTesla)", "value": "16d6541ee05ed78178d0db6672b7632c2ff097925999c3c0db0c2a01cfb87a61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217470, "uuid": "2bf3c63e-ebcc-4f09-b1a7-9bf6a2329df0", "comment": "Malware payload (AgentTesla)", "value": "76b9cceeaaea0f6c7483ebec9af0831bc5424cb0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217470, "uuid": "72fa9dbe-b2cc-4103-a0fc-55ec8533c73e", "comment": "Malware payload (AgentTesla)", "value": "92c299673470692a7148250434578aa3d79d107692dacb4a481089e970aa96a9e0565245d36b13140cc92f12923e1e6d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217470, "uuid": "970bde65-0d1b-4095-9650-8667cc7bef4b", "value": "T1B3559D0587D99710CB68122630BD971F63DAC7971009ABDADFE37B1726F6328A317398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217470, "uuid": "2362bab9-e7cf-4a2f-b0ee-3d598d2d086d", "value": "12288:JhSBqCke5QTGwIycT4A3ieJ/iPIu0DAfKjQ+CwDVhuClUY0A3ltaBVB+qbuVoOwZ:7SBqCLuqdV5doBX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217470, "uuid": "908efa31-e01a-439a-a960-8783af3f37e9", "value": 1352982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217470, "uuid": "2b533ac0-701e-4702-bb78-2efd2d33af4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217470, "uuid": "35dbda10-fa25-40ce-90f8-559a0afb5680", "value": "0eeb973dea4655c7ddf7ce9871c284d8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81716734-1d41-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773230260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773230260, "uuid": "ae2debb7-8486-43b8-9356-ee08297d01b1", "comment": "Malware payload", "value": "20fb78822bf7675fd590cd183533a686", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773230260, "uuid": "0e255361-7831-4c74-ac01-6999e7d80ff6", "comment": "Malware payload", "value": "177932b2db172c45a106b247565b61f46c0c2e323e35efb41603500c91e187e1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773230260, "uuid": "bb32f5a9-04cd-44df-b911-9975f889bbe1", "comment": "Malware payload", "value": "a1de4adf9a31eaa4ff6926b290410ce3b2674d49", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773230260, "uuid": "3abec7f0-180f-4cfc-8dba-7d7f4a0ab4cf", "comment": "Malware payload", "value": "3385c64e794e174c9e948511871cd2377816669b8e39df3c4b0fe501cfd7d84b5510a32fb3d07a5e6b016d71d27b80df", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773230260, "uuid": "fd5426ae-101a-4b60-a340-23c1e8611363", "value": "T19A925DB512896C79FBD0CE399F3C7F4DADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773230260, "uuid": "3bf175d7-a7a3-4891-93a4-10d35502bcc9", "value": "384:bFcuQpWx+BL0SWL0gyzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:bF8i+BL0SI0xzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773230260, "uuid": "b192c622-4483-4b08-82b3-f98494650232", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773230260, "uuid": "592335e5-e02c-4e29-b8a5-45ff816fd1e7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773230260, "uuid": "b280f29e-6e2a-47d1-9986-eea0e3a76b64", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f334c32-1d1f-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773215546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215546, "uuid": "eee7d931-f0c8-4d82-88f9-a390abdeaf08", "comment": "Malware payload (ACRStealer)", "value": "df43de7e53c72b30f1372de84f47ebcb", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215546, "uuid": "a1b2af37-e866-46eb-8617-c3f8c0659789", "comment": "Malware payload (ACRStealer)", "value": "17878934fc7db5810a6d235f2810c20501a3330bb0554c998865a2a65baf74f1", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215546, "uuid": "d43bad77-5c29-4a71-aa45-b0bf1e3355c5", "comment": "Malware payload (ACRStealer)", "value": "03b18f3c7f7a6b61c2384c90d0c395734a5ca6d4", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215546, "uuid": "0c2c9c2b-de41-47f9-b19b-854c395d876e", "comment": "Malware payload (ACRStealer)", "value": "4ca90bc88d6ac834aab9fe9229f92681d7e6414e9acf4d53be0f7c43011e32e67293a637d04933d9e60e1449f9bde4fe", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215546, "uuid": "8be7b8a4-a7c6-4962-a54b-7b2891d247af", "value": "T19D756C95F6EA05F2E6AF843C858A554FE732BC2507B1C7CF02916A5E9EF36C11E38181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215546, "uuid": "94b726c1-6542-4acc-9e22-6656aeeaec1d", "value": "866d140b03db81ead01fc5d7ce53ec52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215546, "uuid": "ba5531af-1572-42b5-94c4-4657f12fec8e", "value": "24576:C5XuZSUkyZtDKWA8DVFRhJUoLUBt5H/zDQZMRxZcnkOZ+RhvAx:9tOWdDVrhJFKtl/zDiMRxZjOZ+R9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773215546, "uuid": "a34b23e4-469c-4c91-9c07-db64adae5b1b", "value": 1604608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773215546, "uuid": "89c9f721-6841-4d1c-a649-4542ff833e49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215546, "uuid": "dcfc54a9-de36-472b-9ef3-22874e029041", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae787ed-1d25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773218384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218384, "uuid": "285417d5-f7ed-4952-bab7-36d4eccde931", "comment": "Malware payload", "value": "a0feaefbe343954e61544f32827ccb96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218384, "uuid": "24de39f3-9010-4ef4-8b52-bf11606f9100", "comment": "Malware payload", "value": "17d2b3fb0c1942c43588d26ba9aecd6f6a9a549f86a8bb4120865cfbd9caf137", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218384, "uuid": "a9483f4b-44ee-4c4b-9929-4a19295b9be2", "comment": "Malware payload", "value": "2c3470eaea2614ee5d3385c073abd4f1260bd3d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218384, "uuid": "d895b447-750b-48d5-a0c7-e06c59ceac12", "comment": "Malware payload", "value": "1d5c770a4e382cb51ef5feca44c7f1bca11a68a85d0a31f6f36cc09b4af85e510a998fccc194be1e89dbf084c256a40a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218384, "uuid": "34e22fe6-8e51-40ee-96b1-d4842e7db01d", "value": "T1956733BB5212685DE0A7CAB4B0C1DA6150633D2C08B1124F62EF13D92DB265F6F7E25F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218384, "uuid": "9097e0be-cc32-4f65-b579-dc37e995133b", "value": "4a69501d065aecd17da3f8f42bc46478", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218384, "uuid": "639c470c-9d0b-4cbc-95ee-d5dbe67ae477", "value": "786432:B+G5eaaDqy3rc/OlBy9g4aLpOQlqjfLZSZoK:fcrc/OlBhhLphlEfVSqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773218384, "uuid": "ba2cfb17-e640-4183-9b0c-c11940b9f8dc", "value": 30344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773218384, "uuid": "9403e9d5-2c0a-41c2-80ea-d3803beb4472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218384, "uuid": "89f1d505-bcac-4256-88cc-ae8340102558", "value": "autocad_v1.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ce4277-1d5f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773242985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242985, "uuid": "b9a5b591-c0f4-46fd-b563-1d4d3c3a8fee", "comment": "Malware payload (ConnectWise)", "value": "92141b1d875854e40a97ace4da54c60f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242985, "uuid": "33712a9e-dce7-47cb-a482-4cea952c706e", "comment": "Malware payload (ConnectWise)", "value": "180b959eaecaa6c410af4f4445befcde5947a537ec396196fda014258625e2dd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242985, "uuid": "626fb748-5b3b-486d-9bfe-1d89f7c622ca", "comment": "Malware payload (ConnectWise)", "value": "c6e87e54ec01dbf9f326e908c7ce3136b9cc6f00", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242985, "uuid": "5473ccbd-3f49-47cf-bf3a-b0c424ac07a1", "comment": "Malware payload (ConnectWise)", "value": "9ac53ffc355bb9d2093f5ac8cf8975b4de9e655674a838e01ee80f8669cbfd78c9267d6016b25ae90c5994e9d8ba9caf", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242985, "uuid": "0ccf5c93-a31b-4457-84a5-a33369a91667", "value": "T17E96232277FA952DE0F21A39EE3986F01C7A7C149A21C15E87A57D1E3931E80D4B2773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242985, "uuid": "dbcf80e0-0e53-4622-ba30-73bec391fa09", "value": "196608:OmVT1P0ZO10P53/vmVT1P0ZO10imVT1P0ZO109mVT1P0ZO10xmVT1P0ZO10:dVT1sZ/P53/OVT1sZ/BVT1sZ/AVT1sZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773242985, "uuid": "7157fd0f-906c-4f12-b8c4-0d8f2189e1b2", "value": 9105408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773242985, "uuid": "200456f5-2bbc-42bd-83be-3d2ddd5c1d91", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242985, "uuid": "f5a7a8b9-11c8-4e4a-968f-c23d35d40248", "value": "Factura.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821f5845-1d23-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773217376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217376, "uuid": "73be894f-bf63-4c00-9591-d5b4097f0dc4", "comment": "Malware payload (AsyncRAT)", "value": "293c87b44973148ccdb7c1c03f12e8cd", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217376, "uuid": "869df9d0-0454-438f-b9c0-315b9655266d", "comment": "Malware payload (AsyncRAT)", "value": "1828531fbc67051335ec19f5e7ff29b3567afb12e3bd30acbb2e59f153728364", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217376, "uuid": "bd4faccb-b692-4b41-a021-50f696c275e8", "comment": "Malware payload (AsyncRAT)", "value": "8c55824696bd107bac06ffe9bb00789a81f91546", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217376, "uuid": "73869e6c-8fbf-48b0-8928-ea07e08a64fc", "comment": "Malware payload (AsyncRAT)", "value": "483cc30ca8f6273cde18f0686dd59a29e104c10d0e47b400639831dc9735b1ca96429f38fbf373f371f2b2e057a5074b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217376, "uuid": "3ed60051-64b5-4fe8-9e76-951bdc9903df", "value": "T1BF748E98B8E1979A8B86041330FEF2EB71B58EF56513F2BFEAF4542DE151244C4B31A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217376, "uuid": "a80ae785-1205-44c0-9884-4783c836a0a0", "value": "6144:Jupxs0UGe9cQiJgZpuZ/7wd1qiOBNqG7x:Jup2gJsQZEPwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217376, "uuid": "994cf6b7-64b0-4367-8e56-e39ea666a979", "value": 339642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217376, "uuid": "b3aaf1b0-3eef-4fc3-8bcf-e6f9935f8b2a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217376, "uuid": "6ee7a0f4-5510-4c58-a01d-388bb763f030", "value": "293c87b44973148ccdb7c1c03f12e8cd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ed3055-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249817, "uuid": "8af4f000-1997-41ab-b089-db919cc3020d", "comment": "Malware payload (WannaCry)", "value": "2b4d3c993bc777de8d10ac080e3e5c00", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249817, "uuid": "8fc02be8-073d-4c2b-84f5-b120552a3611", "comment": "Malware payload (WannaCry)", "value": "1914ed77c7c2a95fd0e5a63379f10952a8157d61446949ee6983f9bf421a238d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249817, "uuid": "276fb951-5d19-4d3f-ad46-8260147a0780", "comment": "Malware payload (WannaCry)", "value": "9880a071411041cdc9602115e8d7e416d5b03d32", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249817, "uuid": "01493415-f3b5-4ec0-b94e-5ed0caa3694a", "comment": "Malware payload (WannaCry)", "value": "3c215b7fece2c80b0e18bb8df8dab9781bbbf1a779bd43c28c76c30626c15c427883f193d59f27cd1ea2964155b5df4e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249817, "uuid": "97358791-2047-4494-ac48-ec3487eb8e3b", "value": "T1E33633A4A36CE2B8E24C29B404A38E1EB6723C6157FF1E0F474449760D5376FAF90A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249817, "uuid": "43bec16d-b3e2-42b4-b532-b6aac09810f1", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249817, "uuid": "bc7443e1-a467-4db8-b7a4-187896ff42ad", "value": "98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P593:+DqPe1Cxcxk3ZAEUadz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249817, "uuid": "2c23ad6d-5355-470b-8177-bc44e9573bbe", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249817, "uuid": "17ecbaaf-baab-4c34-8f0b-40e2e0062c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249817, "uuid": "cfa1a2e0-739a-4818-9d56-0126324dfa98", "value": "1914ed77c7c2a95fd0e5a63379f10952a8157d61446949ee6983f9bf421a238d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233e0851-1d28-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773219365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773219365, "uuid": "3523da66-6954-4490-89f3-7f8b4135c411", "comment": "Malware payload", "value": "a8cdd95a23cd00b4f4bd9180292025e8", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773219365, "uuid": "667acbdd-0bf8-44c0-8ac5-beadd3039815", "comment": "Malware payload", "value": "191b7d804e65d9f7cf456458639edd98eb69f00d97111fcefd8a337dea886412", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773219365, "uuid": "5e64783e-dee9-4a59-8f1d-1924d8375ab4", "comment": "Malware payload", "value": "8c35c45757895af1070cd3c46bbacdf2b6af29bb", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773219365, "uuid": "88a64ef7-b668-4bf2-bbd3-92ab4e37ce2e", "comment": "Malware payload", "value": "66840f206d6976fee5a076ca42a4780702b363b822ebc6df3d5464d5e7c668d8c2757665f09a0f19b711a446a2f6a63c", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773219365, "uuid": "5a25128c-af26-40a9-acbf-7696ded1402d", "value": "T1F852186E361639CAF44498326019EF4423653E85B9E3DBB07AC9FF7B2B84055B318078", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773219365, "uuid": "d0dad829-1259-49b2-901c-a10f91b51135", "value": "192:s+V81vn2I7mKGYCBEPzTCKOx0zHzHNVdv1xw6uH3tUn5MiLq+syeKFBq8yirqPx0:s+VUhmKGY5TgYHBV71atA5ENKdoo+W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773219365, "uuid": "9d321462-694b-4a6a-afbe-f7bd88749a2f", "value": 13905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773219365, "uuid": "e1614a21-8a73-462d-8dba-f3e784bf3b1f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773219365, "uuid": "f2e615d0-cb68-4be9-9c65-cebc264655cb", "value": "Orden de compra.pdf.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724a6cad-1d20-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773216061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216061, "uuid": "09707b63-ef36-457c-bb88-848a34b94f1f", "comment": "Malware payload (AgentTesla)", "value": "708a4e1b4faf6021adf126573dd641e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216061, "uuid": "c7f528ad-d3ff-4bd2-9a02-1a995940a143", "comment": "Malware payload (AgentTesla)", "value": "19515995ceaefc174b541d157c1d62a366b062c3bfec7adca2b66555222a0dac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216061, "uuid": "7c06997b-2e12-49b5-902e-797d8da57f30", "comment": "Malware payload (AgentTesla)", "value": "7c415201b357306ea11d4cd0f6918c54b3b0b58c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216061, "uuid": "704837dc-1513-4a94-bf4f-37124e66ab2c", "comment": "Malware payload (AgentTesla)", "value": "8b24dd4584c19d9228f715827ee1bf55600832e91e7427e2155cc389a82b9e1b415299cf51b4e2248b1e84d8c866e2f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216061, "uuid": "d9a7ebc5-74b1-46a2-b853-084afbe9b8c9", "value": "T12B45F0A032E9C817C11886F80961F1B15BB51CBF9452D286BEDD6DEBBFD2F401A07A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216061, "uuid": "3e5338c0-64ed-4865-b518-393b1832db83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216061, "uuid": "df63edb8-14f2-48e7-a41e-4f8cf3b02af0", "value": "24576:P0Vi0VhLkSHk0/uWmLmdrhHru//3flMQBkXrlycoOoOe0V:MVtVhZlhZz6/PflM4kpCOoO5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216061, "uuid": "66fd165f-2874-48f5-9685-aa186668eafe", "value": 1246208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216061, "uuid": "78a49b74-6765-490e-9e6a-59d2901e5e2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216061, "uuid": "2b65803a-3c2d-49eb-b8da-5a0f6dcbb651", "value": "708a4e1b4faf6021adf126573dd641e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff3523e-1cfa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773199656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199656, "uuid": "4ce64f97-b1a6-4b82-a2cc-4c4996757e78", "comment": "Malware payload", "value": "74b263a6a6d4f7846f5f942da3acf4c7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199656, "uuid": "7c8607fb-8649-45d2-a01e-f9a9dcfaee4f", "comment": "Malware payload", "value": "197380d8afbaf4fa7c2b1b970fde14629388b956e27413082bffe2ca746cf732", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199656, "uuid": "8a40462f-fa90-4127-9bf7-23b943a16f01", "comment": "Malware payload", "value": "1c39e0db85f4e272b5fa334918c5c95d15665b80", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199656, "uuid": "f2b8dd89-22d3-42c2-a339-ef6ddfbb6eb4", "comment": "Malware payload", "value": "9e3429425f55b681747a5da523d045949219ccaec5354ee5a065793daa3bbca3e659282d82d0ee18c224509aeb98d722", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773199656, "uuid": "12cda604-abf5-45d3-ab8c-2264443c3217", "value": "T1DAB42356FF3659388FC66D11A0A9A209B1EF357BEF27B20A1E330074FD54AD80D17A58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773199656, "uuid": "756b6e5b-310b-427b-8a1e-53512d2c7a55", "value": "12288:KeFUkfxeycUOhHQr0utf2kJ5B8lxZgsXp9LLS2aG4:t9fxeLutf2ABSLgsDm2p4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773199656, "uuid": "46cb1268-9b07-4337-ae8c-684e6d099fe0", "value": 516183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773199656, "uuid": "c87497d1-14bd-455a-8885-bd48bac8a682", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773199656, "uuid": "540e7d63-546a-4e27-ac92-24ce29c25063", "value": "FEDEX AWB.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1310f5-1d20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773216051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216051, "uuid": "fdaccb00-ddd2-4ea3-8ddd-1585e4be2bf9", "comment": "Malware payload", "value": "b6ebb60cd54d27abb62e9c108087f8a0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216051, "uuid": "856b58bc-0f0e-438e-b6ad-4fa2c69b1d3d", "comment": "Malware payload", "value": "19d1507a08193e55ebb5b873e23fa0fd1d54a29e413ccd51903d6f084556c1d3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216051, "uuid": "ab509f1b-1ffe-4330-ac62-8468bd49b5db", "comment": "Malware payload", "value": "e7737db78519f10256dd57362ba208bd5923c1b1", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216051, "uuid": "599742bf-b568-4757-a106-fb25c2402307", "comment": "Malware payload", "value": "22ad84b12ba74317adf80bce9e35d50c521992d340522ef3b34a8837cd13196781db10d417d569877b61a73f895092b5", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216051, "uuid": "d35ba5d4-789d-4b9c-afc4-405c4d73caf6", "value": "T1E43501D64314BAC806BAD44F415B67BAAEA724C4716F79A9B3F6C4DBE3603EC506013C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216051, "uuid": "ebb959a7-5bd7-4b06-8bfb-a46a00f7841f", "value": "24576:FgRKUMzHfEnfuw9agREj45oE8KRIzje9qjjeyb4RUgMQIjeFZg+Gg08Rn97bapF0:FgRKUMzHfEnfuw9agREj45oE8KRIzjeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216051, "uuid": "d4b3defd-106b-4634-8c28-6ce6895f46bc", "value": 1066917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216051, "uuid": "f48b2261-547f-49de-ac0d-8af4fb5b17ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216051, "uuid": "020a0f7d-dc4e-44a6-958e-690e9caeef41", "value": "b6ebb60cd54d27abb62e9c108087f8a0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264ca1bb-1d72-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773251153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251153, "uuid": "46d905f6-cfe6-4120-a6b8-6547bc8b55b1", "comment": "Malware payload", "value": "71e39aca3426b14928f7b65f8b44b7c3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251153, "uuid": "5a49871a-8a77-48e8-bbb1-d50a438d1c82", "comment": "Malware payload", "value": "1b20a210fe96e5a8abc347dfb91d7befecb4b5f9b7ed40d856410fac15952057", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251153, "uuid": "d26bf01d-a784-45a2-b663-8b74ffe763bf", "comment": "Malware payload", "value": "232371db7e9ef5a168871a9fafaec73d76822025", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251153, "uuid": "5089b18c-7357-4d36-952a-9b17d3f192c1", "comment": "Malware payload", "value": "df36143bc904e277397797d96a0d96f33fb45f2e7531b45cc10a0c40b457853490ddb35a3da8e9352babed6430e06748", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251153, "uuid": "0d8c81c6-5a6d-4eba-a61f-1835ced4953c", "value": "T127C09297E68BC9A921B91365D8E124745A37682584456C19FF743E42D54C897338B11C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251153, "uuid": "58c1e18c-7605-44b1-b27a-fefb04eea08d", "value": "3:eEIAyTRbBFHl9X8EHE1SJYqAsd4MKLLvsPTRbBFHl9X8EHE1SJYqAsd4MKLLvn:eEIPT9xjEgygGMKnsPT9xjEgygGMKnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773251153, "uuid": "ad30d15f-a6a7-499a-a178-9e790cf233d9", "value": 140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773251153, "uuid": "ae26fba3-ae79-4f5d-9220-05f3aa8e4fc8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251153, "uuid": "3b4e1ee3-d9c0-4085-b330-963de90537ed", "value": "1b20a210fe96e5a8abc347dfb91d7befecb4b5f9b7ed40d856410fac15952057", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e947b49e-1d6e-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249762, "uuid": "3a0c0a7f-dd9a-4c2b-8f49-b5460e48fc61", "comment": "Malware payload (WannaCry)", "value": "13655f5cd9b5a3cd054c2876054df16f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249762, "uuid": "e2ac909a-771c-4cd6-8da4-5bf161c5d718", "comment": "Malware payload (WannaCry)", "value": "1c635367ea14165ea4dc39796f34e6f459233bf8601ed1626ae080b9e0334ea3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249762, "uuid": "c757c321-06f1-4650-afdf-cda2673c158c", "comment": "Malware payload (WannaCry)", "value": "4be0befea8d5d7ee406a462f5852925e440e1858", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249762, "uuid": "31f246ee-8921-4a9c-ba05-d232f602522e", "comment": "Malware payload (WannaCry)", "value": "f811a1009860829f4b19174d8d9f35e12efaeb4e41a93bc1ff96f8f669be588ef81d27bd29e45eed4cde1463670e2c78", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249762, "uuid": "e47ebe2d-cc2e-4788-9598-716e72f12969", "value": "T1D7363359713CC6FCD10629B500A7CA63A7F37C5A16FE6A0F8F4089A61D53B59FB90A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249762, "uuid": "fe6a1642-bdee-4a20-bee2-2c0e96521754", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249762, "uuid": "8cb1d456-7196-4f34-aa1b-4198cdbfd938", "value": "49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdh:+DqPoBhz1aRxcSUDk36SAEdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249762, "uuid": "c93967c9-8919-43cb-833f-b4617bf9066d", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249762, "uuid": "45c44ea8-f266-427c-880f-ad8398da0f83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249762, "uuid": "79a32217-dbbe-46d8-8edb-5e162c580e9f", "value": "1c635367ea14165ea4dc39796f34e6f459233bf8601ed1626ae080b9e0334ea3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1801e33f-1d0d-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1773207749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773207749, "uuid": "ab2773d4-3b52-4898-8b0e-87e2b02eca36", "comment": "Malware payload (a310Logger)", "value": "e4c0ca29d0d9903c8d947c0ccafa6d1b", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773207749, "uuid": "1c8782c9-2a6c-472a-a8c2-d8f0e26accfd", "comment": "Malware payload (a310Logger)", "value": "1c7376d94977591ba486c5b5e6fb4ec7bf84e13cbd37c51ae49a4935e36849a7", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773207749, "uuid": "6b027e01-f342-4254-865b-66311d189660", "comment": "Malware payload (a310Logger)", "value": "c8cd9bf3139cec167a8039dd6d9f9448f46c2714", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773207749, "uuid": "e91ad00d-b5d2-4c5b-974b-a42807c1a93e", "comment": "Malware payload (a310Logger)", "value": "0911bf2690655a7f31bfeea8b4c87c7b516e83c041837ca3d8bc0b192b41503a25f3dd1c5a23e152249f5234f57a2ff7", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773207749, "uuid": "cc8296ea-c19f-42a9-a9c0-36eab03fd1d0", "value": "T19155CF0273D1C062FFAB95734B5AF6215ABC79260123EA1F13981D7ABD701B1463E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773207749, "uuid": "c6edefb8-2b06-4bfa-ba5a-363c75a518fe", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773207749, "uuid": "4125c287-c38f-4b0d-95d6-2cbdb6bbde1e", "value": "24576:F5EmXFtKaL4/oFe5T9yyXYfP1ijXdaw2FhvtR/E29tRuJYdGXd91pLves9:FPVt/LZeJbInQRawchbRu2gpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773207749, "uuid": "b48c6a56-ead0-4ad0-a6d2-f7cb916039cb", "value": 1329664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773207749, "uuid": "551b0983-8690-4d4b-a42d-e2ca471e1c56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773207749, "uuid": "eb32be54-0905-4d20-81af-bf10cd48f563", "value": "INVOICE COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9e9d8f9-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773218007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218007, "uuid": "85a8fb6c-9c68-428b-a5f3-9e90b0a02a28", "comment": "Malware payload (RemcosRAT)", "value": "eb41d873bddf8747ea9687a5fc4134b2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218007, "uuid": "22ba8fae-d826-43da-8758-01c380955020", "comment": "Malware payload (RemcosRAT)", "value": "1d0ea54f75d592d7fe26d4fa350f66569e2deb31e98cb2be9be8ad25c3f12b9d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218007, "uuid": "d91652e2-fb6f-4d97-8239-4465aca45470", "comment": "Malware payload (RemcosRAT)", "value": "ab3d03714e2686015ff4441d6ff7de7faf4d58e5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218007, "uuid": "01b6aca8-1b6c-4f73-987d-20283b541960", "comment": "Malware payload (RemcosRAT)", "value": "86ab92afb109ba155c4cac3fd4ae6f521f694cc63b88f8a121d2754dde5325f21b660039e0bc46e74b745e8583559be9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218007, "uuid": "9f463de7-455e-46ff-b4ad-4c01110b53a9", "value": "T145666FEAB19B7A874DC42EDDA397C705382153917CA251189EFF43DBC4A8940FFE8252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218007, "uuid": "0e8e7754-52f0-43bf-a1e0-d18f136cf407", "value": "192:wH92igJ1ZXQocwcdiFU3geZdilUdyeddiAU3serdiAUo0eudiaUogeidifUoOeKL:IVDpeibfY9AQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773218007, "uuid": "4811b365-d0f4-4364-826e-cc53295b2ec8", "value": 6559882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773218007, "uuid": "6a8579a4-ad60-4747-b371-7e520eb469cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218007, "uuid": "7eca24c5-dcf8-4be0-bf26-b1939c3575a5", "value": "CopilotDriver.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "858277dc-1d20-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773216094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216094, "uuid": "652df03e-be3f-4190-9acc-b7c584b775a1", "comment": "Malware payload (XWorm)", "value": "72ed4310b68de4435ac81d2e32ddc5be", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216094, "uuid": "fa69397b-2196-49cd-8cab-ee115b4e4ef3", "comment": "Malware payload (XWorm)", "value": "1d1cbc1c3e0bbb5080affd242d59e269cf30241385946741433b59328b47437c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216094, "uuid": "4f87071a-ee4d-48c2-8db4-36a7a6ec6b20", "comment": "Malware payload (XWorm)", "value": "de5011ea5f5a395fa90f521c50d8c4a584d76a73", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216094, "uuid": "80d73666-3503-44d4-a7b7-9c06b49e2006", "comment": "Malware payload (XWorm)", "value": "a748e9d9f1a86e2278d2b6d70d4c6a0a68d6362b97d5529f7070e0eab2100a46c2f874771d9185f5a6d97c6b9197bba7", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216094, "uuid": "1e45e4ca-a3ca-44e7-8fc4-bfb1ab950d69", "value": "T157421EBDC5D1BCC0875B32E179AEF7C2118E8B137A6B1B6CF9CC05A50B50198ABB558C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216094, "uuid": "261d2969-937b-48fd-a9d4-686b7ede7c6f", "value": "384:oG9geiwg/XzDGWh6UoZJMkcKC/jHQpAhaEd:R9GBfGWWJ8njw+td", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216094, "uuid": "057e3fe9-b50d-40a6-b3e7-73d06127ce22", "value": 12586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216094, "uuid": "6f405d70-a4bd-44c0-9428-796722de7d98", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216094, "uuid": "cf07da95-58de-46b8-9ae1-78b9970a1b6a", "value": "72ed4310b68de4435ac81d2e32ddc5be.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a809dadc-1d17-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773212286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212286, "uuid": "eb90c712-aa8e-4a6b-880c-2640d18b103a", "comment": "Malware payload (RemcosRAT)", "value": "362717ee552f647f662f464b5080747d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212286, "uuid": "16b37b2a-5826-4956-ba6d-7a2424399e81", "comment": "Malware payload (RemcosRAT)", "value": "1dd20400a7bb38e2bc807c8bbe15fb719b3466be957bbd9b71f620f876916287", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212286, "uuid": "3041f9da-406e-4270-8861-6628d58f9e4f", "comment": "Malware payload (RemcosRAT)", "value": "9d0c31a1a9e8cf75d6279a591fa40e8c00bfeb6a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212286, "uuid": "dd6d6a85-3c90-4b1e-a584-367c3c5e0b33", "comment": "Malware payload (RemcosRAT)", "value": "8402274e3a2ce59849e29174123cbe03da4ee0d29c36b473c6194e7ee506e20f3d8254353759216d23d74ea9d88acbff", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212286, "uuid": "88729147-83d8-4407-af41-505a791bbe72", "value": "T17B36137A69E854E0EA5AC920E4D322F2FC971339A95838973179CDFEE3C8C1D549071E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212286, "uuid": "4103108b-b06d-4aa2-a45d-51c26b57f34f", "value": "192:ui8HM9H0SfH83/g/ksVPAS7vByBib0SKFH/eeAixSuzGqA1iyD/:OASqviy7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773212286, "uuid": "3f6e2702-9ea0-4844-968e-2440bcbfe7f7", "value": 5113303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773212286, "uuid": "eaed4e86-70a6-4090-aed2-857921fb173c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212286, "uuid": "4098961f-b81c-47b1-83ac-255dc4260382", "value": "CopilotDriver.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3238368d-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249884, "uuid": "0cc940c0-2442-4489-87e4-a0e233dea3e5", "comment": "Malware payload (WannaCry)", "value": "0efeb2851c6aa5371b0238297458f02c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249884, "uuid": "6c233d92-ba8b-4961-a40e-3dccfd7fc728", "comment": "Malware payload (WannaCry)", "value": "1f0e08fe6b1799c09cb3042a366b2e229fd9b82d8dc45c596d43f5e475c6cb92", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249884, "uuid": "9200a85f-efbd-4bcb-a722-6596aa0d0507", "comment": "Malware payload (WannaCry)", "value": "76310bcebaf3f8618d42c2946cc5ea21b0c389b8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249884, "uuid": "c39fc62d-6bc4-4673-885c-eb677cf5b2c5", "comment": "Malware payload (WannaCry)", "value": "c61048f9603219b3721a288dec5dda019bad13973214d3c69105b3296748a667e7e0c315d452bf7adfff08334753d046", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249884, "uuid": "c71f3346-5a34-4b22-b5b3-8b937220de17", "value": "T173363394A22CA2FCF1140EB04467895BB6B73C6567FF5A1FCB8085960D43B5FAFD0A42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249884, "uuid": "aec0cd6d-d0c8-4c74-bbb4-cac3e9842b62", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249884, "uuid": "0fdc4940-21a9-4a8a-9729-cc6e6d052621", "value": "98304:d8qPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2Bg:d8qPe1Cxcxk3ZAEUadzR8yc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249884, "uuid": "63c2f2c7-1afc-43d5-a066-4f203c816fa1", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249884, "uuid": "09bb4625-1bb3-41ec-87f4-61da7ab87607", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249884, "uuid": "ad1a7387-e9a8-436e-a61c-d0fe55112597", "value": "1f0e08fe6b1799c09cb3042a366b2e229fd9b82d8dc45c596d43f5e475c6cb92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005a787d-1d6a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773247653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247653, "uuid": "0b98e39c-e981-4a17-9a15-833b17fdc76c", "comment": "Malware payload", "value": "726fd595ff926c73635e868cdf13abb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247653, "uuid": "f9355882-f3e8-4f12-b708-1bc296850189", "comment": "Malware payload", "value": "207f46575ae45a1918ffc4fa21eb7069010a7b97d46b87604a57c53495a6c682", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247653, "uuid": "6fd62187-452e-4de3-b331-ff7adb327744", "comment": "Malware payload", "value": "3393205bc24f0928ecbb9b9ab4acd77e93db5a44", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247653, "uuid": "49be2719-b369-4c13-ad01-7f9df949a78d", "comment": "Malware payload", "value": "5be04cdf3bfa899bb8ac23ff58b8b4089a32f31f939a816f7c805f65e2ccbc4554c44a9973ee994f770e098d7a91dafa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247653, "uuid": "e8050e37-d016-466e-bfb1-1cbf09e99fba", "value": "T1C126C0574F985D488B2D750EC0FEAA2F5216A20BC01B4502BFEFA579F6C384C77572A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247653, "uuid": "cfb5d057-fc7b-469a-a922-36054693da34", "value": "24576:2Z1Z6/umt496z0DvwsPwgRruLBRCJ0+jsdQmhMCfn/7agk0IoLuAQU7nMbs3hUZc:2Z9DZjU7WVShVJrnCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773247653, "uuid": "7c3477e9-5a84-40d4-aed4-d45b329d012b", "value": 4607311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773247653, "uuid": "5ab8081d-ae9a-41e0-936d-1151fa487db2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247653, "uuid": "ad3a138d-a2f6-460b-acde-bf982aa44d56", "value": "MV TBN VESSEL PARTICULAR.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d063317-1d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773256452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256452, "uuid": "01bbf6c7-0358-4c75-9b22-2b8fba234cbb", "comment": "Malware payload (Mirai)", "value": "abc08b18591b728ce89067f1e1deee11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256452, "uuid": "4ddb9078-d4b1-42d1-97a7-33f8455ff7e6", "comment": "Malware payload (Mirai)", "value": "20e9f1caef52c938ab3509af0eb6fcf7d3c39202c907f0ec76f78dbd7331ed3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256452, "uuid": "24da656a-c942-41aa-8914-0acb491d5592", "comment": "Malware payload (Mirai)", "value": "364178614aea90fafb1b083a0489a3d3242dec9f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256452, "uuid": "af798ac7-8371-416d-9e06-3c2326891e3f", "comment": "Malware payload (Mirai)", "value": "7223f5dc0e572a8578c8b6cd940b799ff8bfbbbf197a5872320fc09ac2f2b1a294d090cd9abcfb9785b2b70ed4cf8558", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256452, "uuid": "06fd7262-0ac8-49af-b6a7-d618e3c53232", "value": "T1114302BCE6E364F5C1E19074CF3E48CF9B714579936A045A62C6446C4BC29877BBC0B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256452, "uuid": "a0185973-a074-4075-a9df-e0ede2b15be8", "value": "1536:GccRgToi/makIfyS5Dup1aKgfalLX5yfmDVRty25mH:GLRgThRfyCO1CfalLgfmjg2cH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773256452, "uuid": "71b771cf-b32d-4dcb-9aa4-0375cfae2732", "value": 59076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773256452, "uuid": "7bbc710d-7602-41c4-826d-4f90a01a3ae2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256452, "uuid": "7ded26b6-f3e9-4bac-8769-a8bf1a60df60", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff15752d-1cf6-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1773198259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773198259, "uuid": "d770b7a7-57f8-4074-bfa5-868a4ec7e5c7", "comment": "Malware payload (Joker)", "value": "d87ffe358a636e923899dcad84871c96", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773198259, "uuid": "4a6bb394-8be6-4f18-9260-678990e2bf7c", "comment": "Malware payload (Joker)", "value": "2113d39e936e92d387a2902ad112e3cb01bc66ef301e199a03e8d644bab61b1e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773198259, "uuid": "276a8fd6-22b4-4412-81c2-b2e7cad62df3", "comment": "Malware payload (Joker)", "value": "0fcb4e53df4d581fda79a31f0a696420315a0b0d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773198259, "uuid": "d3286af8-703b-42bb-88e7-02bcacf8bd50", "comment": "Malware payload (Joker)", "value": "6f1e412fb555af9a92394ec083ea80dad27d5ff21f5cae8020017b008c666f1828bf5edce0352be3574f5e4008ab576c", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773198259, "uuid": "c2d41cc8-2c29-45be-ae4a-f64613d6da52", "value": "T1F4C7338AF369DA1FC837A0365E6E6325494A0C65EA83EB533A09731D29F39D04F45FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773198259, "uuid": "e70fe672-16c0-497a-81e6-32181b21a821", "value": "786432:FF3++g+MDR4uuVEh0diLQh677AMZnZmuv++bRcYaXh8kmVM67G8VWpISe:buwMLuVECdiLO27fDG+bRI3mjq8VkIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773198259, "uuid": "2516b909-1127-4096-b945-b03e08f3aa5a", "value": 54122210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773198259, "uuid": "15341fa6-db2d-496b-a312-ee9d14538f85", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773198259, "uuid": "00644786-4914-4e16-8702-5be79940ee89", "value": "com.beauty.pro4k.hdcamera.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0601c234-1d2c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773221034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773221034, "uuid": "c8a0e09c-1892-4d17-b793-15dac2307295", "comment": "Malware payload", "value": "e2308169dd917725604fd860140a4132", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773221034, "uuid": "7abb2449-a46a-4b1b-a779-daeb78728a0c", "comment": "Malware payload", "value": "21aacae7e979d0ef3db0f01353a190437e89b5ee4ac230cc2637faeea9ee8ab0", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773221034, "uuid": "95d897c3-04eb-401b-a5e4-b33283f56531", "comment": "Malware payload", "value": "9204831fd729cdd298c31b7142b55c74c60115e8", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773221034, "uuid": "97ea9676-c5ac-4192-954e-00455a522e57", "comment": "Malware payload", "value": "e72a2b4b6ff0f024438878ab140a223a613c9151d06908d02c9f3d3c87140f888bf9d26a838850383b12a87e303e6c50", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773221034, "uuid": "a811d030-f52c-4969-8a9c-154a9ea59f1e", "value": "T1419401B68AC93E7EC45E05F7155372B0B2118D05D9B8B825294713CA8E592CC4EAE3FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773221034, "uuid": "f8e90e67-8cbe-4025-9a1f-11a1dc189ad6", "value": "12288:Bktl/NXlQBkUK1Dvgd+RCF3EdaDrUAOT5XZWTXF4JVBQVPRg:Ex6k71D4wA3Eda3HGd4LoeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773221034, "uuid": "9e3fc479-451e-4b91-98f5-90a8a5f0be4e", "value": 421293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773221034, "uuid": "036a580d-0982-4a99-80c2-c5a6d594473a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773221034, "uuid": "180749af-2cf3-4da1-b2d5-407488b258f3", "value": "RFQXBS-00151.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f5e6921-1cfb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773200058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773200058, "uuid": "aec2ce9a-e547-4eeb-87b8-00ce653208a7", "comment": "Malware payload (Mirai)", "value": "c5d3d64ef4f7ef27b922eb464d365d86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773200058, "uuid": "a2382fbb-47d1-4e7d-88e5-147c45149c0e", "comment": "Malware payload (Mirai)", "value": "22caad5f3f32a0bac1bb40f0c09f650907a5ae37182d24dda4b26b4f73718d57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773200058, "uuid": "442ed72b-b77d-436e-968c-082a13f10724", "comment": "Malware payload (Mirai)", "value": "d9ac934754b49b7707f373bdb659bc5428458a2d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773200058, "uuid": "0576bff8-3443-4696-ba2e-1d38db2ab67a", "comment": "Malware payload (Mirai)", "value": "102403a29ca5689ff357e6f0c63e9aec9a24242469f37b0951c1e978254fe5e7ab61a6397b9da4f40c686b9c2f07bc4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773200058, "uuid": "1aba3776-0e14-4688-9c95-c66100580392", "value": "T1BB34B60AAF610EBBDC6FDD3706E90A0635CCA50722A43B7A3674D524F55A50F4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773200058, "uuid": "359d7212-143b-43ef-bc40-ada14ec8b286", "value": "3072:sR0UHIe08zqMz6fxMGgo6S7obz/RzgExkCXK7bqWKOPqFrB5Nt9R:sR0UsYdkJgz/HxFa7zKOPmhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773200058, "uuid": "ea18cced-cd03-476f-9014-cd589c4b7f5c", "value": 232968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773200058, "uuid": "77c5ccff-2320-4b3d-8d6b-87f37f1e0ccf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773200058, "uuid": "5f834609-fe98-4aca-b85c-af320f7d57e8", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ffe613-1d60-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773243473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243473, "uuid": "03c77200-aec3-4ed3-b018-8e9af47a5228", "comment": "Malware payload (ACRStealer)", "value": "d87b2fa27f99acc9d728b5c799462abc", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243473, "uuid": "4f1c7215-6501-4095-acff-6575216ee2c0", "comment": "Malware payload (ACRStealer)", "value": "22cb1ac28554ec947f5fc5b9cf5ab3d84a83a00b942b62c685cb38c9d99b533a", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243473, "uuid": "273fceed-e4b3-4e77-ad0a-ec940d0084cd", "comment": "Malware payload (ACRStealer)", "value": "9dc932e8922371ddba20e142a8cdf4627bb9eccf", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243473, "uuid": "2493da70-d3ae-4066-82e4-2f57c7f9ee24", "comment": "Malware payload (ACRStealer)", "value": "0da96752716131d9d471f89f7ab266e1e515d28a3083ed44dedb9136a2b1ecc238182187696e4717057ebb0b3d65bca6", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243473, "uuid": "408d97e9-6609-4e8b-ad02-45d208827153", "value": "T1C9F47C8550AF91F2FA468A3E532F671F7338129C0711CAEBDB64AD9BEA317D1093C485", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243473, "uuid": "9317ca7e-b839-400d-aaa9-db9ee1a84263", "value": "84b9db404799c341d63eda0b3ec865fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243473, "uuid": "c9ba667c-3d98-4a45-99c0-d6d14523ca5a", "value": "12288:cAdy0DXAOp++BwaqA2V+FKhNVSQGoBSemntnTXSz96PW+:cADDvp+lrMuQQGKmnFTXrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243473, "uuid": "40567976-82b9-43e1-b3cf-cf0665501f48", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243473, "uuid": "851d0af5-3de8-4d56-a681-c38626cdc5b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243473, "uuid": "680f8f19-58f1-4d17-92ee-30d2a82a411b", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cf2b2e7-1d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773255539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255539, "uuid": "730d15ea-1196-4531-b7b0-64d5f09a9b9a", "comment": "Malware payload (Mirai)", "value": "2e21f572f058d2b8a4c5bac16e25180d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255539, "uuid": "7cd2849b-3eda-4f9e-bca3-7f3d439048ab", "comment": "Malware payload (Mirai)", "value": "23b724b8eaad36d761cde6cbd6b545051d2dae73b1c2259d63081e59f1459759", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255539, "uuid": "c3c2e559-3ea7-48c6-b722-8b8513478c84", "comment": "Malware payload (Mirai)", "value": "2ce5425908bf9848389eb73f601654a18ab31e19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255539, "uuid": "e2c8a202-8f1d-4954-8dde-09169ef87501", "comment": "Malware payload (Mirai)", "value": "8b5647596a70dc5abf4fcc2ac7b4d69d07d3d6dd78f44bee4e6fe7f929f1916ae3a171fc4bd2130201d27aa6462e2539", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255539, "uuid": "17ba784c-07f9-4963-85c9-e321c5ff5a82", "value": "T196A32B12BB514FF3DCD7CD3705F61B01288DA82726A62B36B534D868B61728F2AD3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255539, "uuid": "d2c78b10-a3db-43df-adad-8e682599a684", "value": "1536:7Il1zyldzJMU39umT3ZuekUDMLZ5gQdL6sR5kICK:7Il1zyldVMc/MLDBT2K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773255539, "uuid": "ceeba6de-11a1-4137-b145-03897abc942a", "value": 100543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773255539, "uuid": "bc53d321-dcf9-41fb-a56f-598ebbf15c07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255539, "uuid": "18d36317-865d-4ec6-ad79-4c1b27bd7f7f", "value": "xdlol.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11ba172-1d4b-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773234716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773234716, "uuid": "84bffc29-c48c-43ca-86ac-4b6d4930b3ac", "comment": "Malware payload (AsyncRAT)", "value": "27bfebddf8c538b1664860b16bfa6f3e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773234716, "uuid": "f02e6667-cc68-4292-8ef3-43dd092c87d9", "comment": "Malware payload (AsyncRAT)", "value": "241df0f833fb40db01d7ec055477cf1fb71360c34843466f0d2c54046900bfcd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773234716, "uuid": "035a391e-3b6f-44da-917d-6701c767873c", "comment": "Malware payload (AsyncRAT)", "value": "5d9207faa3493efee739c889d071fecaf3e09a44", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773234716, "uuid": "458fabe6-af38-47b9-8edd-9765764fa9f8", "comment": "Malware payload (AsyncRAT)", "value": "8148d6c63cdb0a5a8937e0f93d68a8869dacc88692fcbc41e8479490e1eb8e23fc7b7a06578bb153944dedacf2b0f1ea", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773234716, "uuid": "b4c48edb-cd64-40b0-b856-d45a93f5c479", "value": "T1C2033A18B7F88965F2FE5B7D8DB182004335FA579D22C79E1EC4508F5A63788CA24FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773234716, "uuid": "b8d7ebdc-a7da-4c46-b359-d93dd1673c05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773234716, "uuid": "cf5ceff0-2118-41da-97be-cdfe99437c38", "value": "384:C7DC9cMCcUBQ/oe31/2bnTn8QHmp2M77n9393bayse6QxnC7O+WRl3uuhGfrNP7G:CnCIcUBs1+bTpwVRbJpB+WWP7LB1jj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773234716, "uuid": "39049439-df72-404c-a276-6a05b480c0bc", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773234716, "uuid": "f9ed167a-73e4-49b7-9c1e-6f38983e26f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773234716, "uuid": "8586ed1f-00e5-401b-aafc-136158223d55", "value": "PhishingRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4e618a-1d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773256448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256448, "uuid": "6f0344b4-c0f2-476f-9a73-ee97b6d861ea", "comment": "Malware payload (Mirai)", "value": "25a07488e1cbfd099dbe44c3a34d3078", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256448, "uuid": "4245821e-c11f-462b-b4d7-8a79fe656ae7", "comment": "Malware payload (Mirai)", "value": "25a52e10310948461ec0f33e833cadc6ce5e6a27819c3046c70ab8ff56793eab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256448, "uuid": "5878b65c-ae60-4a41-aa2f-b2e8b441b04c", "comment": "Malware payload (Mirai)", "value": "85131e78c149e029dd55fdfc5c6c587d984a6193", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256448, "uuid": "2fca56e7-6408-4d2c-bd16-44198cf55001", "comment": "Malware payload (Mirai)", "value": "fed398fad73eb675e51fc29115e55d33dc4f358f905554c131af82eeae7664349ada4ed377f0131c2036ec67692f6a5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256448, "uuid": "b6c1f712-6063-4d2e-87a9-965f2664dd12", "value": "T1677329DBF800DD7DF80ED77B44530A0AB270A79106931B36635BBA67FD321A55822F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256448, "uuid": "fa5284f0-c2c8-4602-93d8-05fa1ade10ce", "value": "1536:z3OL3wr34Qu3EhvOy0sxom9XFH4ZWp6wtwb48FyRXFORZkRawHUzN6NzbotcuObI:z3OL3wr34Qu3EhvOybxomn4cp6wtwfyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773256448, "uuid": "9c5d718a-5d38-4039-b9cb-56af7d0de1ce", "value": 80340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773256448, "uuid": "00ca0aac-7941-4f23-ae42-a82ecc97ade0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256448, "uuid": "6821eb6d-df43-43cb-9c51-81467acfc302", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a18c84d-1d85-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773259480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773259480, "uuid": "29c72176-a4e0-4081-b107-65a00cb24bcf", "comment": "Malware payload", "value": "106715255b0cf0e2d386be2866fe550e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773259480, "uuid": "b0a350c4-bbbf-4c4f-8e4a-598ffb8e252f", "comment": "Malware payload", "value": "27245cd56bd9940ab528bcf1b0d33efdaf4de40f21513baf0116402dc9bd75a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773259480, "uuid": "78170ee1-295f-4ed3-8066-eb4b260191dd", "comment": "Malware payload", "value": "13143fec81dfa2638adf8d3d97ca543591577deb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773259480, "uuid": "b44040e8-b3e7-42d8-91cf-a43c32fa8372", "comment": "Malware payload", "value": "1623d304f09b2baf761c38b468e09b03f61b0475df91ed0ce6b9eac7b18b9af651641712c57426802e37948dcf5b9a3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773259480, "uuid": "c270412e-1df9-4b19-a986-21be944da7b5", "value": "T1D0530755BD929A17CAC4537BFA5E42CD372623A8E2EE3213DE155F2132CB42B0E7B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773259480, "uuid": "a5d193e7-a050-4b4f-b56a-b452449109ed", "value": "768:xq4OHoKVnm5eETi6QpfOTpYkOwEM0oOHhWE+5A+6vpNqC0enmTI5pAx+irwlDF6G:kl09Q921Edo0AT6RwNOb5pAFyJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773259480, "uuid": "0e6ecc97-aba7-4f17-80ac-aa69b82e090c", "value": 62688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773259480, "uuid": "dd793cd9-0d0f-49e6-a0ad-ade7452cefd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773259480, "uuid": "2c54e9f9-cead-45be-93f7-01814b97ce94", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc61bac-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217983, "uuid": "95cc1b13-6a16-4a80-93ac-561d35b4dc4a", "comment": "Malware payload", "value": "67cc016ae1ad0db1b8cddd7b5af0542e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217983, "uuid": "5f1337d1-9056-465b-84d7-4e52c06d2843", "comment": "Malware payload", "value": "27b396c1fb44cd00cf03415421d901782bccb5c3ea237ecf7b91c0f8f5f6da14", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217983, "uuid": "5e319d13-bef7-40d1-bbfd-4795000fb044", "comment": "Malware payload", "value": "6d2e959118d81b4098980160ea365a31d44d5093", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217983, "uuid": "5e609d14-9d17-4d76-aef4-e89478a177ed", "comment": "Malware payload", "value": "d3cf2311de379c2385bd3c19086bd9daf9e1957def8cecd6825c5fe3b8d43bf20cc6e98ea89e3b00c242928ebe014d65", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217983, "uuid": "9efc4a46-9282-4fd4-ac57-c6a52ab0f97e", "value": "T1E745D277417603C8D7759850DAA969CCDE8C0EB17F060229687FE9CFF8353B601BA662", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217983, "uuid": "eef7d7d6-07cc-461f-a2e6-9a8a477a0226", "value": "96:qHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHH1:vPj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217983, "uuid": "cc529d28-95a9-4549-a996-739530a54a9f", "value": 1166296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217983, "uuid": "0dd6a002-8fe4-488f-a122-78c7f0ecdba8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217983, "uuid": "acc48fa7-628f-4715-a92c-fe232106cd2f", "value": "67cc016ae1ad0db1b8cddd7b5af0542e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4247c89c-1d70-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773250341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250341, "uuid": "e3e52cf8-5d39-40af-b96e-6f3682edbd23", "comment": "Malware payload (RemcosRAT)", "value": "843f04520cb88da13e8692177c8d254e", "object_relation": "md5", "Tag": [ { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250341, "uuid": "f3eabeba-4fba-437c-8609-01a2b44084d6", "comment": "Malware payload (RemcosRAT)", "value": "27fa259ad516be5efa3b22cb01651365f6912e04b4f79d00fcb3ad4cf505a705", "object_relation": "sha256", "Tag": [ { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250341, "uuid": "3c7026a4-245a-4a82-b6a5-f43a1abfcb85", "comment": "Malware payload (RemcosRAT)", "value": "007bb76ffcd92bcb58e36b4d856a460483acc954", "object_relation": "sha1", "Tag": [ { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250341, "uuid": "d421bc0a-6cf1-460b-b9e1-8a1d09a10346", "comment": "Malware payload (RemcosRAT)", "value": "b16fc27176f31fb024394472b7788946bbf22fd190beceaa6943fa03e024e99c7231f8f8bfa44d8341d55fc1a152a5b9", "object_relation": "sha3-384", "Tag": [ { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250341, "uuid": "af2d14b1-643a-45b6-a1cc-8ec5d4bb341c", "value": "T1A45517955327D5C18A5E2153F1044FF46E39AB3F2E81F167CB6E3EE834A69C39887488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250341, "uuid": "58278eb8-957b-4fb1-8ca5-2b0513f5ef9c", "value": "96:JiMm/lmXyrPNMRj0dYgKI9uoSRi9qrSqGqzMuKW/M99GKTGMHuB5TuIGTea03sa9:SVcxBPlPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773250341, "uuid": "6a55d350-eb0c-4a0b-bdfe-67a71acc71b5", "value": 1402880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773250341, "uuid": "b91ff01c-ca94-4ec3-9a3b-52da8308837f", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250341, "uuid": "dffe6ac4-afd2-4cb6-bba1-304b4ebd203a", "value": "05032026_1652_05032026_INQUIRY 1260017 - 05032026.PDF.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd5ae6d-1d6e-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249766, "uuid": "0de4a028-4f08-41a9-ba6c-753cfcac9d99", "comment": "Malware payload (WannaCry)", "value": "6b3b7a004d8f6ef4f1af847e275f1dcb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249766, "uuid": "27bd3bd4-8c83-4b1c-a0ba-0961fa3dbe6f", "comment": "Malware payload (WannaCry)", "value": "282523f5de1964653a189fcf45097fa9c735318c3334d99785f8b3e9c1ee35ec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249766, "uuid": "b523cf49-36d9-4e3c-b656-71c199bb383b", "comment": "Malware payload (WannaCry)", "value": "055371642bff05c14d821a0578105904e7857555", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249766, "uuid": "218a0060-60b1-433c-9f43-f147bad5ec4b", "comment": "Malware payload (WannaCry)", "value": "be7c2a464ce43dd5aed3409d29eed4e111e65d6e6c0e20fdee20ce7454a112e3642435865d515c97f785b9fbd417c80d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249766, "uuid": "65b684ff-02cc-427c-a34a-dedab8ab9f6f", "value": "T18F3633A4A22CE6BCF1051DB44463892BA7773C6567BE5E1F8B8045A70D03F6FAFD0A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249766, "uuid": "d6e8d0e5-e0f7-4db2-85d8-72d02f088022", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249766, "uuid": "67822844-8bbf-40ce-890d-06cf4577cd01", "value": "98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp:TDqPe1Cxcxk3ZAEUadzR8yc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249766, "uuid": "986db205-ab8f-4384-97e6-5b67c113b3b7", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249766, "uuid": "713cd138-eb7b-425e-9a00-9365d7667f89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249766, "uuid": "7c93ef7b-f660-47d8-aa3e-adb2bff0efb9", "value": "282523f5de1964653a189fcf45097fa9c735318c3334d99785f8b3e9c1ee35ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef2c3b8-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217989, "uuid": "dca3c9d7-def4-42bc-b339-e1f1dc84c326", "comment": "Malware payload", "value": "68f25c6c831f40bf78aeaa2ec1018a97", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217989, "uuid": "8df402be-5cba-4c2c-8034-f2f55674363d", "comment": "Malware payload", "value": "28b1e0b6c517a34662e4ccf68b399eb954bf503e9144f6a86fb6630cfd438826", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217989, "uuid": "8762c88a-cce2-4816-878b-516da7faaa5f", "comment": "Malware payload", "value": "52270c5808b468107f9ce7d0143b5f139bc401e4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217989, "uuid": "fac8071b-67a1-497a-8a3f-3dac6942c607", "comment": "Malware payload", "value": "f0ea1f29a75dab025ecbced1c577351a0135204c95c9943bab11013b4b976576b89b47022ce81f86af536380e1ec782e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217989, "uuid": "707e21e7-5092-4257-9346-5570678de992", "value": "T18C556DDD17895E99F4047D1DE0FEA22581207E8B8D7004C57F69BC9EBF2A9CC192728E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217989, "uuid": "268e3bea-6ce5-4187-8eb8-e184e0cc3be4", "value": "24576:V9j5qzrF4f6krsfv52bFI4RHDCcxxlrBjNFxaT+EmEDGSza:HRdsmED3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217989, "uuid": "874d0324-74d8-4ed9-bb4e-327dded1efaa", "value": 1356779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217989, "uuid": "4f88f4db-0e61-49df-a300-afedbf3b10bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217989, "uuid": "dff3b321-baf6-46a6-b9eb-d4bf0767faa6", "value": "p_SCP0161295.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4cbdcb-1d5a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773240939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240939, "uuid": "34f6c91f-92ce-4d4a-8b2a-b21421c23db7", "comment": "Malware payload (Vidar)", "value": "4e8acd8d03b5a05aef2ce64bf13e3878", "object_relation": "md5", "Tag": [ { "name": "37-221-66-22", "colour": "#9E1FE4", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-9790", "colour": "#9718E5", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240939, "uuid": "d631c3e0-34d9-4be3-8926-d7022655b72f", "comment": "Malware payload (Vidar)", "value": "28e6e206ceaad0b9cce58fd0b98e7dd0209ad6ce7d29088d8f5de09737978d10", "object_relation": "sha256", "Tag": [ { "name": "37-221-66-22", "colour": "#9E1FE4", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-9790", "colour": "#9718E5", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240939, "uuid": "aaa39949-231d-468e-808e-948be7b3b286", "comment": "Malware payload (Vidar)", "value": "6d320606b0077cec714f61732c8c6f95295aaae1", "object_relation": "sha1", "Tag": [ { "name": "37-221-66-22", "colour": "#9E1FE4", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-9790", "colour": "#9718E5", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240939, "uuid": "f614926a-534a-45b7-a33f-a135f506116c", "comment": "Malware payload (Vidar)", "value": "3e0db4789a4f3b305aab7b6e54acd6f7bca766cbf9e444098c21880594c5faf1a4d8059a368aa9c50aa930764289a1b6", "object_relation": "sha3-384", "Tag": [ { "name": "37-221-66-22", "colour": "#9E1FE4", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-9790", "colour": "#9718E5", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240939, "uuid": "3f7b5986-4328-4d36-8f78-c368b50999df", "value": "T18507336857B1601BFC63DC1DFAC6ED1B5BCEC700D484C949C1486DADA9E8BD8498E23E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240939, "uuid": "70f36492-aa22-421f-a11c-5fab625435d8", "value": "393216:XKLAJk7VF5Z7atu2Y8arkbtkyCg5ZG9ygd4CJdco9TwFila9y0zD2:XKsGJT12Y8ar8kg5ZyNFXa9yP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773240939, "uuid": "1e34feb5-0fdc-48eb-9ee1-83ef868e49c3", "value": 17324227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773240939, "uuid": "b43a55c0-b904-4e44-9988-4257bcf54c29", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240939, "uuid": "511ff910-7c23-4240-bcfb-bb57e45d01b4", "value": "source code of carbanak backdoor discovered.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cade2254-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773217069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217069, "uuid": "647309a1-41f9-48fd-887d-28046f6cfb2b", "comment": "Malware payload (AgentTesla)", "value": "422ccb8be551a8f127d881b8cb80ff10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217069, "uuid": "3eeefd53-12c7-410d-855c-e88b697223ad", "comment": "Malware payload (AgentTesla)", "value": "2a3411bc31cae594ece8f636fabbe629fbc6b11b554a6c5e7c635b00e0449ac2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217069, "uuid": "fb39ce02-3b34-492c-bb3b-89ed1cfdacb8", "comment": "Malware payload (AgentTesla)", "value": "83fe16671d716169d8df8c96585ce51889efb309", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217069, "uuid": "a687aa92-b786-48c7-baa6-9e60dbb93649", "comment": "Malware payload (AgentTesla)", "value": "811863f924081424b88f9a8796dde9856f994bb47dd5170b999c9486c874feeff12fc9ed1f977a11293fcd3bbd625d5c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217069, "uuid": "d1c5df9d-2c0f-4ad2-8151-6b3d1042e8b7", "value": "T14DD59E693885492D1A5C3A587CD9614762F294867F6FE3B8D3F4BC04DECABDC6203A0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217069, "uuid": "f7c019df-ad78-464b-8a60-141eca68d5ae", "value": "49152:MsOlADjYiIZlzxR3sg/Zffv8RZ/ni1iO86IokbONnLQ0KrXF7Pd6sOlADjYiIZlE:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217069, "uuid": "1f950d61-38b0-470f-8544-f68d297adbdf", "value": 2754458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217069, "uuid": "18bdd85d-3fa8-4521-a7ac-ce5d14eb8356", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217069, "uuid": "25507d9b-5a29-4093-a140-8d17e21f2bfd", "value": "422ccb8be551a8f127d881b8cb80ff10.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff58959-1d6a-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773247760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247760, "uuid": "7ae8bd0d-00fa-4970-b39f-ee6836f6469f", "comment": "Malware payload (GuLoader)", "value": "60b0ba471d0988fb6228898e2b9a57ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247760, "uuid": "f2ae48f0-77d3-49be-b2ee-c641121d9303", "comment": "Malware payload (GuLoader)", "value": "2aeb12afcb6e7eedd462e05947a8973faa1e334b73646901bb5a66fbe323739f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247760, "uuid": "be54ab6c-1bbf-45fa-989a-a33d84ed0dc9", "comment": "Malware payload (GuLoader)", "value": "0ab9a3bee6bc20e35fec9eb3b010c33725d0466e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247760, "uuid": "5d1e2408-b3b4-4e2f-aa60-3c4831cb6a7d", "comment": "Malware payload (GuLoader)", "value": "e9710f77eef8cd3f40e7da5826a5e6f5202d4ab9475e8b1d2c5fd8e172e3228a8eb636d1890147c47fa3725440fc6dde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247760, "uuid": "de83d1ab-9b0d-4c59-8e7c-4904f68d887a", "value": "T198B4F13692188883DB5654B5D937689D6EB09C32BE80DC363011BFFA5C71F72890EA5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247760, "uuid": "d894466a-9985-465b-8d6e-a341fc8625bf", "value": "1f23f452093b5c1ff091a2f9fb4fa3e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247760, "uuid": "c7599d93-90e0-4cf1-b8b6-76eace3e3555", "value": "6144:tp+ggmPubjUGPIYH2ZXEnA6R/voqHetZth5A77do8vvIoOOUYdJnPPi5GoUw:j3QGiA6C7tZm7728v8BYHiPUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773247760, "uuid": "1a715db8-e1ea-4ed9-bd52-05054c30c651", "value": 527816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773247760, "uuid": "0e6d0c1d-5b7b-4626-9b8c-e26112443618", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247760, "uuid": "d011026a-fdbd-4dcf-b0b9-87f457ee0633", "value": "Stellulate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c5b750-1d1f-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773215663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215663, "uuid": "b5438edb-5e92-480b-af58-a30038a6fc8c", "comment": "Malware payload (ACRStealer)", "value": "edcfb2d942956a5e789a5b59ba886c7c", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215663, "uuid": "8d9d329c-7359-4095-9d44-70de78f998c0", "comment": "Malware payload (ACRStealer)", "value": "2b00e773b3962b2d666cfee40d35476718ff44606e503b49565381973c31b3f8", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215663, "uuid": "eadd95dd-2926-401c-873c-e0f9f85c97c5", "comment": "Malware payload (ACRStealer)", "value": "f5fddc70b20dc539b98ca2c1ca23a233520f20a7", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215663, "uuid": "289e1bd7-25a4-49f5-900c-aee24e4a7946", "comment": "Malware payload (ACRStealer)", "value": "df12821d8b7afdcb15203fa5f39495cefc077e4be995f7f47ede731aa3d2f7ee97ddba805eb3d2d05a963b37d7e4f1aa", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215663, "uuid": "e7ca98c9-9560-43d8-a12a-c92558b701bc", "value": "T130058D9266E357B1F2976DB2543A631FD33822344710C9EB82505ABB9A335C3247FBC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215663, "uuid": "22cb43ee-4078-4279-90da-effdf0022c4f", "value": "075df4573b739d86fb9209e3d2993719", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215663, "uuid": "cc42e54d-fe3c-4c68-9142-0d1d341133f5", "value": "12288:0P4OjcwTl/VTdIw1FUbl/yH4WJRbw1Fc2mUPPZe5pACvbeN+hEGDYo+xD55F4V:0P4Ojc5TchQZopACzeNUMoO5qV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773215663, "uuid": "af34b5f9-2a40-4cdb-bcb8-c94662a5d59e", "value": 819712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773215663, "uuid": "d4d4431e-14a6-415c-856b-57f8a5921ade", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215663, "uuid": "965ab059-ebca-4719-a1d9-7a58d7600c21", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8196282-1ce6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773191241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191241, "uuid": "04aa0b49-46bd-4f30-bc27-a044046b7f33", "comment": "Malware payload (Mirai)", "value": "7c60657441adc44b3079e4e1aba4040e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191241, "uuid": "03d3a7df-9bea-4559-b436-280848d860eb", "comment": "Malware payload (Mirai)", "value": "2b036e7352e5569b061e11774e60c1631c7fe633f47495cb3ca85c78fa7f0ef5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191241, "uuid": "a56023f9-ff6c-41d4-8d58-f557b81c8e8a", "comment": "Malware payload (Mirai)", "value": "e9ec6b43742966a5c49ee610e08ad83971e09479", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191241, "uuid": "e61c00cb-c4ce-46d6-86bb-606f762b7b73", "comment": "Malware payload (Mirai)", "value": "64c6225e4840d72407bc66160346c07c68154571e12673216dbc51ac888999c0868505db77ea46031e66f83254466792", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191241, "uuid": "c5d27fa2-be77-48f8-b491-9950ec85e44b", "value": "T108A30709AB650FF7DC6FCD3706E9070635CC651A22F97B3A3634C918B60B64B5AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191241, "uuid": "46a4bc40-9eec-40df-9e96-3ac7789f18e7", "value": "1536:uJri55uEJPlFt3BCALbF88QUW/M1ms56XGZDQ+wbp4lx9LJxXY61d6cM:A+3uEJ97bxW/w6XGkmRxX1l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773191241, "uuid": "c7228db4-54e0-4443-b7f5-c026d174b55f", "value": 99560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773191241, "uuid": "78fb0705-f032-4db9-b79b-894a0107b7d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191241, "uuid": "806a5d80-ea33-49d2-93a3-10d7a7b06a23", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a21591c1-1d25-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773218289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218289, "uuid": "c365fd6d-4c8c-499b-8eb7-aed07575e49c", "comment": "Malware payload (Formbook)", "value": "e8195102dd4aa92822a0facdf6d7524d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218289, "uuid": "695a19cc-b9c3-4cac-9473-dc89f4c574f9", "comment": "Malware payload (Formbook)", "value": "2b973dd6686e5fdc533eb55644bf25fc5deefb87eee67f325474d0be3cc53561", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218289, "uuid": "3385b047-d8de-4a0e-bdc9-6d0df9949413", "comment": "Malware payload (Formbook)", "value": "e2788b9bf9c7d2cbf45269a7b60cc8af50578f31", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218289, "uuid": "6cfd0514-45b6-433c-9672-f26838da357a", "comment": "Malware payload (Formbook)", "value": "21f7ec701af94fdf9acc2243b251555bcaba14dbebf8e108beef11e8a00c09955479641a8d97ed4f8b6cc397cb6b1fc3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218289, "uuid": "66a64a6a-951a-488a-bbf1-ce6082cd1c27", "value": "T11B95C0B6DCDE22F0DF7CB72984FF6005131318A5992DDADA17C2EC0A7BA7404506F6A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218289, "uuid": "1698d7b9-3f0f-4591-8f4c-728684a56e03", "value": "24576:UURRRRRRRRRRRRRRRRRRRRRRRRhSLrDi9hKPzQuADVgg5WtKjCDh3lhjkHkXT2XB:fK8JROgAUFIx0s1jsQG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773218289, "uuid": "0a706930-560f-44ba-8127-092d8d638324", "value": 1985528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773218289, "uuid": "5018d402-4591-4428-8a8a-acff0098b700", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218289, "uuid": "948b0419-c69c-45f2-b647-9b910a8cd3a5", "value": "50% Advance Payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e282538-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217638, "uuid": "6d091269-f016-4970-82f1-18e514ac5b42", "comment": "Malware payload (Mirai)", "value": "f51b2a21889deeb52cc401624a2cf81d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217638, "uuid": "cc1fe75a-336f-4951-a263-103cb50a65a5", "comment": "Malware payload (Mirai)", "value": "2c1b0fd298c55b1ae875d4b2ea79e2aa61ced84588a2104c9fc4d3e494cfb9e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217638, "uuid": "ed0e321b-b8c2-4d04-a4fa-72c146f0f2d4", "comment": "Malware payload (Mirai)", "value": "4fc8f04334dd0fad13af86a5f29d6b725418b298", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217638, "uuid": "a4e8b8ba-4475-4db4-b6f5-9c40feaa22de", "comment": "Malware payload (Mirai)", "value": "a8067bf9d08b4e670dc2d8a61023222b4401db397cd760f72c476a5809bdb668dc85205eb4f07e587c9bcd3f11317cdb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217638, "uuid": "ff6e8344-fd70-4d16-8c35-0b09eb0d715c", "value": "T135961852AE822B67C1DC077540ED629672A43F455B91472323B4EBEC3E7773CAF4A848", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217638, "uuid": "11408c27-df5e-40ff-8a26-7e380d147885", "value": "49152:9YnMt0GeyFk5jnZuOi/jyKHVBywC/Tr78lWYZu+Gb0vKE+2Aum5EP:9ugheykFnI45LoveBEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217638, "uuid": "6bb784ef-7f2b-4f2b-8242-9f71e57b7710", "value": 9175188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217638, "uuid": "2a001501-3678-4708-9d54-decc082ad9a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217638, "uuid": "6ac73587-f546-481b-baf8-dc4303bdc845", "value": "biosd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bc46a53-1d27-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1773218896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218896, "uuid": "505df616-cd32-4d21-994c-0651ee35fba8", "comment": "Malware payload (VIPKeylogger)", "value": "6bd53441f8e6ef655089cc775cdb9c52", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218896, "uuid": "9270b258-36fc-46c3-9543-3bf832280728", "comment": "Malware payload (VIPKeylogger)", "value": "2c1b5c4603ba3a79bdb541f2eba98828781c742fdc0545bf45745cb3173575b2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218896, "uuid": "b91d1edc-8798-4110-baa8-8054dcf83b40", "comment": "Malware payload (VIPKeylogger)", "value": "69ac8e9be8a8a562ec96399c3382455baab8e722", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218896, "uuid": "b0c22a7e-a570-45f9-9062-2a7b983d38da", "comment": "Malware payload (VIPKeylogger)", "value": "26ba5ec2e4069f247f968b8be4154a3b7335b7e859684fc80d676bbd986cde7a4cfbd18562babffad5a3edbd549dc18b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218896, "uuid": "1ca2a9f7-d61e-49c5-a9c9-be526497eb15", "value": "T1AFE3E015DEC81FB58BA8851540FD5ADE67BE03CE2436258AE7237D0A9FF744810FA1E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218896, "uuid": "39a24148-064f-4993-9efb-6e80a6abadce", "value": "3072:Iy6G58Ftqc/kTAVWpCCQNLDebXwLGTHXdfY5kZDyB:d6G7TAfW8LGzX9Y5C+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773218896, "uuid": "66aa48e6-86f3-4ffc-a84b-473bbf8bb6e3", "value": 152633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773218896, "uuid": "e899583f-bb1b-4974-93e8-752c9cb18b1b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218896, "uuid": "d11a9488-aa02-4fb9-a6df-c51d0173d728", "value": "RFQ - MJ4300- 73702668.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ab5014-1d70-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773250398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250398, "uuid": "79b77f09-999f-4e8c-b151-09964b709857", "comment": "Malware payload", "value": "df51b1bf232d7dad2975fad84e8698e0", "object_relation": "md5", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250398, "uuid": "c78e5373-05a4-4e9e-9495-574729e63977", "comment": "Malware payload", "value": "2c7ea92b24edaa8d2f99829532346a048c98955320d24a8482344fed5d868741", "object_relation": "sha256", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250398, "uuid": "f859204b-e283-41c9-940f-1f52ff6b2a02", "comment": "Malware payload", "value": "d98fc47871d341eb821cfe0e981e0d69130d6306", "object_relation": "sha1", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250398, "uuid": "74a5bacf-7215-46cf-a2e3-c716fcafb589", "comment": "Malware payload", "value": "1c7f6cf17ba526336d986c4312e4f9c32e302daabef64ac0ce1dfa47fc8a6818f62c20f9b0477c832a78ce0d17ae91fe", "object_relation": "sha3-384", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250398, "uuid": "f32c3882-39b8-4a5f-b282-88e32807cb36", "value": "T1A285330AF163C76F8BCC608C4AF91BF9936483484D8F39649DB8A510911FDA6EDD7970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250398, "uuid": "649da145-7234-4cfb-befa-f3cfb1e21b52", "value": "49152:CYD28GwuaPxAT1A5FMijQV71nYaW0LfDPVW6xTA2wVIhWa7:CYDveaPmQE6PCfLLTGDa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773250398, "uuid": "b2166bfc-e6fe-4f50-89a4-e7d7013ea704", "value": 1859320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773250398, "uuid": "2aa32135-6009-48d3-a442-9a512d5b9b41", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250398, "uuid": "dbb94e83-a307-4b3b-b129-ad43003040f5", "value": "MSI_PRO_with.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d262db8b-1ce6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773191312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191312, "uuid": "8db9bbd2-c721-4702-8388-724d98a277ba", "comment": "Malware payload (Mirai)", "value": "93e81e49cd410591781d054049be7874", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191312, "uuid": "846b114c-ee4d-4f6f-8903-25db5e9a890d", "comment": "Malware payload (Mirai)", "value": "2cfb94aaac6ebeb20872e04ae23140a8cbc02779234523e3c58d8f9906530654", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191312, "uuid": "de791af2-9ce1-43d2-b20a-3a8bcb46b757", "comment": "Malware payload (Mirai)", "value": "ac02a200eac58f5a8343f3f43c4c8e0533de52ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191312, "uuid": "13656ee5-034e-46c6-a6de-0a1743c2bc6b", "comment": "Malware payload (Mirai)", "value": "8516156eaf58203912d1f46432719975e58f3196d7c1ee38ec594d7ec32defd0aa7b3db35bd3ac98384d5f7dbf178da2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191312, "uuid": "b0f354ba-1764-4476-92a6-1157de1b5611", "value": "T122535BC4A743D4F8F95605795133B3336B72E53610A9CE8BC3A8BA32BC52911EE1B25D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191312, "uuid": "7bd691a9-9455-48b8-adf5-65c17098d3b4", "value": "1536:iJ1cbpvrvokOkeu9MPQNqOr6dalpvCBI9PyTCavNuMFVtKSSBdU:iJy1vrv9euuKqOXqC9SCwkMMd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773191312, "uuid": "e2a01c7d-31f4-454c-9feb-092dd259e745", "value": 64592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773191312, "uuid": "ee688ae4-4ffd-4d15-9221-e9c92b79ee22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191312, "uuid": "2a8d1132-5ec4-4568-8418-235c5b1e075f", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a5fbd9-1d1b-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773213839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213839, "uuid": "bd789f86-dcd2-490b-874a-f62998cf9665", "comment": "Malware payload (ACRStealer)", "value": "d7b941bfb5ba7d37137b0e74e83f6cf8", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213839, "uuid": "5dabf176-a641-429f-9631-7f84d156467a", "comment": "Malware payload (ACRStealer)", "value": "2d0f49b4f602791d7341a1ca350e84d8ea622cfc09928b8d3f1df5ce48a11bc1", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213839, "uuid": "827285a1-d2f3-432b-b07b-a8d6650d1160", "comment": "Malware payload (ACRStealer)", "value": "fe9708c3533ddfb68f9e419acc17a49114d5354c", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213839, "uuid": "b4698c82-99b1-40c8-b72a-1bacc1bdeadf", "comment": "Malware payload (ACRStealer)", "value": "f1d931e3eceda6b8dc82d84da614f3e13551516c2e923ac279416f11afc7e7d5d8405b22a253a0fc27a80a5084e230b1", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213839, "uuid": "23754622-26d5-47c9-9b14-d494b2c5a672", "value": "T187558D5DE6FA05B5E4AE523941179A1FA331BC3C0F10CACB12A4CE7E9F66BE14934B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213839, "uuid": "8720eb4c-164c-46ca-a067-f98ca2593290", "value": "6f8e9e4ca91e2007f07d7c4bc1035c4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213839, "uuid": "71efcd21-30c5-4886-a98b-05d8ac348f2e", "value": "24576:Ut3JZbemnervmsUG1/P8XUXd2zf7G5b4Fk7tTraK9HC1DON4OBFaWyUJV/3m:BzDzP8kXd+7qda+4SqUJV/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773213839, "uuid": "d024e2f0-5b26-482f-8fe5-3a4eb2666fff", "value": 1361408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773213839, "uuid": "0c17d43c-85d0-47d1-983a-705293df9be4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213839, "uuid": "786e7af0-422b-4244-b707-5495102cd7ea", "value": "SecuriteInfo.com.Win32.MalwareX-gen.67158682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b7366d-1d61-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773243959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243959, "uuid": "4c3a189e-6260-4273-a799-15811b55b32b", "comment": "Malware payload (AgentTesla)", "value": "70d102ea1802fc4521e02e6f62e53f91", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243959, "uuid": "df76ff09-5720-4a48-af00-5ee3d13de2ee", "comment": "Malware payload (AgentTesla)", "value": "2d6c2f5c0122193732dbb6749994c5e6286e456545e012d47d4ec7f4d5abe7ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243959, "uuid": "8bcc5f4c-5342-4cd8-af3f-5dbe158cea85", "comment": "Malware payload (AgentTesla)", "value": "edbf15e33cac58cebc2eb1aaa9b52759165e33fd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243959, "uuid": "c3761a19-80d7-442a-bb89-b51364d7474e", "comment": "Malware payload (AgentTesla)", "value": "d54723f95896f86afe732d5413ac20baccd6e90e94783a54c5b373b1b06d6a0b9bb517e9ee283c791fb9cf21199d6274", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243959, "uuid": "3cfe3881-5964-4fba-a768-a6dd7601db1a", "value": "T1F8162AA4E1C4876538532D71F770B0D14A8776DF7D86B623E01FA7B1BEA72C2A931221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243959, "uuid": "bf00545f-5245-4e3a-86e3-c848d4557347", "value": "98304:8QuMXBORgn5OT6k3tXTGI2iDhGK4qufraOB3Wn9NV2sIIbR3a3M3UNNnzK+Mw9WW:8yXBORQ5X0tciD0KYz99Wnj8sIIl30Ki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243959, "uuid": "f120f905-e912-42f1-a885-dd5d1835b300", "value": 4181657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243959, "uuid": "8315bbf0-1062-4df2-ae44-8bf5caee64f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243959, "uuid": "519db1f2-db0d-4a50-b1da-1d00401622dc", "value": "Payment Advice.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efc6b102-1d87-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773260510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773260510, "uuid": "41a1e0db-368e-48a3-bbe1-4c649cf99845", "comment": "Malware payload", "value": "10856fe6d92cb725b036093ecd0f78d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773260510, "uuid": "d69b2394-ae5d-4f64-9396-616e300183bd", "comment": "Malware payload", "value": "2e9a2252e6120c4f3fd4dcc023d87fc75c052e9623c3d23e57f7557cb50e9620", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773260510, "uuid": "a30b00fe-3a2f-4acf-a799-896d8a734a6b", "comment": "Malware payload", "value": "aa3f906f477dc44592fcf9ae58eeba5a53c4764d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773260510, "uuid": "e7db2d10-a61f-4896-a691-761a8942f5d3", "comment": "Malware payload", "value": "9042c90f38e8e9ca5653513a593ab6d667e8fc7ce0a1352aa55711c5be2ca40bc18be684613dec24bc2548bc09da268b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773260510, "uuid": "47f11dfe-19d0-45c6-b6e5-a8fce3e2175b", "value": "T14C751248275AD841D4E95BB01D70E37926B54E986412C303DFEFFEABBA3978678403D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773260510, "uuid": "095f0ce9-69db-4b3c-a338-cf9fad8d978e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773260510, "uuid": "f68308b5-0625-4677-a9ab-98f01f3bdaad", "value": "49152:BcoE7L9ynzvaJhnAO81fYXwVvw3Zn6ENPUSCM7Gnu:OV9yzv0L89YXW6Pyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773260510, "uuid": "75c01181-5684-446c-8642-a0bf4ed1f12a", "value": 1640448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773260510, "uuid": "74a3c5c1-a71e-48ff-8048-5624769db86a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773260510, "uuid": "14429630-3ca0-479c-9c7a-48f0e06180fb", "value": "Remittance Advice 11032026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a875d8c-1d23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217391, "uuid": "a1ceb0b7-9e22-4248-8619-83d305eafe0a", "comment": "Malware payload", "value": "c89b9903e358aafe00d646f79d94c214", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217391, "uuid": "9c540a79-b970-4b8c-ad8e-0d6fa3fb9327", "comment": "Malware payload", "value": "2f42a96f5746bdfa41ce044f3d2f3e62380344a5344fec8520811655ddc033b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217391, "uuid": "429987f2-0866-4c83-a5eb-ae935c6e3965", "comment": "Malware payload", "value": "5878095f8dd6d2e319b76dff9ec385c83b4d002d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217391, "uuid": "2483db09-d708-4a4e-97ab-9886ba06bda7", "comment": "Malware payload", "value": "7e2f5e9b33405e4ee996a7aa1498091c5c4db759cea4f55603e285f44efa445efacc924fa69dc669d8ec3d58b4b0d4d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217391, "uuid": "269eeafd-b9bf-4e45-920e-a7cf6aeef676", "value": "T13134C70AAF610EBBDC6FDD3706E90B0625CCA50722A43B763574D528F54A54F8AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217391, "uuid": "da0acd26-4e44-4a09-aa67-52777d8268e6", "value": "6144:p96natc5jbgq7ow0rs2kJxX7e3oEt6149L:pdmkxsri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217391, "uuid": "66e8ca76-f6d4-422e-84f9-dbe58cb9d0b8", "value": 241272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217391, "uuid": "a065501b-5de3-4e6e-9c1a-090da454eccd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217391, "uuid": "7c318cf3-8839-450f-90f9-142289c8c05c", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13cbab87-1d55-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773238666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238666, "uuid": "948a7bbc-43b1-45d4-b716-dbca5e5f5c57", "comment": "Malware payload (Mirai)", "value": "48ca394b27504e131526d27242d4fa5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238666, "uuid": "28e34fec-df56-4a19-b770-ee13c73d37db", "comment": "Malware payload (Mirai)", "value": "2f94b3aef184e009a4a8a6c1958d44734a0ddf2f29807e2ca2500fb0dbfc512f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238666, "uuid": "c3e89d23-1e3d-445d-b30d-369df76ba1b6", "comment": "Malware payload (Mirai)", "value": "ff8d4c6c219ad978d7e6920511406c807be760d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238666, "uuid": "eafeaa43-cf55-4e8f-ac5f-f32695b5642f", "comment": "Malware payload (Mirai)", "value": "74117f8695f955459e1b5c17cf9f3c4489d5bed874cf44fdf466af8b96b6fc91d41ff6b147b1c14d92357f74f3247c75", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773238666, "uuid": "f41a0cfb-d5e0-4d01-8e7d-07301d1b0fc3", "value": "T1DB330272025F53B4E905E1700C9EA7C4F032B81FB9034AF7554971AAE63D6EB1F14BA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773238666, "uuid": "9734a8ef-c7cd-4d10-97c5-c4dcd13fe01b", "value": "1536:353lbRllzCmtHBCUdF+Vsg5JsuUQiQ34o:3J1LlDHjF/qJspQiQoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773238666, "uuid": "e1e56436-7458-4a6c-8d8f-169616125e9e", "value": 51324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773238666, "uuid": "6fef69b0-1893-4edb-981e-0b1757064809", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773238666, "uuid": "899a73d9-7b4e-4c7b-b10c-a0b0a653b619", "value": "sora.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf51a87-1d18-11f1-a769-42010a9c0008", "comment": "Malware payload (ResolverRAT)", "timestamp": 1773212831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212831, "uuid": "7313a95f-f26f-4a50-98b9-d6bb0578a263", "comment": "Malware payload (ResolverRAT)", "value": "6b58696a77c43b21585f02cd6569e735", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212831, "uuid": "dc1fc107-7edc-46e3-a637-4b12562e7fb9", "comment": "Malware payload (ResolverRAT)", "value": "2faf6556a65fc54fd76285662f237716a0201c0937e53b33efd40609f81a44fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212831, "uuid": "54d9dbde-1c9e-439f-a00e-b8ee546b1edf", "comment": "Malware payload (ResolverRAT)", "value": "d1051448a0e24315921fcb9ae261866eb3204c65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212831, "uuid": "f3c36747-9a02-413f-8561-de3c0a6f6dca", "comment": "Malware payload (ResolverRAT)", "value": "bcba46ae3811b23d8a679375754a81116e6de23bc909fe2ade28632b3247b8be2aa773ba189cb3c111b1b01247144005", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ResolverRAT", "colour": "#ACEDC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212831, "uuid": "02c673f4-25c0-450a-a495-38aa7c6b2737", "value": "T129D49DA673674E22D1442777C0CB8A41A3B5974AB5A7F30F724423D6154A3EECE07AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212831, "uuid": "4188ad98-d9eb-4038-b20f-9d89d335ab6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212831, "uuid": "0bcf29a4-7694-4301-92c9-0d6efbb803a3", "value": "12288:fsAJzJhJ6GRFJWPWnCWfcok+fFfvzAXKU9:fsAJzJT3RFvn3zk/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773212831, "uuid": "7ecd1a44-71b8-4aa6-9054-e11f9c2cd1de", "value": 606208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773212831, "uuid": "6709b0f3-252b-472a-a420-e3e225293f83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212831, "uuid": "49d669b7-825a-4b9d-a6f6-66f9d1ec9336", "value": "6b58696a77c43b21585f02cd6569e735.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6432c2e0-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773216897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216897, "uuid": "3b5a7036-921e-493a-9135-9c76b5fdacef", "comment": "Malware payload", "value": "c94a1939470325a3a85e251f393e10d8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216897, "uuid": "a7aa7925-39b0-4196-b30b-07be9ec66f47", "comment": "Malware payload", "value": "314dfb2385d84fd279b7e297313da57e3d349711886e152d2a6e82016a657f9f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216897, "uuid": "acd1bbcb-bf21-4e2e-9506-316a2a4c1188", "comment": "Malware payload", "value": "69d8a61ae81a716360c1e52f7079c9ffc14c37e1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216897, "uuid": "b73ee821-a4a3-49f4-a28f-38179e46f0ae", "comment": "Malware payload", "value": "0831512c4ce30b40d6f32c9bb11e236d24dbf22c0170965fe195c6f201e0632cf2e2d7f2be3b2f9262ee0d4e28ee482a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216897, "uuid": "38dfd888-ddb1-4571-bb41-1758682a27ba", "value": "T18DF2C784EFB50A914A6723C79E69A37A6CB4836B63106364DD1F469C070326CD3FB778", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216897, "uuid": "d859d074-2aef-427d-b3ae-96a4eb1df4d6", "value": "768:0Nu2hIjKPwQ2hI2hIjDI2hIjI2hIq2hIjVk2fbHjFr10orjvbdq2lzGDvJDvlLtO:qUHjFr10coA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216897, "uuid": "fa696d8f-3560-41b1-a66a-20bb41018c2f", "value": 35095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216897, "uuid": "92c36e0b-b138-4ccf-8889-6445bb69b206", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216897, "uuid": "b1153259-4b60-4787-87e9-8ca7466b0434", "value": "11032026_0625_Fattura946562284.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a6b6dd-1d6e-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249727, "uuid": "e9c16b0d-c164-4f23-8901-93e9a5eab7c3", "comment": "Malware payload (WannaCry)", "value": "9aa2f539b6a717dea5e3cb290902ea28", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249727, "uuid": "b25cd7b3-ddb6-48f8-89fa-f82b9df9492e", "comment": "Malware payload (WannaCry)", "value": "318029f261083d74e2acb44b2614f15eb4285b3f86b632513373432adac55bdb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249727, "uuid": "22b5d6cc-c5bb-4115-b816-debf0d83b10d", "comment": "Malware payload (WannaCry)", "value": "55488e59945eac1d98735a90000fdf09361a7c38", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249727, "uuid": "0f3342fd-03fb-47ae-a1c8-b08c2419ff09", "comment": "Malware payload (WannaCry)", "value": "9e4a63a2ffc43a815b645d5324c0f2d9cf9cdabe452452cde4efcaf9f5ce57967ce60e060ca719541f8c2aa0c4ec42c4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249727, "uuid": "14b72f3f-feee-439f-bc89-d4aa370c38f2", "value": "T18B36F105A2D82B64E6F21FF2217B8710477A7E45895B936E1660A04F0C73F5CDEE2F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249727, "uuid": "261d5da0-0195-46d5-8118-bb60eeb3ba7f", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249727, "uuid": "19dc4258-a8ea-4c9d-86e2-93e0bb30f25f", "value": "98304:+DqPoBhz1aRxcSUDkcA/hD593R8yAVp2:+DqPe1CxcxkcA9zR8yc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249727, "uuid": "0662a2f3-9359-412d-b070-21b8544c5090", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249727, "uuid": "e3095e50-de46-46d3-a5a4-8d4702bac6f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249727, "uuid": "67d4ea8b-f295-4ef3-b4d8-d8c8030a7c17", "value": "318029f261083d74e2acb44b2614f15eb4285b3f86b632513373432adac55bdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9da3a9-1d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773256483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256483, "uuid": "72f3101e-937a-41fc-8984-f0ebf0810193", "comment": "Malware payload (Mirai)", "value": "b185dc1446b628c37aff280ff2e6836e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256483, "uuid": "ba21a4e7-5166-4de2-bb59-9a079cdcd438", "comment": "Malware payload (Mirai)", "value": "32d479bdaf0c159b10c08dedc83f8336a4ccec6c3d203f5549a8fa4a9163ba9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256483, "uuid": "023192a6-2785-4bdd-8ce6-5d46e3ba96ef", "comment": "Malware payload (Mirai)", "value": "8589b764490b95146be287086989eea219db9e2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256483, "uuid": "8c5cec21-2adf-4340-b4ee-d9e6c7699beb", "comment": "Malware payload (Mirai)", "value": "eb610a4e3f873f85fc362033f5b124a9739e4814fac6cea2e067fc8c7f7dfc3ae70b71156f97898d65fd253c3bf519c9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256483, "uuid": "c36796e8-35c3-4eb0-8685-2f06a810f1fb", "value": "T1F093B81E6E219FADF769C73047B78A21A75833C627E1D685E25CD6002F6034D642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256483, "uuid": "634b081b-eda5-4d0f-a11d-e1e02c5cb0cb", "value": "1536:KloXJI3TfgvWQHoqXXgLAHw3AGh6zeglH08kYf:KkJIDovlHxwLH3AGka89f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773256483, "uuid": "860a1ec6-0782-40bf-9e5c-58c4c6c4ef38", "value": 93352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773256483, "uuid": "9fd0432c-6dcc-47be-b739-59cfe3353438", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256483, "uuid": "9b577583-6116-422e-aa18-c15bdcdb3f04", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb5680ed-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773217123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217123, "uuid": "2c387061-e413-476d-a32a-397bb1cf30ad", "comment": "Malware payload (AgentTesla)", "value": "9c6a5e49ce1f3f28d8ded261ed61bf6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217123, "uuid": "8b3c47ff-0578-491b-82b6-cf28b6bb2b06", "comment": "Malware payload (AgentTesla)", "value": "34e1551055a3db36eea0438f165ab00b60c47e503e8af3f8ecc9aca66c4ffb13", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217123, "uuid": "456b7762-a4f6-4111-aa5f-ba67399411fe", "comment": "Malware payload (AgentTesla)", "value": "cb5a5ee1cf8c48d7af915eee91461a05e473a4dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217123, "uuid": "13ab893c-78aa-4d8a-86ef-b0f1739614bc", "comment": "Malware payload (AgentTesla)", "value": "7049aaeb564f7deb76e444c14393bd3a3e6c2f11e86f952dbab981a92992c81167c9267752c8a0f168d76d2542335967", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217123, "uuid": "67941937-8754-447a-afc7-7c0e0876c65a", "value": "T13D162B65B194DBC438176C71BB54B1D04B8739DB7D81B502E03F6BB1BBA72E1A863232", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217123, "uuid": "904cab1f-dafc-4b62-a3a5-d3e9922af549", "value": "98304:q1uGhmj2oXeipoAfamgQ9og3lRPFoHjE2Ut7JR4N/SPmkUkrCDNxfZUZ49yFMVLk:OuGIuipoixgsog3lRPFQE2UzR4N/8U2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217123, "uuid": "02968310-4ef2-48dd-9627-f3b0eeef12f6", "value": 4181657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217123, "uuid": "9267cc06-edae-4e88-b7c8-5a7dbf88bb48", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217123, "uuid": "600d0658-0b72-4418-b80d-ba21e211b49d", "value": "docx.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "276d56e4-1d61-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773243853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243853, "uuid": "5f1cd4f7-a150-45a2-94a7-334c50ded2c5", "comment": "Malware payload", "value": "e1f3b7eec3635062d7c02b2f638ee3ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243853, "uuid": "41d6d292-9c9e-4276-9b90-ff52972882bd", "comment": "Malware payload", "value": "35d525ff0c420a9f649b001287a4a11c559a6421e1b8bebddf341481e366dbd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243853, "uuid": "9cd1ad59-ab2c-49e3-b4cd-828fb3eaf016", "comment": "Malware payload", "value": "2d5d24e0ffb8912163e36a35101c78cddffe6847", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243853, "uuid": "551f70d5-26e9-41a0-ad7f-74cf083a1917", "comment": "Malware payload", "value": "fa9f8aae4c1506407da0075ecd138b3efd0acace9001907300182297699f347a8bf3c96ba0bd4924d24f414156b6378e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243853, "uuid": "a0c25479-6851-43fb-98e5-b8938b34af79", "value": "T1D2D2E6A2FE090DC8C08BF53894B78116771D787E83B2274FF6519A2D1B06269AC97F49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243853, "uuid": "9cab8617-1ba3-4d0e-b821-0d4d0ef8d150", "value": "901e6222b7539d61ee1cad22af60ac37", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243853, "uuid": "5bcf73bb-911a-4de5-ae60-ca87fa337f19", "value": "384:vWMmYMc74+l1z4wQpLb1Qk6O3kNISEofi5Ch1apwL8Sy+FbHvTn+9BrIsBGM/WvW:v7xjzLQkk6O0N1Zh12wLZLnP1dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243853, "uuid": "7ad9cb53-1154-4929-939f-59a7c6cd9f30", "value": 30208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243853, "uuid": "9ca5d35e-c058-462a-bb5a-b6e074ef991b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243853, "uuid": "81a3a1af-4bd1-4be4-9805-016247589a97", "value": "SecuriteInfo.com.SuspiciousPE.94174346", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d9ef25-1cea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773192742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773192742, "uuid": "efe6f35b-0a65-4232-bded-a3e7e6d47f38", "comment": "Malware payload", "value": "e15c5eaf6ec6a98f208a8ab3679ee92e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773192742, "uuid": "7c0981b4-e828-445f-84ca-b3ae088e1211", "comment": "Malware payload", "value": "367169f5607fa2bfab512fbd7f1c7093f7c52982e6d1447fc749a8357bc15642", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773192742, "uuid": "56403f46-da72-43d4-8e9e-5bbd78e7648f", "comment": "Malware payload", "value": "d4e2e2c9dd1104f1da68caca0ac1fa949c762038", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773192742, "uuid": "a1809b28-09e5-4c15-9a66-59cef9e1b512", "comment": "Malware payload", "value": "520d1717a86cf778dc73fad09aba7285c7426ef67a3bc5d548f88c1a527456f355ec8f51c4a3d44ee581239007d96d58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773192742, "uuid": "1c34e70f-afcd-474b-a175-a64f0b64aa3a", "value": "T176978B0773E601A5E5B3D2788AAB5103D773B8625730CBDF329C06552FAB6D09A7B720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773192742, "uuid": "d1ba131c-0dc5-4c98-976f-6740a029bf86", "value": "1558a68fff2ed1b2060c0c344b24acf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773192742, "uuid": "71cb07b6-27fe-4283-ab69-ca6dbd5e35d5", "value": "393216:66F3TI9E/wpw2/pblsj7KfEfJInv3lMz5/oZxGsnxylfyYr8BUkpcI4BXr3/hIxI:69HlkOm6CXdIxO1Mkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773192742, "uuid": "41513889-d040-4a72-9a62-b09417afaa97", "value": 43128609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773192742, "uuid": "23b8afd7-cc5c-4045-ad71-9b25c53c2fc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773192742, "uuid": "75b33eee-73e3-43b1-b501-e2cde94ab008", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f12f633-1d80-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773257341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773257341, "uuid": "09f21e2f-5266-4725-a510-bd3c81223c88", "comment": "Malware payload", "value": "7856cee9e766d0905c40be6189525e86", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773257341, "uuid": "8a12967c-463d-4c45-a7bc-2afe862d5a6d", "comment": "Malware payload", "value": "38773ef36f826313577cfc0da088415b4d8408dafe7723c2592978ffee7d864d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773257341, "uuid": "acacd108-40ca-4ddd-bd06-39c47ac57988", "comment": "Malware payload", "value": "e2e71b5ef6140676c61178104a5f4ab96e4f8ecc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773257341, "uuid": "79b23fd9-8a1b-4930-bfbd-97eae1376c98", "comment": "Malware payload", "value": "3f14e4e93e1886ba6b79f0a6c2ffdb8920df741dab2d400ca0dee9f14e16ecc7fc5fce6415a681f7a0cc5be554353cd9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773257341, "uuid": "53988bfb-d37e-4bbd-ba7b-91b7cfd0a83f", "value": "T1DAA59E03E6991ADAD4BBC0B8C5112A67F4FE78310624AB3B7AD80B947B12B3117FD745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773257341, "uuid": "2a0309ad-8c39-4a41-9f2c-e227661bb2dd", "value": "acbce142e0c10a19b67eff888c542e42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773257341, "uuid": "a75748f8-54ff-4081-b6ef-4cd64f598e40", "value": "24576:OALEojSMtgKOfD9xiOmsVzpXMEGBjAqNfJ9JGIXTrntWRV/vFxRNdPSgxyqA1Waj:NLPHgPJ7pVMrZZsIXTDQqlfDUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773257341, "uuid": "dde2d6b2-18bf-4c29-a293-2d97acc00fdd", "value": 2211840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773257341, "uuid": "6a6ecea6-2c68-4f06-a983-9587445dafdb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773257341, "uuid": "26bbcdc9-a403-48a8-a68d-e4d25ab88f3f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63499946-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773216895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216895, "uuid": "4452f168-ec01-48fa-aed6-5b97211383f7", "comment": "Malware payload (AgentTesla)", "value": "3a70a8a9787cbcd930a8d1b9921d3d38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216895, "uuid": "9346b9d7-36b6-458b-b507-e30b9f788e7d", "comment": "Malware payload (AgentTesla)", "value": "38b9f775b1080b1cb5afe51c31d93bfae6c199f07b84757405d49926885a328d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216895, "uuid": "44db9573-9ed1-4de6-b54a-e01c368d709b", "comment": "Malware payload (AgentTesla)", "value": "20f19c4b1b6dd38e99829e42b9b0ef408ed631bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216895, "uuid": "df8cc8ce-4387-4e1f-96dc-fc25ddd3b9b6", "comment": "Malware payload (AgentTesla)", "value": "2c25e90204eaf016f94d8e291092e787906f00a93c64de9afa51114ba5211ec23ef697596381297a39d7a078ff733852", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216895, "uuid": "3d88e52e-c6bc-4b5d-b1e5-3c229fae6662", "value": "T11905A4B242B3BDEA9B6E7D41C4943C44CDDC649B876681AFF488099AF1F15D4EE36830", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216895, "uuid": "af4c4bbf-32e4-4b97-a3b2-34ebd141e435", "value": "6144:XZVEolYqPWmW8rWEreKby+C+PhiwtWjpbhZZvfzwlh5DdRyYAq1D5xIwxQ/s55V2:kV6WEr3bP6Ow4fIwxQzLF/XJiobsWQKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216895, "uuid": "489e0133-b071-4401-a788-e45563f0bba5", "value": 824248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216895, "uuid": "93b02e12-f3f7-493d-9c23-227b8641bea4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216895, "uuid": "10624d0b-b167-415e-9f89-9533e8396bf4", "value": "3a70a8a9787cbcd930a8d1b9921d3d38.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9425138f-1d4e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773235875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773235875, "uuid": "4cd4bc4b-df27-40d3-a1a3-4f51f434933e", "comment": "Malware payload (RemcosRAT)", "value": "06b8ac1cce3a715129e0c9072c3d267b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773235875, "uuid": "638284e2-5177-441e-bc44-116e2844d350", "comment": "Malware payload (RemcosRAT)", "value": "395bd33b1a3210c0210221a058f26e28b82b5952ef773177ae1da670707b02d3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773235875, "uuid": "f9a1d036-b91b-4490-aeec-9001c31792d1", "comment": "Malware payload (RemcosRAT)", "value": "8cb26b99bab53eb7032e7c74e5f1b2ffdac8c62f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773235875, "uuid": "2a775993-258a-4192-b8cf-c5ce33af82c8", "comment": "Malware payload (RemcosRAT)", "value": "d38436ddb871550ba626d37eb02144ced456c851d769c87aa1f7e04ba86d6270db3eb819757121a69e83917de06c86ac", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773235875, "uuid": "11b4797f-749b-4af5-a5dd-ced1622a8dd5", "value": "T13BE2448E7FC6F97503D735272D2B603AB5BD0E4078CCD058D4EB14E8B8687E8D526A68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773235875, "uuid": "539caaaa-bbad-4d83-bd46-d1ae451b54d3", "value": "768:B7oyvcTJThW8nAnmNZB4jgdJH6810Worc:VBv0A8l2kdJ51QI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773235875, "uuid": "66325205-5a31-428f-813d-17295e205c87", "value": 31742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773235875, "uuid": "07fdd6f3-be25-4118-86d8-0297085ef92a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773235875, "uuid": "3c9a46af-82ab-4d83-ae49-21e97e2facd8", "value": "Nuovo Ordine 59.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc54034e-1d6e-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249740, "uuid": "262006ad-ef54-48ca-a610-fe675228435e", "comment": "Malware payload (WannaCry)", "value": "4530d3d6dd04c8d0b5f6907ec34acacf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249740, "uuid": "3352499a-9fc0-44d6-b268-48d50ad039f1", "comment": "Malware payload (WannaCry)", "value": "3be9077b9feebd0a1dcfafc43778538e0b7c5721e7b2cd12f37ec7c03ef75cc3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249740, "uuid": "0b4421d2-77bb-4c78-ae85-82085e2fb36d", "comment": "Malware payload (WannaCry)", "value": "c74500e4c159222797b954fa30ede4d26627583c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249740, "uuid": "a6671352-9f6f-4980-b4d3-82c2b9f984f8", "comment": "Malware payload (WannaCry)", "value": "31f74a395de73b82df9746da39d98fbb7ba5fd6de848d9ca45a9787b40c13bcee8348aa6b3a9f891b8dfd7d5c10aa095", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249740, "uuid": "f95727ed-c672-4655-ae77-a1b730309b09", "value": "T19A363361664C62ECE1960BB4405386B8B3773C76977A0A2FCB84DB020DB3756FEE4749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249740, "uuid": "0e6b3e2c-c58f-48f2-9618-6ad0bba6cbb3", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249740, "uuid": "7ff4da51-f506-4f51-892e-cde9f17da2a6", "value": "98304:cDqPoBK6SAEdhvxWa9P593R8yAVp2Hvnc313MWFjRd:cDqPJZAEUadzR8yc4HvcF3MGR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249740, "uuid": "2e4a2e2d-e052-44de-bb13-621ee2c7f27a", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249740, "uuid": "f4a4d921-ce63-4a8b-b05e-de0640c95822", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249740, "uuid": "bce33425-bb08-43c9-b0ea-66039c5bb4c0", "value": "3be9077b9feebd0a1dcfafc43778538e0b7c5721e7b2cd12f37ec7c03ef75cc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77575343-1d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773256443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256443, "uuid": "bf5aff2e-39d1-4d94-b07e-424d6450d9ff", "comment": "Malware payload (Mirai)", "value": "6dcaebeedb039a560c26478092e2c55d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256443, "uuid": "b4d5e116-cbdd-4a68-ad3c-6256ba896e70", "comment": "Malware payload (Mirai)", "value": "3d0521f20ca2515efae65c909f8591205d6d207b5a2a36f21c73960409206a81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256443, "uuid": "c726f377-dea9-4241-9381-c27211c7e656", "comment": "Malware payload (Mirai)", "value": "fee659de9df744a822f1de4291d217fda87e7461", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256443, "uuid": "f9b33ddc-44bd-4242-8b88-7ee0d0da9e6a", "comment": "Malware payload (Mirai)", "value": "2ca58d3e0431ed012aadb242bd965e1a62660e3eb0c98fbab1c675db5699aa419ceab34a49fcc04b2b70ad8e0a9b986f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256443, "uuid": "07d21ca2-c849-4da8-8256-d2bc55fe7cb5", "value": "T1CC735B22BA751D2BC4D4A87A22F30725F2F2479B25AC8A1A7D710D8DBF3165032477F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256443, "uuid": "fc1d9b12-3291-4c1f-b748-def4971151f2", "value": "1536:mQMSZZm4fVFd9BPziJnHQ7jtEeCNM5UeWzQSkWtgWG:DpzHzHjmpN8UeIjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773256443, "uuid": "63105e87-9fa4-48bf-b5bb-4170cab46411", "value": 76448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773256443, "uuid": "5be605ee-dd38-4df6-9856-2ce997d8fd5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256443, "uuid": "9f28e2f3-4360-4184-8595-ec558cd67fc2", "value": "pspc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43e9218-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773217112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217112, "uuid": "cf5de2bf-c9d9-47a3-8d0e-3fd2b008c618", "comment": "Malware payload (PhantomStealer)", "value": "47e56e483e561eb8933f537a87b692d8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217112, "uuid": "0d8f5b7c-0cc8-454c-98c6-233eea93ced8", "comment": "Malware payload (PhantomStealer)", "value": "3f04be6321405edc63c25528f825d0830a5dc58f1791e7ac426574af7e3bb7cb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217112, "uuid": "975bbd1b-aa6d-44ad-827e-7033009e7c76", "comment": "Malware payload (PhantomStealer)", "value": "162c372533c6c40063a8ef5965b50834b90d283d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217112, "uuid": "0b25e3ca-f9db-4f2f-ac4b-a3e11df11d75", "comment": "Malware payload (PhantomStealer)", "value": "b6ab219e6431944305c13c0ae53213c0164344797f2043ae43699c08bcae4b3c2c085f06d038e2733c7ff48b4b40a19e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217112, "uuid": "9fde3c94-24d8-4190-a5fa-5c37a7c261b4", "value": "T1A526AF1293A5AA68C7C8531440FAE59B8EB0D2CAB41BFD56B921FC055CF7A103EDD31E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217112, "uuid": "8c2a2851-6faf-446a-b8f5-01e6c9f97c85", "value": "49152:2t5MhH4sLNAcbUAOB2kZetsmkAgFCN/Jt948vFqgpG9QmbVbTZWZFyFLLVbJ:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217112, "uuid": "7b991fd6-b901-4c7e-be8f-a1b62c4062af", "value": 4612923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217112, "uuid": "d4fda2d1-8dae-45f7-8848-706cdb276e40", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217112, "uuid": "00b583e0-e794-426c-9c6e-552aa1ac9bbf", "value": "47e56e483e561eb8933f537a87b692d8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c22e567-1d60-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773243485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243485, "uuid": "5c9c1fc0-c5b7-4428-8f14-a125ac22ccc7", "comment": "Malware payload", "value": "8d127e16dce5a0f15edf773cadbaed17", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243485, "uuid": "79a9847d-9612-4985-848d-030e1c6603b3", "comment": "Malware payload", "value": "40e11e5b80c5768a204b88046ab146b649b56b7af8fa57de691c16a1e112e50d", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243485, "uuid": "a952c34b-0fb5-4d8e-b7c1-eedd8790f576", "comment": "Malware payload", "value": "be0f2e12b1eaaa663453bf166211865cf359631f", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243485, "uuid": "5bd3eed3-1332-4620-8b69-65c441195ec5", "comment": "Malware payload", "value": "26e99637bdb6b48235c48eab03cf6b27fa9fe94551691a0d3a334918b9cdec6a31eee0d4156eb5f1724703d4f42b9794", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243485, "uuid": "e9ff9ee0-77f3-41a1-a925-e9b5b951a19f", "value": "T1C3642382DC0B34F414ED263EB297A1D00675A71BE0E8B653FC9D55EB5B57F309202C6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243485, "uuid": "0e97a76b-1bf7-4e1d-995f-6be0a7567678", "value": "6144:+zSVRM/1KqvdtM0BNIKzfxEJKU9dassavgca3ct4mggVW7OUui/2oNWM:+Ui1KqDM0B6Q5EEedcavX2mFW7OUui1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243485, "uuid": "ee05162c-362b-48a0-8b85-73fb51d4edb2", "value": 319252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243485, "uuid": "0a247466-e5b1-4607-87f8-f1a1f37ec3bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243485, "uuid": "1a86be3d-0e16-41a6-87cb-71b98adc61ab", "value": "40e11e5b80c5768a204b88046ab146b649b56b7af8fa57de691c16a1e112e50d.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c4072a-1d70-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773250373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250373, "uuid": "e2b0eb41-bfd4-4ea6-92dd-575eb04184be", "comment": "Malware payload (RemcosRAT)", "value": "957bdff0bd3f28392e3730fe58b2e4fb", "object_relation": "md5", "Tag": [ { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250373, "uuid": "988903c1-794c-48c1-9c65-f0ae7f1589a2", "comment": "Malware payload (RemcosRAT)", "value": "412953324b82b071252b3f583ac9fcb932f16ec50f12bf09c8a1e1b550a5e891", "object_relation": "sha256", "Tag": [ { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250373, "uuid": "a9bf29b1-dab6-4370-b625-968778bc1006", "comment": "Malware payload (RemcosRAT)", "value": "4a0bba68d86b46b4d23335931bb243cf5a9e4e65", "object_relation": "sha1", "Tag": [ { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250373, "uuid": "8f175290-2f6a-46d3-878f-a3d9dd086b4a", "comment": "Malware payload (RemcosRAT)", "value": "d555e4c8ec199c6d1249a79de5d5ff6a8ae0d769a0a55693bf9607ccb8082ac38001c2c02334b0545681d634bed63a98", "object_relation": "sha3-384", "Tag": [ { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250373, "uuid": "819f0689-7d64-491f-9f64-c27601c97aff", "value": "T16A315223505B823F2385793B966D39CFDC60811CC68C5B54E29D9BBE525A3EC917F18C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250373, "uuid": "d536434c-5654-4e4a-940a-4ff0c09e4a3c", "value": "24:UDp0Oi2JieQZ136Q1J0FRsjDbD04e5bXarzxugxa35P1Y2fDP1kmVeSHVwlY:Ul03aihD31ORCDX04e5rWJx6A2YY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773250373, "uuid": "ddd17041-6e6d-4873-aa5d-df4dd83dab40", "value": 1506, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773250373, "uuid": "1401f90e-87e6-49e2-a013-8e03a9d31e54", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250373, "uuid": "8c01c3a2-753d-4f39-94aa-9e7f7c58e311", "value": "malicious powershell.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34521d95-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249888, "uuid": "ecb9af17-c669-4d49-b62c-fd4bae212e6b", "comment": "Malware payload (WannaCry)", "value": "77c9bc1342fa2b84aa29583f08d6051d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249888, "uuid": "4f0f7abb-f28e-4458-bfb5-70781429337a", "comment": "Malware payload (WannaCry)", "value": "4278571b3070555e5b1658fdffaa35b7c4fc1f810b4088969933106a3bc6a0a5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249888, "uuid": "f1eb0535-9d04-4a42-95dc-14d470ce1c1d", "comment": "Malware payload (WannaCry)", "value": "11c49a6d650540640d9c7549eab4c7d83c513d2a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249888, "uuid": "87382b46-6180-4773-af2b-ed758c7cc157", "comment": "Malware payload (WannaCry)", "value": "3142129b8d05865992399e4c95661a97a924fded1570b841a1d23c3672e67efdf594fc9fcf9cd5eebe40858db3a2254f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249888, "uuid": "c982813d-2fc6-4ac5-aa82-6136084b8150", "value": "T13236024ADDB85B99D034C679ECBF4551A3BE78C81E554F0E878CE2342C422287BD1ADE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249888, "uuid": "3403c687-1111-4ca8-bd6c-c12c4a6c7d7b", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249888, "uuid": "ffe52475-9281-4296-a3b6-0706e4aac4b8", "value": "49152:znAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvxJM0H9q:TDqPoBhz1aRxcSUDk36SAEdhvxWa9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249888, "uuid": "cf2c27a0-aecc-4da0-a164-300c282b927f", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249888, "uuid": "eb5480f6-9623-41c4-9803-c8b277d5894f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249888, "uuid": "19be39f7-85b2-4eb1-a915-b3169c849df0", "value": "4278571b3070555e5b1658fdffaa35b7c4fc1f810b4088969933106a3bc6a0a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d507b6e-1d0b-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773207007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773207007, "uuid": "89045666-75e3-42dd-8035-60aacc841d3d", "comment": "Malware payload (GuLoader)", "value": "2a3745c1412f90d2bdeb21dee92abc04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773207007, "uuid": "ba59c021-ca69-4b74-9c1a-2841fc16388a", "comment": "Malware payload (GuLoader)", "value": "42a575352719a76034cd3b2309ffb99728f2be97698a83dfda3eec2b8495b1c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773207007, "uuid": "79067825-2faf-456d-ac8d-b65a41d996dc", "comment": "Malware payload (GuLoader)", "value": "f54d87c5c25994892a9a8571b87c961e60de6e9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773207007, "uuid": "d74fe760-298a-4f34-858b-b3e229831989", "comment": "Malware payload (GuLoader)", "value": "dd4467ba1a321949ab8396099173ea3ab949b3d9cc34c2eb33dbc2e84a1465f509974c8ce9d140b035ce85953d7d2dc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773207007, "uuid": "082bd6f4-5dc3-4798-9965-7849cec68834", "value": "T11A74DFD57684C496C8A622719C27AF6123BFFDAEB5B10E0B2217761FF873352650720B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773207007, "uuid": "884dfd9e-86c3-4c29-9f0b-efe6acd0eba0", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773207007, "uuid": "4e48e843-a9af-412d-8ab9-616a7cb6f6f0", "value": "6144:wRlWoXbJ7CjFlfhmK9cav2wNdnaN1JjV3ZM2M4bW+4NvaqbSATa:4R7CjffLr2wNdna1Jp3mWbnqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773207007, "uuid": "fc853526-bd53-44d9-8518-09f3c077003a", "value": 366044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773207007, "uuid": "66811a3f-c9f4-49e9-8422-ae765db68a99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773207007, "uuid": "d64393bd-0501-48bf-b2a6-2c922f71c797", "value": "z1NewOrderRFQ20X20PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2922b75c-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217657, "uuid": "72db7cee-2946-4e19-b51c-16f8dc2a6188", "comment": "Malware payload (Mirai)", "value": "ff66cf851936a00acad98c5767ab3d19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217657, "uuid": "582f6dcc-a3c7-43f0-8c8e-18b04e9aa6da", "comment": "Malware payload (Mirai)", "value": "42b0210e34ad04a70ad30f12effe8ef173c4d1408e6bef1bd5003481f4ee3662", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217657, "uuid": "fba97c1f-fe39-4521-8a94-6c4559a635d6", "comment": "Malware payload (Mirai)", "value": "88003a07f511759d42826819d0bd6ced76381407", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217657, "uuid": "f90bad89-5bcc-49d6-8ded-c1c6cbfc7f72", "comment": "Malware payload (Mirai)", "value": "7c90a5271137702cd5881e44afd2732c7ea8b1dd3be360940faa6e3810134836169f866bac66983bd010d39ce7bd6519", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217657, "uuid": "d59f3d57-4c6c-47a9-ae09-389ec30cd0c6", "value": "T194961962BF88DE5FD2A431368AB6C23873D53D0181A060369612F71D2FBE2B59D17DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217657, "uuid": "66dc7f89-e1d7-4af0-99f0-d39a9709ee62", "value": "98304:Gctr8sSjkEk2tTNGhzkrJ+bmqEPes6dsLFPoXlgQkkboP/1efkovt7UndsVqXA2y:l8hRo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217657, "uuid": "8441e9cf-e18a-4c42-a3c1-6ad46d6e0ba4", "value": 9175188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217657, "uuid": "7fd704cf-6874-46b3-b04b-c4cb572a1d1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217657, "uuid": "5e4201f9-be11-472e-8daf-453884650460", "value": "kintegrity0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5be7fd-1d2f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773222387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773222387, "uuid": "c5025bf6-77e9-4725-a68a-da50b3b3fbbd", "comment": "Malware payload", "value": "8778219f8913776f06b3d98cf88469cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773222387, "uuid": "62139b07-44f6-4479-9828-ebf907fe0ffb", "comment": "Malware payload", "value": "4341e88cc8798d44a25d75f7ba833f82567f4fb427a26a272448ee347eca2a0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773222387, "uuid": "e7f392f3-3d91-43f5-bbc0-c4cc360a452f", "comment": "Malware payload", "value": "b62360a57ef22150135e2a1a3e0c1e0c00bd3e65", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773222387, "uuid": "ec849440-fc26-4e14-a953-2bdf3f0aea76", "comment": "Malware payload", "value": "5596031f0efa38e00130274e435a0d3290c1d35720b41dda8b42ef22d7ff1802aa0cd681fc2c2371eaf4f94bd9fa512a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773222387, "uuid": "87946f44-f69a-44b5-981a-216a09d0a71e", "value": "T1CD34A65E6E228F7DF668C73487F74A31A76D33D623E1D684D1ACD1101E2424E681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773222387, "uuid": "4be90ed0-f3bd-4d9b-84ad-54cbfbf9c277", "value": "3072:ScnN0GE0z2VyBViN4/OH1hqqi3yEjf5cwFoXZoJsiBCAqY4mfNR0:SS9fayLj/E1oqiCcCpoBBQY4uw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773222387, "uuid": "3c5dece7-4539-46b4-a71a-95270bf1ce0e", "value": 237176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773222387, "uuid": "16d41057-6983-4144-84d6-d7e091b3e5b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773222387, "uuid": "9ea9de9a-bb94-4bb4-a68e-a9fb0628bcc6", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed553d5-1d6e-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249771, "uuid": "8c06fdd9-9bfd-401c-b0d6-d2163b224be8", "comment": "Malware payload (WannaCry)", "value": "42708471bba43fab8c0834de27a7a3a4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249771, "uuid": "d070ee0f-c3b2-4195-8286-cf7fd16525cb", "comment": "Malware payload (WannaCry)", "value": "46d23bc35d038fbeaf2c3e86a89c42319560e8a6a4a3fd3bd743d96f2b49f238", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249771, "uuid": "3e0e06c9-88a6-4534-8b07-11fd42ab75a7", "comment": "Malware payload (WannaCry)", "value": "9a87f4a8ce7bfb5e9dda353a0a308f228353bcfe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249771, "uuid": "1c7d2c3b-dfcd-412d-9703-613423af5222", "comment": "Malware payload (WannaCry)", "value": "f50c383590e73da1677ce7b249c1a7a0bbb5d055952b05a7cb448296553f30a0b2c006238256e576c4ad55c2dc0b9854", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249771, "uuid": "9b5a2205-6248-498a-9f38-0663a8382d27", "value": "T12D363394A12CA2BCF1440EF44463895BB7B73C6567BE5E1F8B8086670D43B6FAFD0A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249771, "uuid": "b0c7d28a-f6f9-49e0-838e-49316c5bb798", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249771, "uuid": "f72c60bc-6c28-4f94-b5c7-4152b3679143", "value": "98304:+DqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2:+DqPe1Cxcxk3ZAEUadzR8yc4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249771, "uuid": "72020edb-ef3a-4501-b624-3609eae18863", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249771, "uuid": "79fe6a1c-1424-4cc1-915c-7662af7c8cb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249771, "uuid": "898eb572-0a80-4b85-9752-3d4fa34c580e", "value": "46d23bc35d038fbeaf2c3e86a89c42319560e8a6a4a3fd3bd743d96f2b49f238", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "407f1c5d-1ceb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773193215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773193215, "uuid": "f725277b-902d-4141-bf8e-c0d1a40ec1c6", "comment": "Malware payload", "value": "8971cc9e5104a314744f194142b5c360", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773193215, "uuid": "7c4ffe17-db5a-4966-994d-f6c078265c46", "comment": "Malware payload", "value": "488a1fea5c08b49211537f88ea497cb9ab8c2011abecb35c70ec796e14ee3704", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773193215, "uuid": "fdb6b5b1-3d9b-403f-805d-e22f471f6247", "comment": "Malware payload", "value": "3786df0a568cd2e21ab625770b2620d7522f2920", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773193215, "uuid": "d4695d35-d12e-4ece-918d-2e4c32d01b5b", "comment": "Malware payload", "value": "f0cdca10b78e4de5d426891a21c18a6cd86a6e9e31082a2c838a19450508a7e6b548a30bf6c9acd623917abd203fb123", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773193215, "uuid": "573ea425-0294-4ff4-8052-c9620f753f55", "value": "T16A32567B21F08B32D7D410C963B61A614E72A70B496614B9F4FE5739AF2DA0370E7B21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773193215, "uuid": "d98173f7-c849-48d7-a042-d5898bb688a9", "value": "96:cCuolB6csht+O+v1fsn+h4+tIiKkC1ymysuKNpUj4waYvjKlWXaEXHArCAr8yspi:cCua6p4hvZ5mN9oKNpivAwRlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773193215, "uuid": "eafc6822-dc33-4d34-9530-9fd927af5a45", "value": 11969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773193215, "uuid": "29fc1701-c901-4f8e-abe6-e2ada6f0d441", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773193215, "uuid": "d023c381-0adc-44f8-a578-0ad024e09230", "value": "488a1fea5c08b49211537f88ea497cb9ab8c2011abecb35c70ec796e14ee3704.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d7e631-1d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773255475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255475, "uuid": "46e27b00-867e-4e56-a9dc-97a18c365260", "comment": "Malware payload (Mirai)", "value": "8c9399bba4666a96e9a093a11a154ac4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255475, "uuid": "3e41f21e-6452-494c-9838-6bbdff8d6cd3", "comment": "Malware payload (Mirai)", "value": "488a9c4cc84d01f7a891ed6757fcfc42c373e214e01efd7b33b7fd3caf31dce8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255475, "uuid": "e05fb141-ccd0-44cc-b00e-3f45c17fb5c8", "comment": "Malware payload (Mirai)", "value": "30a8f11948c8fad14e07ffc7e8fdcc5349ad7639", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255475, "uuid": "695b6c21-69bf-4731-88e2-2cd44b3c51ea", "comment": "Malware payload (Mirai)", "value": "49e7414596243fd7d5c82eab3f1c6812460cd3ac4144bd4aad8a46ad1557cfd008052fe0c6fb4a78014b43e3cff70b0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255475, "uuid": "55ead409-1a2a-4948-841f-65f100c45127", "value": "T11F734B13F9569EE6C0834BB816E38EB41F63F4894B132E776658A9F404439DCBC19BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255475, "uuid": "fff1f609-f28c-4356-a101-698750007968", "value": "1536:OaSMSH9dHLOfew3qDnbRPSrgCQk6LkEGj9wu:OMSH9weZnRPSrgGYkENu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773255475, "uuid": "4bb57172-312f-481f-900f-f7dac4f957b9", "value": 74448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773255475, "uuid": "1c16c548-b1fb-4fbf-9c87-148afe77c647", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255475, "uuid": "09b16a22-bdc9-4fd2-8f49-8c37342daed2", "value": "xdlol.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fac04cda-1d26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773218867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218867, "uuid": "231dda9d-4988-4322-a121-bbc31749ca86", "comment": "Malware payload", "value": "63ed913f7fd87b944c943e6d45a4b02f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218867, "uuid": "ae04d8ce-90e4-4665-8bbd-54fc69e4d0c2", "comment": "Malware payload", "value": "48f48dca5997c445389a83af202095ea12807e393c659a1a87031de38ef515e5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218867, "uuid": "2e80a011-3dce-464a-8656-2423d7671758", "comment": "Malware payload", "value": "f39139fcf3eae66ae182de5418a3c462af22d447", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218867, "uuid": "c6a7d165-d1be-4c4c-a313-6b5ac0d0eed0", "comment": "Malware payload", "value": "a3961b69ee5bb9e59a3c024d8824359124f2cd35a7e45ea946ebb08fa9b7905870db4e4a9652f8452857cc5e1fac3782", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218867, "uuid": "eeec7258-a594-447d-862c-00122272eca1", "value": "T1EC925DB512896C79FBD0CE39AF3C7F4DADE8C2C42124A3ACBA4F39205A1166DC705349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218867, "uuid": "dcb523f9-c4d7-4263-b89b-4bdc2780b2f4", "value": "384:3FcuQpWx+BL0SWL0gMzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:3F8i+BL0SI0rzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773218867, "uuid": "49ad4f53-12cd-4d1b-b9ab-0e53f82ab487", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773218867, "uuid": "2af1b806-edac-4a6a-bec9-47cb4d40a703", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218867, "uuid": "1c05eb46-8fc8-458d-9a9a-c3c26cdf9deb", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243c28cf-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217648, "uuid": "9c805855-8fa8-4d7a-9fdb-0498d59c20b5", "comment": "Malware payload", "value": "ac2e17779955fc70a06fa2c72d65997a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217648, "uuid": "3ad6e340-6951-4599-aae1-088ece196e63", "comment": "Malware payload", "value": "4985e9dccef7d6b6cebc3279ea3c147d9847cb42d7d4ff8c7cb363a498e5813e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217648, "uuid": "4dc196c6-2fd7-4fe8-80cd-1d1ecffb595b", "comment": "Malware payload", "value": "15260d6dc220eaa6e3da296a908bff18df71faf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217648, "uuid": "cafb37f4-9da1-4c44-8f37-e7e6c68c64cf", "comment": "Malware payload", "value": "f14656dacbb6634bea4870f52f7985db59ff972c5baebaf93e998fdbe9055412d3997a699dfb7a1bb7b70a7310e76772", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217648, "uuid": "42e1d0e9-8114-4868-90ff-db9ce6e3b161", "value": "T192B53344B53020FCD936D7B4E3334B5ACCD3A3C647583A9B9D648BF6AA72D78216A10D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217648, "uuid": "4274d959-9e4b-4424-9f4f-1c3ff77e5338", "value": "49152:5KkzvgvOlnINDslEA81C1t9RqWTbA0VjEJWDgGq5fqfvFMTR/ZbK/0O8xPa:5jMvfNDs1nRLHA0RiEq5fSvGTR/Z2p7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217648, "uuid": "8a7eb591-a650-4cdb-9c7a-06eee466e351", "value": 2434940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217648, "uuid": "ca1d3085-e4d9-4cec-a3b4-7056d4b51c74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217648, "uuid": "cd8f811a-e5b1-415b-a20e-fbd4d001ec4e", "value": "ethd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb2a88fa-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773217150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217150, "uuid": "008a0441-79a2-4077-bc99-d8d8fcdd9d53", "comment": "Malware payload (AgentTesla)", "value": "eb8988ade8d349762d7f31fe3c8579f4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217150, "uuid": "b0bfe7d5-5e7a-4d99-9d42-325441bb8015", "comment": "Malware payload (AgentTesla)", "value": "49aae628e6b3abdf6928ed3fa2609a64e6a0442fa399846ae87026a9ff21e94c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217150, "uuid": "03e26f0f-37cb-4f87-936e-7695b99477e8", "comment": "Malware payload (AgentTesla)", "value": "581fdc48430ed2b925f99d53c83aed4708c98427", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217150, "uuid": "11b2ec1f-421b-48e7-a0a5-49b874408985", "comment": "Malware payload (AgentTesla)", "value": "9a8465958188a1a0a4108230d6670f7ba730d83b3fc525cf8d45f7e59dab632ea657d364ae021963b251e9a81d80da10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217150, "uuid": "00eb6fb0-50b5-43a7-b0b6-ad02595f95e8", "value": "T123558D95A6CA6EA54FC0007B91FB44290AB4174C986DFB48F0A7FD31D7BA740F09B69C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217150, "uuid": "2f3d7f79-b554-4f94-a637-82b4e5b2a1d0", "value": "12288:2gtRk5b33Dhc/IoMB11QqEq52sJ39pMz90Q1b8pJZ95urUptsK7XuBoPtFIJ2Zh8:2gnk93XJRLJRQeZTurEwoRwOQIJiDrr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217150, "uuid": "be8cf7a7-a7d8-4e88-891f-d7d85e36c2b1", "value": 1320207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217150, "uuid": "dbd9d102-b7fd-4975-b3c1-362cbde24ea6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217150, "uuid": "01b6c3a3-6a34-4de4-bfb1-8576fbb94059", "value": "eb8988ade8d349762d7f31fe3c8579f4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded25d1d-1d6e-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249744, "uuid": "4a755918-c5f7-4e54-89ed-71f337b5596c", "comment": "Malware payload (WannaCry)", "value": "48733441a9b5b95e2387f087d3383898", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249744, "uuid": "5e4536b0-8c7d-47a6-9b47-ef84412bac55", "comment": "Malware payload (WannaCry)", "value": "49d2100d976cc153017361234969b81fa24b0e91c94d9bdef052a3c9c8f2ab65", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249744, "uuid": "e3d7e05d-4cd2-466c-94d0-0989c22bde56", "comment": "Malware payload (WannaCry)", "value": "266aa0ddc286a2482bf973d6bf3112b3ff10f29a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249744, "uuid": "fbbc36da-ef3e-494c-b580-78ce222cf6bf", "comment": "Malware payload (WannaCry)", "value": "d74f1701a3fb729770708292e5c35f02fa31c27929be7d626e554754f0f19965267f8129d90d80923ab604e70e764f00", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249744, "uuid": "3de00b11-0129-48ec-9db0-4c5282ea68ba", "value": "T19C360153905640BCD10D987090EE4B91E9772EA5396DB48AAF43FA1E3BF36D3F582903", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249744, "uuid": "4d0a563e-ee16-47bb-8b7f-13981b043f24", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249744, "uuid": "3e509bcb-d1e9-42f0-aef2-7d3f1e4b8aad", "value": "49152:RnGMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdh:1GPoBhz1aRxcSUDk36SAEdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249744, "uuid": "ceae9406-9a5b-4b83-a88c-e9fe281382c7", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249744, "uuid": "399cb771-e5d9-43d1-a2c7-394269039e12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249744, "uuid": "7548072a-71d8-4370-b91b-cf92dee66cb0", "value": "49d2100d976cc153017361234969b81fa24b0e91c94d9bdef052a3c9c8f2ab65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2beb05-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217660, "uuid": "15f139aa-dacb-4e92-b9a6-67a6efb48bf7", "comment": "Malware payload (Mirai)", "value": "0b5d13bd235602f3428516ba43293936", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217660, "uuid": "edb89237-2ef4-4b61-afd7-7d499c585f2f", "comment": "Malware payload (Mirai)", "value": "49fb7645dc0d583560b65c06ec07f7e1fe0982cee4c8e8186bcbdfbaffc09ede", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217660, "uuid": "0b8226a9-0df9-49df-b526-9de45fc0e295", "comment": "Malware payload (Mirai)", "value": "c679aca25b0075db0b637adfc8ccf3754bb5494a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217660, "uuid": "313aff81-b748-45a2-b898-524ffe467dc5", "comment": "Malware payload (Mirai)", "value": "be560f340659214f726d15bf15c195eceba4a5cf18f1d56bd85b3da46dec056c46f88fbd3f9e02c4a70f06eab4ac1980", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217660, "uuid": "9a1badac-371d-4f89-ba17-599080b9b34c", "value": "T1CC9533142A718E66E39C05BBEA34CA983CD252D90871AF8F84D5FC9C3549DC3764FE52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217660, "uuid": "50d6b4e2-7db0-4068-bc49-470afc262c3a", "value": "49152:4hV277Jo7D5gQKQ2fNPDm6LLMvfHb4an9pOcouVlxhlhLtN1S:A87J1QKrPDm6vcfHb79VHhldZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217660, "uuid": "eaefb5c2-66ce-4af7-82e1-9640c8836f79", "value": 2047100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217660, "uuid": "328a90d6-4ad7-47c4-8ce8-132810ec2de9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217660, "uuid": "8fdfa3fd-f4ed-47ac-a17e-dc4908fc675c", "value": "kpsmoused0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da02222f-1d19-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1773213229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213229, "uuid": "49ac0e51-c1dd-4a2f-8f54-afee6a8be90a", "comment": "Malware payload (SalatStealer)", "value": "1993976e4022846c1d560bd349859d38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213229, "uuid": "fabaebf5-6dda-4b85-8f8b-32121d58467b", "comment": "Malware payload (SalatStealer)", "value": "4b91b0281194181d282d3cbbf322a654bb99b88f6361e7c5b18762fa0dcbbfad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213229, "uuid": "2c55ee84-488d-4318-8c52-ca6a1654cbe8", "comment": "Malware payload (SalatStealer)", "value": "5f4fb3664c3ed16b6ff2614867513128b48d980b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213229, "uuid": "8f8add03-2714-41a1-8fe8-2efb8e1689b9", "comment": "Malware payload (SalatStealer)", "value": "2c881681ad2b476f566273a15b440ab2cbdd63ef796131e466bf7757afca39b2ec6ee8e74a7fa7a6451c0aef48a1bfc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213229, "uuid": "8ee8ba4e-26ba-4211-8c4b-349c143e6947", "value": "T1E8E533C7E0EDE94BD4AC66768B0BD586841B1DD19FDC020FC64F9F29D0A2369B08E719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213229, "uuid": "5fc5d5a5-3cc0-4446-8619-a03ee9b4afe7", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213229, "uuid": "adc0e812-ca56-4e29-b98e-0f172b438b64", "value": "49152:n4iwX5iSvxDWdz2iFu7ian+9Qsxea1b91rowCyUo4c/nl98UFwTDqUfHatET4:n4ig5t5adKiFu7iaAT1UwRU/8DwnH63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773213229, "uuid": "80170233-9345-4194-9e83-cd9a42e1b3d8", "value": 3249664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773213229, "uuid": "328c48e3-afac-420b-a05b-51f384fe0915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213229, "uuid": "ad87bf5e-d520-4063-ae88-f12603e77691", "value": "1993976e4022846c1d560bd349859d38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d5e4f2-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773216978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216978, "uuid": "b6beb239-5516-45be-8af2-bb22d1d0b13c", "comment": "Malware payload (AgentTesla)", "value": "c0ddbf9b8a6ca15b2ded2b71fa562340", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216978, "uuid": "9ab265b9-9279-4a99-a4a5-044326aa2a7e", "comment": "Malware payload (AgentTesla)", "value": "4bd4c1eeb5ba86ada2b1afad4a6445edae69717bda5690ab967c4d3c4431649c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216978, "uuid": "9b8b825a-e513-484a-9f9a-ec7119a6faf2", "comment": "Malware payload (AgentTesla)", "value": "c1832816f11a513bf1806477a6917603dbf09881", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216978, "uuid": "7a4bb548-3b3e-429b-ae4f-76e52293c98b", "comment": "Malware payload (AgentTesla)", "value": "fb98beb4ceb78c21775df0309499c5f11cae353bca52ee763302399855c8d8bec2ef912a2c7f2d0895779690c1f55b02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216978, "uuid": "1bfe1d4a-789b-4a8d-9b68-ad4b4355c39e", "value": "T13FD56C4AD580AF39DFCC2B3B8475B70D42B6D8873076798ABF9A720E2D62704861D71D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216978, "uuid": "99d152ef-49f0-486a-947a-3c42cc9a8b97", "value": "24576:eWUPuXxIHeIbDsSaU2d+vg7x4o3CeJpNWUPuXxIHeIbDsSaU2d+vg7x4o3CeJpi:8jeZTjeZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216978, "uuid": "1389a5e0-70ff-421c-9458-02ff273e99bb", "value": 2754330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216978, "uuid": "35f31151-0066-4d25-a493-473145f4be98", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216978, "uuid": "9cf563f3-c354-40da-b27b-747d7ffad673", "value": "c0ddbf9b8a6ca15b2ded2b71fa562340.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d249625-1d21-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773216348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216348, "uuid": "9257b96b-3dd3-4524-ad0a-8007db28f95f", "comment": "Malware payload (PhantomStealer)", "value": "d48091fb3cb9a3516e313b5d55723e7d", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216348, "uuid": "e6845c44-fec7-4f0f-93a5-44a143983d4a", "comment": "Malware payload (PhantomStealer)", "value": "4bdb2ccb7b90c7d871048219c4ab8e65bd60ca835e6b86a595e5e62a703b30d1", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216348, "uuid": "62387893-b86c-4353-ad6c-4565a05c2460", "comment": "Malware payload (PhantomStealer)", "value": "84e6b10d0946ba3f1aecb9056e89c80242bf5a21", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216348, "uuid": "0e0a5ac9-70c5-405c-ad96-d2f086b99603", "comment": "Malware payload (PhantomStealer)", "value": "df783c2b1aa7502ca42dd38b7ba57d8a90f11eb089cbb88e9e1d87e5d881844eb0b5479618d87a24aa19ce3c8c9e1a8a", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216348, "uuid": "f4e2dab5-7802-4905-a3d5-da809f98111a", "value": "T10D26BF883EDA27E811F99C26426F776BA780DAFD221B7D5586563B1407E34C43E1BEC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216348, "uuid": "ce24fc12-7d3c-45b6-9062-a5b270ddc660", "value": "49152:Vjs3uvIxSKrl98AOIthejuzs7vj614ZVAgZezVO8xHwQrPoiRAI9o:D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216348, "uuid": "56ca58a5-8ce5-4a1c-bb7c-00e6bdc4dcff", "value": 4656006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216348, "uuid": "93630120-b22b-45e5-b87b-420cd3e8778e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216348, "uuid": "c8cd5ddf-cd1d-453e-a521-18c9cb45b1f9", "value": "d48091fb3cb9a3516e313b5d55723e7d.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab696e2-1d61-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773243912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243912, "uuid": "48dafed1-4be5-4a34-b520-22b658f2850f", "comment": "Malware payload (AgentTesla)", "value": "d843f0565c7c73b9dcd248c0615a14d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243912, "uuid": "309f1363-b488-42e8-8848-f87554470451", "comment": "Malware payload (AgentTesla)", "value": "4cda8a3c27a0482c3147504e066b6d6adee0ad3a4e7d28ab714d16348554673f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243912, "uuid": "d276afa8-ea16-4f82-8998-8b72e0c8fa8e", "comment": "Malware payload (AgentTesla)", "value": "77dfc85c37bc7e987c45556dba03b0be40860da9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243912, "uuid": "b42281fb-5848-4bed-854c-789631a0072d", "comment": "Malware payload (AgentTesla)", "value": "055fb23cb3deaa93889366e77a91de735e55ce9c590940ab87b0417dbedb1a0dbdc302512cf430de33c36606b6d82bcb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243912, "uuid": "2d432da4-9773-411c-8a04-6d796d8d337e", "value": "T1F3554C08CA85AFFFF11C1D6E431E6B5BB3F11F9AAEB270C82B85DC96412D80605653D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243912, "uuid": "7441902f-7372-46ac-b5d0-52e6796471d9", "value": "24576:oYSu2agooGHzqCDt0AVJLjl5b/StpmcSvbk+dvGRqu3eWgraduOXc3DeyTr6LRQX:oXn5GHms0AVJL3b/StpmcSTk+dvGk4eR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243912, "uuid": "94ecd2ac-e295-4dd2-9a16-94b5837bb3b2", "value": 1348440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243912, "uuid": "98edd55e-5cbc-469e-8a61-54b7f6593e34", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243912, "uuid": "9587c3e8-47f1-473f-9f98-4ab90b3e95b3", "value": "d843f0565c7c73b9dcd248c0615a14d3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28118aee-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249867, "uuid": "e7f0360e-210c-45b8-bcaa-46f9f0e358b3", "comment": "Malware payload (WannaCry)", "value": "4cd836335c1df6a87c1817dfd3f560e8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249867, "uuid": "47f3e9fb-bf7c-41c5-a5a9-1fa3a5152056", "comment": "Malware payload (WannaCry)", "value": "4e6a43d9af957cd66715c0080c4dc51d965380004593769efb954263321e28ff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249867, "uuid": "3728bf8b-ce06-4193-93df-51b80c625702", "comment": "Malware payload (WannaCry)", "value": "72e535ed71b294bb3bc0ebc41c6c30d910cb2ba0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249867, "uuid": "ef3d7567-7872-425b-8b31-a6a0de793f97", "comment": "Malware payload (WannaCry)", "value": "022b96083799bda23c39d555daa245f65ae2f1116b642a7bc0d18b0f57367ae93168d3a7d025764b8be7c793606e9c92", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249867, "uuid": "32dc6c04-d3f8-4396-ac96-f67be55af5b9", "value": "T18F363801D1E51AA0DAF25FF6266BDB10533A6E45C95BA66E1221A00F0C77F0CDDE6F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249867, "uuid": "0bfd24cd-2c96-4450-bff0-f4cb033c626b", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249867, "uuid": "9aaa0e59-285f-4576-8e29-ab92ffa620de", "value": "49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAA:+DqPoBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249867, "uuid": "57d446f0-b817-44e3-a7e1-d25ab148f9ea", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249867, "uuid": "73120328-67a9-4ff3-9b68-cbeeee110b55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249867, "uuid": "3d8bf7af-94cd-4848-a585-444c9d3577e1", "value": "4e6a43d9af957cd66715c0080c4dc51d965380004593769efb954263321e28ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c321a726-1cf3-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773196870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773196870, "uuid": "be24bdf7-4a0b-47e5-8a5e-edc9cbfe7f1a", "comment": "Malware payload (CountLoader)", "value": "b7c60df36a56cfb703982b667bb2d98b", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773196870, "uuid": "b9503328-0228-408e-8bb4-345ee4ab7171", "comment": "Malware payload (CountLoader)", "value": "4f21bd260143a5d3da5609ff733a5e9ba5c4f5a92838aa2fcf15da67294f6d48", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773196870, "uuid": "0bf77530-e362-405e-810a-d469ca910ff5", "comment": "Malware payload (CountLoader)", "value": "f5e109bbd7f32dfc9bf936d86c67bb774c0ccce0", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773196870, "uuid": "8139511e-7d9e-4f1a-a6cb-ec6f6182d340", "comment": "Malware payload (CountLoader)", "value": "948e198caa33b7dffd5cea01dbeec7e17a22d30776bd1b32bd8be84d94535a10cdae80ebf81c171b2a635bafc347e7db", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773196870, "uuid": "22591093-0b5f-4209-baf7-90e0a9272913", "value": "T120B3FD9D1ADE806CC21AFC388ADFCE57B785E51F260CC9673B0ED1641FEB42851A95E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773196870, "uuid": "e1c959b2-bb2f-4f49-a4b9-6d2a3ea96c4f", "value": "768:3Gf248860x1E3hT0Cqoz5Q4o9QdU3vQduTaoib60+U3pO81LgZ/PMkS4vTWY3gk7:6UtQ9vNlib6pU3kekhSY3xbF8E2yD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773196870, "uuid": "fe321e4d-34da-4a88-9e61-ce5c13e61f8e", "value": 111758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773196870, "uuid": "7efe3c31-7a5f-410c-a1b3-3a9b7db2363a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773196870, "uuid": "4d0846c6-b56f-40b7-9126-5670550a9ebb", "value": "Report_Draft_v5.3.wav", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141e7d49-1d21-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773216333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216333, "uuid": "f62c0f6c-a499-4634-87d3-0aa899ed428f", "comment": "Malware payload (XWorm)", "value": "f65ee41ec61ab184d5560de44b1098c9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216333, "uuid": "000f7046-c367-414f-8f37-ee5e73a17f27", "comment": "Malware payload (XWorm)", "value": "4f5d1c5ad71e3be6754c31542735633c0be9224feae128e2bb4cec533e85c33e", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216333, "uuid": "edeb8fb5-e567-4c6d-9d59-776c75919062", "comment": "Malware payload (XWorm)", "value": "b2176870e233bf3a03f91622cbeb90e86f4598af", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216333, "uuid": "ed8667f2-6ba3-4565-8ce4-59522fbfc5e3", "comment": "Malware payload (XWorm)", "value": "9d56759c896da0b960ef067c636c600092d622ee9ef4207478ad390382ee1f0c489a85d7ebff5a9ed34a4d00a8be26bd", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216333, "uuid": "cc253541-21f7-4381-8a64-6ffa3191ffc7", "value": "T1554519B73C63633CA4CA2C8B240599D93619986E1F057B39903CBAC5DB576DBD20BB31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216333, "uuid": "617db112-5a7e-4a80-b8a9-9593f7f87b2e", "value": "96:CFFIbLk2rk2Axno/yBXN9WXttcFc+iZJNAAKNDcFU+aHSJFs4DccXaFshAr8inau:hh3K5qBYDF0/pTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216333, "uuid": "2450f294-af37-408d-a029-1015dbe0b77c", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216333, "uuid": "af614375-bbf8-4833-b438-461d99664369", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216333, "uuid": "94017e8c-11f7-4ae2-a599-17dddfc52495", "value": "f65ee41ec61ab184d5560de44b1098c9.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da191a3b-1d6e-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249736, "uuid": "84a9b8b9-5ab0-4597-b876-ccfbd452c32c", "comment": "Malware payload (WannaCry)", "value": "951b218fab52434aa7d4624c03dd3415", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249736, "uuid": "4005341d-087d-455a-83b9-2456ad94a126", "comment": "Malware payload (WannaCry)", "value": "4fc50923587e70fb3ce84ad1863eda0950fe63761758b1a1c071a73a5817cf00", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249736, "uuid": "5ccaf653-4f4d-4942-8e43-b447772b47d9", "comment": "Malware payload (WannaCry)", "value": "943fc42d4a118b77f032f7d9b767d64731273cbf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249736, "uuid": "dca0ce27-b533-42fc-9a58-42273921eae9", "comment": "Malware payload (WannaCry)", "value": "e47d5631b71c3f15e7715ca68d755a1ae13aae0bd9391cc02068860b3f8e852435a9e3701c5516c8305e10a68930f4f8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249736, "uuid": "9722f2bb-0330-40f5-9c3b-e255d86a8e2d", "value": "T1E036339971BC91FCD20529B484BBCA23B2B23C6D26FE6E0B9B4049751D43F56F790B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249736, "uuid": "5b91a5c6-b545-46a8-b625-5562a1c09032", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249736, "uuid": "90ba13d8-3337-40a5-a467-60f9f262150f", "value": "49152:MnnMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:snPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249736, "uuid": "b5992cc9-5d1f-45d6-ad1f-767586abdeb8", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249736, "uuid": "8fe33253-e8ed-4265-952d-7c397a9e5483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249736, "uuid": "a05cc6c9-833e-43af-b5bb-1fa7dc080699", "value": "4fc50923587e70fb3ce84ad1863eda0950fe63761758b1a1c071a73a5817cf00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b855b84-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217795, "uuid": "ca6fd6cc-8ccf-4f04-8536-4d63bd0e23bb", "comment": "Malware payload (Mirai)", "value": "c4dbe83b27a728a449de74d1c4660e61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217795, "uuid": "50138b5d-28ef-440a-b6ab-0764bf5378a2", "comment": "Malware payload (Mirai)", "value": "4fe09a891209ea19498735084ea5756e5f488752da9c743a92ea99ffeb8ffada", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217795, "uuid": "cde38317-f1f2-475d-a22b-079f81500da1", "comment": "Malware payload (Mirai)", "value": "f21c80ba197e0a52bb35795a8b03f48e61584841", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217795, "uuid": "35b3730d-de76-447a-8ce4-184211acf0db", "comment": "Malware payload (Mirai)", "value": "eb4ad6c36a681108b0cd5dbdeca8d90de3e20fe5b72b0124336817e275135c46be3c879cf4c3b2f73610bce52036d648", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217795, "uuid": "50973c99-8915-4bd6-a2c0-52c762d093c1", "value": "T1AD962A177A1CEB0FC668613419B1EE98272A1C4645DB9517B391F309F9F20BC8A6EDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217795, "uuid": "6a62a7e0-7a0d-453e-aa01-764671c78127", "value": "49152:YZNDouzT17R4jPSUwnwkAbu3XAaOzmOUxYuXPj5yBFzC4q+See7oWKPYy1OyrIe/:YD17Rt3MUlFJuseeNRfjEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217795, "uuid": "67e56623-277e-4279-8784-002b502e0cc1", "value": 9044147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217795, "uuid": "49fffd32-b91b-4ff4-832f-83d4c0442814", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217795, "uuid": "1c079827-c950-4276-ae45-e6acaac21d39", "value": "deferwqd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1747f145-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249839, "uuid": "c87140c0-6919-4dc4-ac75-ae917027c3b0", "comment": "Malware payload (WannaCry)", "value": "afd19704da3a1a6f7f0c33382f9a509f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249839, "uuid": "8509ba37-a143-4f46-a70d-e045306860af", "comment": "Malware payload (WannaCry)", "value": "50ce0da097a06effa7dd81eb300da814353d81ec26443b376fef3286d0a91d55", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249839, "uuid": "fe459330-98e3-4c5a-b847-ec8fb1e78952", "comment": "Malware payload (WannaCry)", "value": "b4c5ff73a4cc6337aa15825fa1a47565a969530c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249839, "uuid": "4c9ecd29-dae5-4647-826d-f4d0881c97a0", "comment": "Malware payload (WannaCry)", "value": "238c5a2d3b7da6acf8975beb82282a242be1f3efd0d499f2617781e0838fb128c6d53b71836175ab668a53c460f4e03a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249839, "uuid": "bb1b8b02-e9a5-4f54-b3ce-cb243eb6ca52", "value": "T17636AE15A6E82B64E7F36EB2217B871007797E45885B925E1760A04F0C33F5CDEB2F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249839, "uuid": "2e9fec10-6ada-4993-976d-0d476a900d2b", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249839, "uuid": "8358f788-9424-4a3f-844c-16be555dc9dc", "value": "12288:T1bLgmluCti624baIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUjXz:RbLguri3dmMSirYbcMNgef0QeQ6+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249839, "uuid": "4b24ced4-4b9d-49aa-af93-7be6e3beb2c7", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249839, "uuid": "a20d3663-19e8-47c6-9d60-95fb696acbc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249839, "uuid": "4ed06650-117c-49aa-aac5-541e55156184", "value": "50ce0da097a06effa7dd81eb300da814353d81ec26443b376fef3286d0a91d55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794f7f31-1d23-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773217362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217362, "uuid": "35e03a12-58de-4066-a19b-3a7ebe6ecfcc", "comment": "Malware payload (Formbook)", "value": "1a9131f7221aca5c7a1b65a28712c24c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217362, "uuid": "aacc20ef-b72f-463d-9907-55d8af5dd598", "comment": "Malware payload (Formbook)", "value": "528eeaa729b13527924b13dc4dfd8264c93535ae8401d8d812c8a5f329dce2ce", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217362, "uuid": "3d65c695-da96-41d2-af4d-6060d8f938fd", "comment": "Malware payload (Formbook)", "value": "f451b9933f253465c08198dabf137c5d71ad2a5c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217362, "uuid": "22efb0bf-3402-485d-b4b0-c6525d80f5fb", "comment": "Malware payload (Formbook)", "value": "aa15d36cfd2008cc13e91649f5d5bd73c231cbdf17c4ea9aa04141a6c51a56130efdaee20e973930649f5bcf56c6a4d0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217362, "uuid": "26c16a28-97b0-496b-b445-563b43364f37", "value": "T1325308580F1E3A8C6D042916E3DFFFDC871B896232DD168F49718DCEB1D6AB1C91A429", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217362, "uuid": "c666e9b7-ea30-4f24-bc35-bdb7cd32d84e", "value": "192:DK7IA6yz8JsdA01pMAQCf4IsVnA6HlTAbfkcrJfeerIbuyhXP+wlRzr0j70RNJEw:DKDxzqw/ssTgGJEqUzy5PZPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217362, "uuid": "68189154-14f3-4306-aaf2-8b9ee8ce7894", "value": 60962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217362, "uuid": "0f041b79-cc30-4197-acf2-a75565e05755", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217362, "uuid": "48e6736c-0600-434d-ad25-fab2359b5154", "value": "1a9131f7221aca5c7a1b65a28712c24c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a0e1434-1ce6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773191190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191190, "uuid": "e67d821f-0d83-4c16-9446-2597fbdc65c0", "comment": "Malware payload (Mirai)", "value": "1bd1eb17f144729896e807affc3384b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191190, "uuid": "c3164889-a2d6-4b45-85dd-db316ebff6cc", "comment": "Malware payload (Mirai)", "value": "538b798e82d1fea1a0d81cf15ffd31c5d6e08324caf4f3b1526d090f3bd4e46c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191190, "uuid": "9effedbd-3c76-40cb-835a-28eac7a14bf4", "comment": "Malware payload (Mirai)", "value": "a1e256ffe1f37f2a1b58c3b5409de6af6b7a5732", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191190, "uuid": "d4b73699-2040-40d5-b11d-72858a7f1b3f", "comment": "Malware payload (Mirai)", "value": "954c467d698f1cfbec8f63574dcadc1b18507ceda036f2a590a9247f9c6f63068d70480bf63811f0d1dc6a41a3a7302f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191190, "uuid": "715ca0bd-6d1c-4cc6-9a82-debc60772e0b", "value": "T187F2E16459079D62DBFA4A3BEE38434943EE2B7CC0E4F0A52F14F6784081696F1B8767", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191190, "uuid": "93ae84d4-4683-4021-a0e7-64f8c7805409", "value": "768:NEWanU+dRP2QDd4TWAQeAfDDiDoXllVRqmYE7Or8Pgg3bCkJ0jCSHZMs3UozI:NEWaUSR9DKFQe09o3Yxdo3JzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773191190, "uuid": "c5c4f645-1117-4708-92a1-effc32ee9a61", "value": 37456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773191190, "uuid": "f4ed3c9c-cd9f-4d42-a687-641add7428f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191190, "uuid": "17703993-2320-4682-a979-760bfc2e6826", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4731b64-1d25-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773218374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218374, "uuid": "7197a19d-5b5b-4825-b668-19073b1b7d19", "comment": "Malware payload (ValleyRAT)", "value": "65c2906d5afc04e4685eb41a84cb5205", "object_relation": "md5", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218374, "uuid": "9813f8ad-1af6-43d9-a6d3-2de2437852f7", "comment": "Malware payload (ValleyRAT)", "value": "53bd1add0d364ef57993eaad0a84adefac9bb44d5047e17018468a069420913e", "object_relation": "sha256", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218374, "uuid": "523ddcd0-7971-4bbc-8811-24d5fd37ab75", "comment": "Malware payload (ValleyRAT)", "value": "51a0832fc378d08566427bf0510e1d7f922a8ae3", "object_relation": "sha1", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218374, "uuid": "2ad5d097-e742-4b58-9db5-516ec9752f1b", "comment": "Malware payload (ValleyRAT)", "value": "3305e51f71e541b1a90fd736aa384fafe6af65eca4db125320b5e92d64000ed348a7744cbfeccac1b3e88a458b4361b1", "object_relation": "sha3-384", "Tag": [ { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218374, "uuid": "ad32bfab-6529-4d19-9932-3326c2503ae0", "value": "T1F9C5338F8134ABAECE7CAFF242916FE392A25D07C154E3E6375D35920E05B421B182D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218374, "uuid": "a4b3ee5d-9c21-4f4f-8727-1d53e67f2030", "value": "49152:Wd0CQrI3LGNw5ZrxoAKAlnnJOlzaAzq68QnMonqBm6JNppxTTl:8JGOpKoOl46rMVBjFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773218374, "uuid": "7c8da402-f304-4a26-a0ca-44739f2afe04", "value": 2700798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773218374, "uuid": "22fee5c9-7884-4f42-9331-dab03198adb0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218374, "uuid": "4f49c121-bcee-4354-a99d-88ca6d87b9fc", "value": "231_20260311.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ffd14fb-1d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773255598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255598, "uuid": "2d1e0b53-57fe-4d0b-9f82-d5899e2d72ad", "comment": "Malware payload (Mirai)", "value": "bee775de58f43f772319da25691e4702", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255598, "uuid": "b54fa5f5-d70e-4fdc-ae9b-fb004c255a86", "comment": "Malware payload (Mirai)", "value": "53d961fa9db058797aad46e72508abcacd950b09a65390acd373991a690a1fa0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255598, "uuid": "b87359fd-5871-4a35-a01b-b0b79e3b6a24", "comment": "Malware payload (Mirai)", "value": "5fceec5ed7ed376603a05d0764847d0d320a2f38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255598, "uuid": "e7df470c-5cf3-4315-8bea-ea266e018b46", "comment": "Malware payload (Mirai)", "value": "ab2e90d677a5ed4aa972331ec0fc8641353f6da021d91dc040ebf914415e444e0cea5b8a9d70f22b705ed3f2458a8897", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255598, "uuid": "c0324651-c0f8-4430-ac1c-b0818a8fcc4a", "value": "T15D834C317A762F27C4D6E5B511F7473077F1AA8E1EA6C10ABD312E9DBF116802806BB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255598, "uuid": "05a115a4-3b2c-4b13-976a-1676a7182a34", "value": "1536:wkrfIoQZLgR/1yBO9N5/TC7G5s5tXNvQdoE96Z/1Ggvr:BrPiG5EtdSoakr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773255598, "uuid": "24b3e6de-89ca-4997-9818-c96155baa7b9", "value": 82657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773255598, "uuid": "2ac30b44-08f4-4ff6-8d6f-dd0a0eadc7d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255598, "uuid": "97c6fd28-42e5-4b34-b18d-10904fbebc0c", "value": "xdlol.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ca4388-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773217092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217092, "uuid": "f86eb1b3-5555-4329-bd08-41b1cfbfbbe8", "comment": "Malware payload (PhantomStealer)", "value": "e1c68fb6779fe41634c81d6100197814", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217092, "uuid": "45b4dda0-08ed-42a5-a65f-acd269717b65", "comment": "Malware payload (PhantomStealer)", "value": "543ae7470109ecec9d58062c1101dccd3ab8f378878d93be0361d1f56864bb2f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217092, "uuid": "eeb3c215-58ba-4c84-9b68-920f07fd269d", "comment": "Malware payload (PhantomStealer)", "value": "9427138f9df99091ab7635118b2686c56d354965", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217092, "uuid": "c33bd054-a57b-4714-9bca-55c6d3a3c8ab", "comment": "Malware payload (PhantomStealer)", "value": "df5efa34ed2e95ea72e210dcd93822a1c214b59d67ff624342c51b1a74b3ec282e016e782132194d8e469ee92b96d367", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217092, "uuid": "dd3e743e-b495-4d8e-bae7-d7c4ee897da1", "value": "T13A269FB3BA887998D34DE14E83A8061ABF40A65D48A3374FD531B72C7F66142760F94F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217092, "uuid": "49a70628-636d-4f4e-9a11-20098b3b1289", "value": "49152:2ODEyKG0xirjUPcy4BsBcCx0djXgiz7B/YoWD:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217092, "uuid": "c479df45-9648-4096-be4e-c7fe4e6e4bc1", "value": 4612555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217092, "uuid": "4bbd06e3-ab0b-4a20-b50a-35cf210ee16e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217092, "uuid": "3dc9fe4c-4377-477c-b7e8-7f066c4f46cc", "value": "e1c68fb6779fe41634c81d6100197814.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "224d9546-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217645, "uuid": "b19e9f64-1775-409a-836e-974469473422", "comment": "Malware payload (Mirai)", "value": "4f4ce22fda5784fa98df0821f1e3bbe9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217645, "uuid": "0f831e7b-2c7b-46ea-99bf-b37378cfa333", "comment": "Malware payload (Mirai)", "value": "546fa743b4c963e8f1fc8cb08f145d87f96543c4233763015f9df51e603adb98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217645, "uuid": "409406bf-6c72-4c8b-81c5-95dfe8cfae20", "comment": "Malware payload (Mirai)", "value": "9092954c890cd5fe50022b9249db31f8b488090b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217645, "uuid": "3da2e130-b00a-42ff-b38c-50de8784a4a5", "comment": "Malware payload (Mirai)", "value": "0574235d0921af86446ff837a3b7e6604073800ba812338b9f2819bb7cbbd10fe6ea2d81657e1dacaa518b4c9afcc086", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217645, "uuid": "e4ffb94b-0ccd-49c8-9d9f-e55e4d97d917", "value": "T1C7A5337669C6A4C11FFC5FACE48201EE8B84B08FD6698A1DB007FB7984B89514E48D7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217645, "uuid": "72ea1750-71f8-4b7d-b9a6-20ad977489ff", "value": "49152:LjLSx9Lgddh5lkKpAzrcMtO8qqCZPD3DgCWe5DrICBq:LjLSxhgvpAzrcyO8w5ICo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217645, "uuid": "8101f339-6aa5-4ac5-9e5b-1d9642801384", "value": 2098188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217645, "uuid": "15af2c21-1a0e-41fc-9473-56b2fc30fe0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217645, "uuid": "1b8d101d-c65b-4027-ba93-d74b566a4b66", "value": "devfreqd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad3b6ca-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249872, "uuid": "35480d78-5277-44f2-93ad-8c26d96fa8b5", "comment": "Malware payload (WannaCry)", "value": "4fbfa754204df11c5d7d4d76bb4b777f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249872, "uuid": "d04b2a86-e326-4513-86bc-e85942773415", "comment": "Malware payload (WannaCry)", "value": "54aa636dbc0be484bebe7d109631703ac63d5335fbfdb0f795329e6406463616", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249872, "uuid": "5a09d755-3571-4ba0-acba-9571d9d03589", "comment": "Malware payload (WannaCry)", "value": "43ac150395a9e5facbcb9ef831c647daf305d8fc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249872, "uuid": "e7b9d30e-b885-4581-9681-eb850ca5a778", "comment": "Malware payload (WannaCry)", "value": "59839937526b4d133a29b5c3c23d3fae5d8b32dc02c0c5aeaf2cf4bea3fede92847f916fda0552dccf1c9b4d46a1aa99", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249872, "uuid": "d810c219-c3ce-4a88-9ffb-229c6132e786", "value": "T16736C01B369CC0F4C0499271A8674A69EBF7BC1A1238D64F4B64DF660F63391B978B07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249872, "uuid": "10042aec-aaf6-4aa2-823d-f79ac3ed9f62", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249872, "uuid": "59d71e53-c2cb-4354-b49a-72e5997216dc", "value": "6144:yE9l9yNqIYVTH5DgSg8ajldktM0XXrs2Qh:ywbLgPluxQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249872, "uuid": "67b12944-a6c2-4024-a80b-d199cae62976", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249872, "uuid": "40bf4b6b-f9b9-44f0-985a-718e7853154b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249872, "uuid": "e973ae94-aa98-40bd-8bd3-3f1d1c933a96", "value": "54aa636dbc0be484bebe7d109631703ac63d5335fbfdb0f795329e6406463616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc8a2671-1d25-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773218387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218387, "uuid": "227589a2-dc47-4a6e-97ba-4ce7690ce8c3", "comment": "Malware payload (ValleyRAT)", "value": "4f481a449ad050fea9ca3900118e5676", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218387, "uuid": "09057a4a-4cf9-40da-aaed-8279590e656f", "comment": "Malware payload (ValleyRAT)", "value": "55b99f0d438800cad8288d81d2808728ce1bec8c22c5346a38a513dc6728b4ba", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218387, "uuid": "29bd81f6-8725-495e-9c8d-be305dc8d8bf", "comment": "Malware payload (ValleyRAT)", "value": "80c5d1ae1ee86f607fdefbbc5f88c5539f8582b5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218387, "uuid": "46a91be3-a47a-4f95-8254-600ab07eb688", "comment": "Malware payload (ValleyRAT)", "value": "f6164e49d468d8a7690f37092aff83baa36b9f55fa4a0bee57a386ebb14e924bcbaa785133d1601a0a2c052544c59566", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218387, "uuid": "040fb17c-4995-4789-ad7a-1261c987396f", "value": "T15F0512167D03E173EB880970A416A7F54966BC92CFD4B693EF92BA8F1C305C2A734649", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218387, "uuid": "3f44df3b-d376-46f6-a9e2-9256c1ea6a0f", "value": "b15035de0874191bbda1e93d484ec77f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218387, "uuid": "f23ff6e7-8768-4745-ae40-c2eb4ba4514f", "value": "24576:K8drt5ZuO57IYKhhjSq/y50MN3nAlf3Y:rrcq6j/ABN3nqf3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773218387, "uuid": "9b62b800-f88c-49da-95aa-2793c32b2f7d", "value": 852480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773218387, "uuid": "7cc09502-ea59-4db7-a51f-c2f401f6ed43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218387, "uuid": "2924f674-c619-4189-8447-02343bfb291c", "value": "sqlite3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283520c0-1d72-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773251156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251156, "uuid": "38156fb7-0c4f-49ef-8b25-82acf1062d38", "comment": "Malware payload", "value": "4be658aa1bb3a43861a23bb4c32ac295", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251156, "uuid": "3a632fbf-1c2a-448c-b386-3524a051aee2", "comment": "Malware payload", "value": "55bc31d53f4454a689aef80d86411fbe1a2db67517dc040da68689cf7335f4cc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251156, "uuid": "aa4839ac-fcc7-460d-bc8b-860bcc124df2", "comment": "Malware payload", "value": "89050068d0e25a95def0407f1d7070a9e6cb9620", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251156, "uuid": "c6f50414-7cc6-4e4c-b9da-c9039900e94b", "comment": "Malware payload", "value": "311bbc9399479d1b23325bd703344b3497aab31be772c3d85cdc871eb564f92588805a59a141b1e8e57de26aaaa2e31d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251156, "uuid": "09ebcc45-fad0-4d9d-984f-5ac91841efac", "value": "T1459100056B0874ECD69F85129A72881C774B05011E22740FB6CCFFB82323274BFD55E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251156, "uuid": "d11bd8db-bc46-4cf5-8177-6161df1d3a45", "value": "96:lFcgKgaQLTg0Diq/EYqaXasS/yYFzaZekkuWQN:UgykTg0w3suZPFm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773251156, "uuid": "de4fcd96-78f1-434d-b7fc-cbb9aad9afbb", "value": 4537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773251156, "uuid": "6184f988-6b71-4abd-a638-fbab3e3d3206", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251156, "uuid": "8c55884d-fb90-449d-9d82-f0b163ea7577", "value": "55bc31d53f4454a689aef80d86411fbe1a2db67517dc040da68689cf7335f4cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23494252-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249859, "uuid": "fbbc3224-c577-48fa-86f5-48ac0db026aa", "comment": "Malware payload (WannaCry)", "value": "a8855ebf1733049eb499c4a26e88a65f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249859, "uuid": "948637d0-60f9-43a4-a5be-83be337bef9a", "comment": "Malware payload (WannaCry)", "value": "55e0bbd6090a6ae735b81c7dce76ce9376f4e3aa20436bcde150158431fff231", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249859, "uuid": "9b2bffd9-4c04-4e20-8c05-49287e09d238", "comment": "Malware payload (WannaCry)", "value": "272f2d0551e61d30e6b56948952fa2b626db3c60", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249859, "uuid": "023ed3ec-3711-4856-a598-b2ea73556d95", "comment": "Malware payload (WannaCry)", "value": "bd878ef60fa473f396677879e5e2df991a036e195918b77468dac2e3a9fdb39c892e8eeb713b82b4da54b8fc806700bc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249859, "uuid": "7604981a-e42c-4efe-88f3-2acf898284a2", "value": "T144363360A72CA1BCF0950AB44063453DB7773C6AA77A8B1FC7D0C7660D53B92ABE4B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249859, "uuid": "03b36367-6c2f-44ba-9f93-687d5ba3f817", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249859, "uuid": "b355f3f5-a98d-46fa-9ef7-8ca388cb34a6", "value": "49152:SnAQqMSPbcBV/6SAARdhnvxJM0H9PAMEcaEau3R8yAH1plAH:+DqPoBd6SAEdhvxWa9P593R8yAVp2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249859, "uuid": "d0dc1b90-698c-4c2f-a3a7-9d4c9d9d9cdc", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249859, "uuid": "9278ea2c-5b9e-4fc6-b441-ef666390415c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249859, "uuid": "3f2f5066-8010-495b-b8e8-1fcb123bd8e7", "value": "55e0bbd6090a6ae735b81c7dce76ce9376f4e3aa20436bcde150158431fff231", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11400d2f-1d23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217187, "uuid": "dcc4e1d0-bc3e-4b6e-9f07-dcc1e53c2c2b", "comment": "Malware payload", "value": "2e3a97272b30d4b672d8cb6973773067", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217187, "uuid": "4ba7aafb-b337-476f-8fda-b2843664bdd4", "comment": "Malware payload", "value": "565261d747ea0570860c941f3cfee0ed363d06601382e3700ded0819e15222e2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217187, "uuid": "c3f00fae-ff1d-420c-8718-afcf23760553", "comment": "Malware payload", "value": "402ada6aa8c4043224284965629e6b5156790d02", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217187, "uuid": "0cacf2d2-d5c2-484c-abb4-c0aab5e216e8", "comment": "Malware payload", "value": "b700797dbaff5ec9f6d1ee4059503a3ad79ac3cd1bdc81ba7d69a01573bc45b88b4ff9339b2ea9f36e514d66bbd8f3b0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217187, "uuid": "85533ed5-9892-4be0-9a0b-a11e4b8aa060", "value": "T138D1E639CAD66962090F05DC773846CEA998C7140367BF504BAF8D1ADFD5A19CF390A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217187, "uuid": "94efe200-cf9b-4ec9-b176-df0fad55118e", "value": "96:VlPRxy1Gbp2rkB3/waBF8/asCDWglz4UQysXA4ATHtL3d6gbtrago4:7EGbgrkB7kODP6UQfatbd6gbF5/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217187, "uuid": "0f874a5b-8dd3-4383-94fd-15b2ebf8d979", "value": 6240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217187, "uuid": "dcc699e1-b3a4-4f50-9dc5-2ef652d991f1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217187, "uuid": "27a4c2d9-1865-403e-9a03-0dbd81ee4dd1", "value": "2e3a97272b30d4b672d8cb6973773067.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a24001b-1d20-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773216101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216101, "uuid": "83e24ecc-db39-47c6-92ba-df2215a66bf3", "comment": "Malware payload (PhantomStealer)", "value": "c995a47a44b91e700238574c9b4d74a4", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216101, "uuid": "1d947541-f541-43e8-ac83-ff2492420659", "comment": "Malware payload (PhantomStealer)", "value": "56a188b98322b87cac62a0f5eb7a90514233a2296af7958e9e0ff68950ca32ae", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216101, "uuid": "f6f01024-6c01-432d-b8ed-97759579fc38", "comment": "Malware payload (PhantomStealer)", "value": "d57e82fdc9265248503977b4fa6ae6d00c1b248a", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216101, "uuid": "e09bf717-5cd8-4567-ba69-eb0e6709b1a4", "comment": "Malware payload (PhantomStealer)", "value": "c354946cfb8524601b31cbc1e766b7c91c43db674a835c61640b22ddc356fb19446e4f128757a42a5846072ea877d3d3", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216101, "uuid": "80143083-9104-4dd7-bca1-deae4f8b5168", "value": "T16526AEC22B2C9F6DD88EC31D90F0934ED7E19FA6F66E6C69051B1D9686AF04B107D0C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216101, "uuid": "c50fe877-9e11-4a23-b39c-355262bfb110", "value": "49152:0f+3gMnLeMl7z7O2K+FPAikP2ATVI4tflCDUtxTOHOYixDkSCj7uT+cDGAMAI5YF:U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216101, "uuid": "6a7bfa53-ddc8-4d7c-baa8-bbb29f002ead", "value": 4607283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216101, "uuid": "5c21eab1-8e35-405a-9858-63fe07df785d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216101, "uuid": "fad09b05-3004-4a84-a932-264a97e1ff06", "value": "c995a47a44b91e700238574c9b4d74a4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62381ea-1d59-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773240764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240764, "uuid": "7bf341d0-332b-4698-ba90-ef3bd23210b4", "comment": "Malware payload (ACRStealer)", "value": "36ec19525c7c89f8500c57edce91d000", "object_relation": "md5", "Tag": [ { "name": "141-98-234-16", "colour": "#B07C16", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240764, "uuid": "c7b41d6b-0ca9-467e-b259-f8ee2c1fb3c0", "comment": "Malware payload (ACRStealer)", "value": "592483ce3a4b52d6f34ab5eaf69950dee7ee54506fab316b14735f4f81f31a1c", "object_relation": "sha256", "Tag": [ { "name": "141-98-234-16", "colour": "#B07C16", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240764, "uuid": "94777210-80a6-40ac-aac3-c6acc659f229", "comment": "Malware payload (ACRStealer)", "value": "43310b95d07096cd44ef5ce26f97aa981ec01775", "object_relation": "sha1", "Tag": [ { "name": "141-98-234-16", "colour": "#B07C16", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240764, "uuid": "12c4b7bd-e438-489c-932c-21d629f44a36", "comment": "Malware payload (ACRStealer)", "value": "4c14430b5db39245beb1e7060aaf6563a8f91eecf530b3ccd8f272b14cc68bc85f78f56e316cdba55edb5549699012d4", "object_relation": "sha3-384", "Tag": [ { "name": "141-98-234-16", "colour": "#B07C16", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240764, "uuid": "a00a72ba-50af-47c1-97ad-e522be633833", "value": "T1AAD69E239DD08274F6C651FE86FD3B6AC86D8A05033981C799C83C995B319E63A3D71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240764, "uuid": "ad392eef-9576-411d-805f-e8972d7366ee", "value": "0bf4447fda89303e8c2644bb6df92eb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240764, "uuid": "7b082a10-7118-4407-bce1-f0caf78a0337", "value": "196608:iQke5A05AXFN3delxDtPAFGfcn+hr7k9hp:iYA0aFsDXcn+B7k9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773240764, "uuid": "4386d13f-e02f-4535-bd22-56db8f7af536", "value": 13208064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773240764, "uuid": "17d81a9e-37f6-4757-95da-45c0d2f1d7ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240764, "uuid": "ebf470d9-ff77-4855-ab47-6bc4bbefc196", "value": "wke.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55227fc6-1cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1773199692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199692, "uuid": "03ce6e37-c899-43ed-af7a-09494849c433", "comment": "Malware payload (ValleyRAT)", "value": "4c42136da4df69ccbc13b50519fef746", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199692, "uuid": "2a4088f7-ac14-4b65-9e94-615da1cf87d0", "comment": "Malware payload (ValleyRAT)", "value": "5981f5bb23790380033b1eb9f6030ecd81b1280d885525e58b1b49939f98dcc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199692, "uuid": "238e7bb3-67a1-4c3b-a41c-27dc63cc4412", "comment": "Malware payload (ValleyRAT)", "value": "26851fd5cf302351eeff885b297f5711184a0e38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199692, "uuid": "f39de647-f6cd-4f50-99f5-a9fd04c6fd2f", "comment": "Malware payload (ValleyRAT)", "value": "71befdb2f8d3171b3420d1633d6489a4b8d1bc4ba51f3daa8d2e3ff112b5f4220b93d422a57cc727bb111655a9916697", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773199692, "uuid": "c656f365-3493-4d3a-9f49-13fc0be1f9aa", "value": "T1D9157C0275D9BCB2D47616312B7B97E5872DED104B60C5EF63C406698E3C2C3BA31BA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773199692, "uuid": "5e349477-8f70-4532-98b3-d9866e9e1dc8", "value": "975ec071e6f5d1945ef4d7912c896f0b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773199692, "uuid": "802ac45a-836f-4939-8161-2cebfcc3402d", "value": "24576:rzDDKfOejQFI2lmaZgCR9ymOTo2sCHFLBXS:XDDOfQF/ZgCRDOTo8LXS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773199692, "uuid": "1149ed67-4137-463d-b4f0-eef7f81cf69f", "value": 952832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773199692, "uuid": "a5640267-8a37-4a2e-b74e-7158877cc050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773199692, "uuid": "d137ad1f-2155-4c0a-be90-c9bde1c0ea22", "value": "\u5c0f\u9ed1\u5c4b\u6b8b\u5fcd\u6bb4\u6253\u8650\u5f85\u4e2d\u56fd\u4eba\u89c6\u9891\u66dd\u5149.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f2f83ae-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217667, "uuid": "37efbee9-4f1c-4f90-9e6e-790f60d205d9", "comment": "Malware payload (Mirai)", "value": "27be7285a32ef02e98ebeee9ecc0d0a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217667, "uuid": "bb290dd5-22c4-4d8a-b471-3e3ed6287077", "comment": "Malware payload (Mirai)", "value": "5983735c43d7cdee4d29182ccb9d639c25a7e4876aeaf3d51c9ce1471ce56edc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217667, "uuid": "88defb09-2e51-4a67-aa77-f1e94a434472", "comment": "Malware payload (Mirai)", "value": "6dd6e372a9a6df82cc2fc7b24822d3ea171fd179", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217667, "uuid": "9395e361-7b1f-4451-9de1-015d08299f0a", "comment": "Malware payload (Mirai)", "value": "433f3f5ab3c32291051f8ad3cc42ad353fbad45f5d611ac0d8868bb90dd0de0b28889c84bc970683fc7d596bc1337c56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217667, "uuid": "bcd2d832-c5ca-4b2b-badf-8720558e20f2", "value": "T11BA5330A852B40D3B5CABB95AD4400B64560F86709B5736F5B3E8AD203AC4C7F9F67BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217667, "uuid": "87d8bbfd-d2e9-4f8d-8e8a-d0ee0f6e7919", "value": "49152:wzsh9jrElwhOFkaeq3vgWdumeaJ35jC5/Yc8cJd/DQx:hh9j6whwSqfxMC5+5/Ue8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217667, "uuid": "f419d4b6-c18e-4086-96b7-e3ed6caee7bc", "value": 2126904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217667, "uuid": "7ea90428-adc3-429e-83f9-0f41c22455e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217667, "uuid": "600af839-ad1b-4c49-8166-8460c016afeb", "value": "kswapd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b5d43f-1d57-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1773239559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773239559, "uuid": "d278899e-93dc-4938-aa0b-981a6c7440a5", "comment": "Malware payload (PureCrypter)", "value": "5bac9c39fa56cfc75368463783a543a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773239559, "uuid": "11830ef7-fef9-49ec-92da-53aaa472fe31", "comment": "Malware payload (PureCrypter)", "value": "5987e61305c62e539824a8e8613437d195322b0f1374bc1d0e1923ba23a8ca6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773239559, "uuid": "9c19b880-12df-46eb-b89e-7465726eaf16", "comment": "Malware payload (PureCrypter)", "value": "a2d6ad4f2d71c0bf2a10b08548c6e793351f73f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773239559, "uuid": "8b2df167-9bd7-4b98-8529-f0999a2a56b0", "comment": "Malware payload (PureCrypter)", "value": "6b165a54994cab9b8441e76a10a5d53fec5a7416c26b691e27cffb6c2e98d4cb487b858e89846bdb7623d7ea23bedf00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773239559, "uuid": "81a17f55-b946-4432-b9e0-035113748b22", "value": "T150E6333B58D289B4D3295FF3EB469258619CC94446A0C5E7E382B2EE07BD8D34D2F1B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773239559, "uuid": "94b1aea5-30f1-4239-bb7e-67a73c2a9735", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773239559, "uuid": "ff9657a4-621b-46f8-90d3-57b716661d80", "value": "393216:aSUBVthwy9I07sOy1ZFVlXu6zfapSNcicm9aMcdXkkkNO:ABVthwD07sOQZFVxTcm95cdx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773239559, "uuid": "0fd5b28a-7936-4b85-b0be-9ea1b3f746d5", "value": 15192576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773239559, "uuid": "60617373-9278-4f89-954c-83cb07715522", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773239559, "uuid": "0db53981-2b7d-440f-af64-63a25ad70084", "value": "Installer_v3149_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1c1227-1d4e-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773235808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773235808, "uuid": "6fa5a49c-7c93-4588-8368-6568a4ea2ec1", "comment": "Malware payload (PhantomStealer)", "value": "53aa811c1453c1653b071b9f340c6e2d", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773235808, "uuid": "4ad89939-6884-469b-bb25-b3df55c07651", "comment": "Malware payload (PhantomStealer)", "value": "5c05a2314c615ee58fe32e421eb39f33e693e7cb666f492befe24451e5c86c68", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773235808, "uuid": "a6569cd0-e928-4c33-8588-35360afd3d7c", "comment": "Malware payload (PhantomStealer)", "value": "973f132bb5389debacaadf749efb1c2a1e6055b2", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773235808, "uuid": "c86d0747-45ae-41c3-bfe4-a661d79a0830", "comment": "Malware payload (PhantomStealer)", "value": "515337c35b992b8436825a4dec9b9fbfedaf36db5aa1d1c11b616f7120325bd385154495df258cdd5879602a1e419eda", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773235808, "uuid": "ec81422c-1ebc-4c9f-a7d1-cd1427bf71dc", "value": "T1B2D2768C3DCAB568D31564FB282FB09BEAFF0CC8B89D8184CB1919C5F865704D47AB16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773235808, "uuid": "56a46ad9-3633-4a03-af30-73b53b2a9fb0", "value": "384:XrZUkZOSl8wN/wz6hwWSCt5i1Igtfqm7LBhs0nrCk8ByRHrg:XrZUUFwz6hwW7iLF7Vhs7Buk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773235808, "uuid": "cc609ee3-47b6-4b20-9c4d-e6b249ecd039", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773235808, "uuid": "69968daa-b4d0-4280-b9f4-719cc2e35578", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773235808, "uuid": "aaf4f8a8-4b77-4453-98f3-afbfdc54139f", "value": "nMoflash-Proforma_Invoice-FOB-2026.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eba32ee-1d23-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1773217183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217183, "uuid": "92cb6b21-d427-4fda-a3ec-a46936a34c70", "comment": "Malware payload (VIPKeylogger)", "value": "58e483bcb7968d323aab62f9d6ebbe80", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217183, "uuid": "36e61883-f0e7-46ff-8ffe-7b816da7c7f5", "comment": "Malware payload (VIPKeylogger)", "value": "5c4623a93e06e54716cd5a83a9d858998d1a456bad15459f4e48c9063bd41b2a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217183, "uuid": "e245c5f5-0762-43f8-b631-f2d21d7f0b09", "comment": "Malware payload (VIPKeylogger)", "value": "e01a6f19194b52fadebe250f601c2ad131e0e2b0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217183, "uuid": "77e006fc-7541-4331-b0c1-e3619b39a335", "comment": "Malware payload (VIPKeylogger)", "value": "615b1e77e5655d494c1f01b286b1d0e01e0540b98a923e073b559a1e88e0bfc76dfed69939fa0fd6ee7d041458b88648", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217183, "uuid": "414e99fc-a9ed-4dfe-ba4c-e70eeea8eacd", "value": "T13BD231CD79C6B16883013033A95FF49BF13F9C816C9CD958D9D5B898A8A4B38D0B587E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217183, "uuid": "269be3c9-b798-4f6a-885e-dcc28dd58e19", "value": "768:rYCauY9UL3nmmFbrfMwFkkIplRDwqbOfihoiL:rYCrLmmFtS9/RMqaaho4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217183, "uuid": "43c6348b-5df9-4504-9653-2e992b40b4ce", "value": 28983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217183, "uuid": "0fed9079-a96a-4b6e-bd39-3c5ab69afb86", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217183, "uuid": "a2c600a5-140d-4083-b7a7-22c1486742eb", "value": "58e483bcb7968d323aab62f9d6ebbe80.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24477eda-1d6a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773247713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247713, "uuid": "3590bd9a-76f7-4655-8ed2-c61de3a575a6", "comment": "Malware payload", "value": "74a436afbcec2bc9ade4f6428ac23696", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247713, "uuid": "26e6ec08-a12e-4331-8ca9-986d0e915bb8", "comment": "Malware payload", "value": "5cd729cc2f286beb8bc76e55971f6efb7e960f83536f2bee7671c30cb3bb5e96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247713, "uuid": "71d921ba-c751-47e7-a5b6-d34b69c69ae1", "comment": "Malware payload", "value": "ca013f6c170aa7c0353e0645f7ff0ecfd4ed9a7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247713, "uuid": "cd3b3531-c0d6-48f4-ae7b-210d823c5317", "comment": "Malware payload", "value": "a3a024a75a5c97f8b658ea4ca9a9e6aa66c95fa45076737e68891fcc3d7414c7f82860f786342e02d8033dc1e66199b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247713, "uuid": "416cc5d4-5848-4b89-858f-a104339bc29f", "value": "T12B65020ADB81E4D4D051CB3444A1678565BEBA178F35BFEF02992E5D1CB23F08E38DA9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247713, "uuid": "63260709-7307-41a4-a756-0913473730db", "value": "24587f39ebe7f0e9605e30bcc578e5dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247713, "uuid": "9fa24174-7d74-4a54-bc80-467aeaa8d6ce", "value": "24576:nM6fYVd7o/KY/V3PXBH3bzVi6CBJuWGThzS1H29K/:nlYVd7oiY/R9fVi6CBEDThex20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773247713, "uuid": "becc380a-1e45-41fa-87c7-c2ab5c0604c1", "value": 1509888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773247713, "uuid": "7a3427d3-43c6-40c4-a44a-cb2fa146eae1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247713, "uuid": "355567ff-ade0-471a-abd8-67609da04cf4", "value": "2026.03.11\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a25ab70-1d1f-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773215672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215672, "uuid": "c781c922-8839-4174-9410-f6eba81afcf0", "comment": "Malware payload (ACRStealer)", "value": "28d77564d5172c912f920f01ce793009", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215672, "uuid": "07ccd523-587d-45b5-8979-5e3dd8f1fb5d", "comment": "Malware payload (ACRStealer)", "value": "5d3f06b5d0857bffa404c25f8fe0a8a7a320adeefbeefd2ecd3b9ae7bbeb0735", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215672, "uuid": "f4534dd4-e5d9-46c7-b321-86b4d944ec3e", "comment": "Malware payload (ACRStealer)", "value": "75c71cfd29de7145942d4f1d8e4707acaf87bcd6", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215672, "uuid": "91d03242-fc4f-4e85-b307-625d5dacd292", "comment": "Malware payload (ACRStealer)", "value": "727e2b13c5cc63a5d949408e490cef6bf4d04540fcf5beb80fbce89e669b7552f36bcb20038cf1246975355fac1fe579", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215672, "uuid": "68eb7207-9509-408e-9573-4d2b54d0a476", "value": "T15F259E92E98E87B6FE9B2DBD0449E23F932851184F11D4C74254DE9B393B7E3653A302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215672, "uuid": "aee691e3-6d82-43a9-97e8-a4ab43750d95", "value": "dc584fb15b5042f6720ca9e383d679f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215672, "uuid": "884cb26f-9964-4d55-868c-0f32fdc9745a", "value": "24576:i0Jue5pHodPNsjk3dIIIUy5KHuoxgr5PNzWSz/emErxTfL:4z3dIIIac5PNCYemErxTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773215672, "uuid": "b3e707bb-d81a-4f04-89be-7eedd8f77f9f", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773215672, "uuid": "de13b608-8170-45bb-b3ea-e310c2c7d4d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215672, "uuid": "ef4467db-c08a-4d5a-9b6f-e2276b2ce6bf", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "388866f4-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249895, "uuid": "f6e495fd-cc1c-4a3a-babf-2ac5f15ce821", "comment": "Malware payload (WannaCry)", "value": "f29fda069a06d11ba8dedf5cdb8e2ac0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249895, "uuid": "2e812ba0-2fb3-408f-98d2-484bb5048f85", "comment": "Malware payload (WannaCry)", "value": "5d8b8489bca4e3b99a350b201f09ed444a803eac53d6659c14cd5146645d4049", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249895, "uuid": "4bd3ee31-bcaa-4d9f-8b6a-f42409189c37", "comment": "Malware payload (WannaCry)", "value": "fd0fb3e42c71c951a4068ec1b1edf7c6a80eb39e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249895, "uuid": "1f293892-0ca2-4189-9aed-c0188826d8c5", "comment": "Malware payload (WannaCry)", "value": "baf06b51c4b40469124aadea6ebd08b5ecb60bca98325f0aab62614289ec28dbf1af381fbb6f79277d402fd1f837e587", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249895, "uuid": "7fc94048-7d93-4932-8588-7859ab20d9e0", "value": "T1D6363365623CE2BCE1041EB04063C93BA7B73C6556FE5E0F8B4045A61D53BAFBBD0A52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249895, "uuid": "f0315137-6a4e-4762-99d2-a0f7ac1d2723", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249895, "uuid": "2dcaca9a-2e59-4999-af84-3c52c68c7f68", "value": "49152:znjQqMSPbcBVQej/1INRx+TSqTdX1HkQi6SAARdhnvMAMEcaEau3R:T8qPoBhz1aRxcSUDkh6SAEdhvM593R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249895, "uuid": "0c1d385a-eb0b-4c57-a4a5-35e40366f569", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249895, "uuid": "7f04a9da-007e-4836-9eda-5aad9fb7c913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249895, "uuid": "cfbff087-b516-487f-a737-d97f652dc330", "value": "5d8b8489bca4e3b99a350b201f09ed444a803eac53d6659c14cd5146645d4049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba7fa28-1ce6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773191247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191247, "uuid": "5409eb7f-352d-42b7-8b54-ceb7fcf9ac9a", "comment": "Malware payload (Mirai)", "value": "eba2826e2a1aab47966bedc555de2b6b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191247, "uuid": "c271db28-8d8a-439d-b7ac-2a80e852e4a0", "comment": "Malware payload (Mirai)", "value": "5dd7423c5c6cf5ac5774cef5d2f23e4a56ef367f3ef7f98ee9c54559a24c61ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191247, "uuid": "55c0b335-33ec-4487-bd46-a3013358511c", "comment": "Malware payload (Mirai)", "value": "8fbcc0aa8a2ab4168aa77d211ce073f9c617de5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191247, "uuid": "62d03e64-2869-4268-9be9-d238b8014c4a", "comment": "Malware payload (Mirai)", "value": "1d5f745b2167796a57b28a29464db39a2f1fae757ca0893d09c93b43c3472c97ac9b369ab41b42c867e52f8b5408d008", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191247, "uuid": "eb450401-2671-4b34-8dc3-8dfcaaafc5be", "value": "T172832A95F9814B21C5D512BEFA2E118D3313177CE3DE72129D10AF21778B96B0E3BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191247, "uuid": "9eb39c5d-b8d3-4b5f-ad4f-5aeae8492551", "value": "1536:4wnW6LltCc1HF2kfnA/vAa4Ww11Q2M8i6+fghe3U7AL5YGYC61d6dOO:BhtCUFA/vAa4V+fghe3UUL6GasO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773191247, "uuid": "1aafef7a-bbdd-4fdc-96e3-1358999160cd", "value": 85492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773191247, "uuid": "a035c9e7-3d86-41a9-acb7-1653807176cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191247, "uuid": "a7cdb78e-b408-4c5c-a61a-6473862f7430", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a2a08f-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217840, "uuid": "6641d65c-fa10-43fa-bc62-3c67ffef8389", "comment": "Malware payload (Mirai)", "value": "704e11ed8f46a3713e8ac73b3e4ea20d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217840, "uuid": "c8da02a0-3aac-44a8-ad28-b15b7a9fe35e", "comment": "Malware payload (Mirai)", "value": "5e4e053b9f63c2a6024eb02a7a8c0122c3d1f655d6abf5a5d325df7064e78969", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217840, "uuid": "e7497009-17e7-496a-9c5b-34fa0054f99d", "comment": "Malware payload (Mirai)", "value": "8528f51462fe81cb9453a7c0012bdaf82d1ab176", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217840, "uuid": "f5abacff-bd72-4bd1-93ec-d4cdd4768d82", "comment": "Malware payload (Mirai)", "value": "8b110abd32e6731cbe90eebc8a146e9d527b145ecdced06d587a2a239f95b9bcd5f576c7dcaba3c1f826cb4053ee952d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217840, "uuid": "bdfa192e-a045-448a-97e8-436c7651dcde", "value": "T12D866D81FF48E125DA4A0B7248630B34B3601D42D1E48D5F5309F76F95B29F66A8FEE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217840, "uuid": "8d64d4d0-f84f-4bc3-a8a5-447d0322dd71", "value": "98304:qK5vgMWmwL4/Fq6YsNLhi0GR28YI+Oun1aXRfjEX:KPme4/Y6YAV2RoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217840, "uuid": "7aaef917-e9dc-4dce-9543-217743fde838", "value": 8192148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217840, "uuid": "10d6b65b-9a30-442a-8ff6-99f8eab39c1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217840, "uuid": "cc612007-99e1-4253-b246-a316963ae43c", "value": "kpsmoused0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b8ac2ea-1d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773255537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255537, "uuid": "e91bde9a-3ef5-4cb6-b38c-d054dfc79c53", "comment": "Malware payload (Mirai)", "value": "7486a2f973dcbadfa581ec12d1a65a26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255537, "uuid": "2a3d4e63-8bc1-47a3-a4c7-09ba1750e4a6", "comment": "Malware payload (Mirai)", "value": "5f4d4fd589421bcf95b5b6b0139b7a3321139b86c58463b1456eb2c36de33055", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255537, "uuid": "3eaae690-78ac-4dbc-b61d-25c3d805560d", "comment": "Malware payload (Mirai)", "value": "b9b94bf621a529fdfc518829bd35031080074df1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255537, "uuid": "506a33f8-7b11-4e4d-b2ea-10b5b96743f3", "comment": "Malware payload (Mirai)", "value": "b4e5a376f092779ee81bc4942be1f33bcc5e2879d5cf1443a4d6a9dfb9e4808848c680f653e8be685375edd3bc32f76d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255537, "uuid": "62a7462d-906c-43a1-81cc-948776397b12", "value": "T196A3C81E7E15DFBDF659C23047F78E31964437862AA2D142E16CEB101E6138E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255537, "uuid": "3019d004-a549-49d8-b3fe-857e4d72a00a", "value": "1536:8bG/vWi5MMRtknUY0UlTVA9qsFg05JniNXLUlhmOSK0nE62K:87WndPUjA9qsFg05JiZUaOSKsEVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773255537, "uuid": "c3416d8c-37b8-4d5a-9afb-3a579a73426d", "value": 100543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773255537, "uuid": "79080ef7-cb18-4c58-ac0f-7ceff9109a37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255537, "uuid": "3e5603b1-718e-4526-8890-08bc70359630", "value": "xdlol.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53568987-1d61-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773243927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243927, "uuid": "9b3eb06c-7179-4961-b3c9-67d5714be193", "comment": "Malware payload (RemcosRAT)", "value": "9b13222782f0ede17a2523bd991c5fd8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243927, "uuid": "2e8e6302-c415-42b6-8ec1-fd51ed7ff7b8", "comment": "Malware payload (RemcosRAT)", "value": "5f4e835359118e714da9b05fe532b9ea1b8f11e64c66bb7b0a4cb3fdea28ecbe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243927, "uuid": "81d83705-7ec2-4cd6-b26c-e703f97598f2", "comment": "Malware payload (RemcosRAT)", "value": "d2d2fd3591287808b4ed8c742c97cdd77ad50874", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243927, "uuid": "1f5f8cfd-fea3-4a23-99fc-b5fd7847fe57", "comment": "Malware payload (RemcosRAT)", "value": "ee2c328b7a5afbb167bccae399e9a6d59898079e508082080cad50713dfa2b95ecb9b61f706f80d4a33bc635d041366c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243927, "uuid": "7c27a60d-b1fa-40bd-a189-a427b4195e63", "value": "T17EE5AF6248DAF6C8D7D8796BF4FA211E1284325FE93838045178EF4F9B321452627E7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243927, "uuid": "289ae81f-42e2-43c1-b119-33cdbc66425e", "value": "24576:ya0IGCmHWrjImOlEoFj17sMJtDgRQzCYewCQi/E1H/88ViDX6JES2sBY1GNLKOFJ:zbuAo5zfznxNFNFy/BY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243927, "uuid": "720c911f-9c53-4086-8f29-449905a91bcf", "value": 3280148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243927, "uuid": "49f8659f-ddcf-474e-9dd0-305d67173aa4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243927, "uuid": "fa312291-c0fb-46e6-80ec-c18d8f6e2b4f", "value": "9b13222782f0ede17a2523bd991c5fd8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31437ec-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773217136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217136, "uuid": "ff85e3df-54e8-45b9-9d8a-942eacc7e216", "comment": "Malware payload (PhantomStealer)", "value": "240f76cfe8f644ab8640e60d17251881", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217136, "uuid": "ae8b1d93-3f51-4519-8fb1-19fc8dfc7b25", "comment": "Malware payload (PhantomStealer)", "value": "60a9b06eea41fab13be83123f97de5ef65cc489ccca4686547c3b3d44eec8e14", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217136, "uuid": "d809f535-d96e-4f1c-b082-8d83b16165ad", "comment": "Malware payload (PhantomStealer)", "value": "e7e3100c927144a7ecedf2954841b652a648c9b5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217136, "uuid": "570c44c0-5013-4e59-bd9c-e11f4d6858a8", "comment": "Malware payload (PhantomStealer)", "value": "c487d931a2a565df115e5f45ee958aeba2d47eb9d033a139de89cf757bef0eb8eb6b4546d611887daa4e3cd0d0587cbd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217136, "uuid": "5f8f698a-a2ba-4eff-b552-be417c35a0b8", "value": "T15726CF0586496F3C82FD732A11FBA00CF3743E1D34488995BB66B959FABF911193E31A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217136, "uuid": "ac8d6234-bb80-4b20-8a8c-3f7ff5b0a257", "value": "49152:2e4ckv7ZC0P5KsWqXNKyorac8OKnkNDWs6lhdipD2a3OhOljthlnyav9GNqxx27U:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217136, "uuid": "5591e299-2407-4d6a-9d8b-273c71ccb6f6", "value": 4612911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217136, "uuid": "d4acbebe-3803-476a-a80b-005f1d018243", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217136, "uuid": "52ad61ff-9d8d-49fe-affd-c07076d2f73c", "value": "240f76cfe8f644ab8640e60d17251881.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14892299-1d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773255418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255418, "uuid": "c448de45-bc1f-41a7-87d6-9f0f91dbf605", "comment": "Malware payload (Mirai)", "value": "7b1ee80fdef0678115778ed6423141d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255418, "uuid": "d0f1abe4-8d97-4ea1-9725-8bd6ed8f7aae", "comment": "Malware payload (Mirai)", "value": "6282ca587326fd593279a91527bbc1babba7fc42aa2bef50054e3f0ec945877e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255418, "uuid": "f37cb499-27b1-448d-956e-a37e9f56fda3", "comment": "Malware payload (Mirai)", "value": "b78a8846ae7ab25e796a43a84f10f97704d99024", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255418, "uuid": "599073ba-3acd-43c5-84f3-c5b25abb235d", "comment": "Malware payload (Mirai)", "value": "386a332be37ea1737a237c8c8fb736b194d5a4b5d8c1ee3df603479fdbbd310eb4e6852b06e0e67100695d62563a0cd5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255418, "uuid": "26117862-4a26-4953-928b-3c128a1251ce", "value": "T16E464C43EC9555E5C0EAD2318A729253BA717C496B3523D32FA0F7382F72BD06AB8750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255418, "uuid": "7508e064-4f79-4a59-a6b8-737fb7a1b1ba", "value": "49152:1KFI+hSpgxDvG7A30oVdhnQmvX+qshIGQIs+UW5Eeei3hfYgJRcjRPKOKDKWrGnP:1mYg5DhQmOq4IvKI82Iq5Eg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773255418, "uuid": "90c8f9a9-456f-44f5-b005-610b06c2e2d0", "value": 5697720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773255418, "uuid": "f6c6d5bd-f069-459b-b19f-56ae109a4e0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255418, "uuid": "d5478f2e-1d2b-49fd-823d-79b934b4dcfa", "value": "boyl7molon", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec44f0f-1d23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217451, "uuid": "cf2e3545-cf7f-4451-97e6-ec9569f9dc5e", "comment": "Malware payload", "value": "6e8ab5a2f7112d1617fc03a8acff5bfa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217451, "uuid": "96a65242-ff31-47f5-be80-bcd7fd3f1a4f", "comment": "Malware payload", "value": "62fcf3ccd49cfc8de6bca7ba35e5a4ec31addf5f4d9137d05ce8520b721a0a8e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217451, "uuid": "5e1501da-168d-4855-8c5b-a78aefe2acaf", "comment": "Malware payload", "value": "33e6dec4ebd9e855f2e5d8856164227b8c529939", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217451, "uuid": "65396b8a-6e27-4a7b-a2aa-06f0c0f01622", "comment": "Malware payload", "value": "6364f3fed6972e0b7fbc06aebeccea403e301c4d0929756983cd7c0531ea89b3ea2f8e66668f34a7064ddeda6557a1ad", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217451, "uuid": "297c9b56-2658-4c16-9ba9-7f18a5d654d3", "value": "T1ECD2218D2EDFB528425A347B2D6BB09AF52E8C4C749C805CEAE71CC2F89D709C47B564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217451, "uuid": "7aaa9b78-397a-4be1-b95e-4e3782c5e193", "value": "384:TQA3dcP+qBoaMModBG8REafOHlmm9O5vPsKbJhCKjtp0yUPMfOeM:TQEd0ZBXMMolCSOHF9wbJhhp0yATeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217451, "uuid": "83328e58-93d7-4439-ad8b-e6b946842074", "value": 29918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217451, "uuid": "2c0a04c0-5091-4725-9a49-1c77a6459912", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217451, "uuid": "aeea673e-b13b-4f99-98a4-63fa75eec4dd", "value": "6e8ab5a2f7112d1617fc03a8acff5bfa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af0089a6-1d72-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773251382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251382, "uuid": "6c098572-85f2-4500-85f4-9627d760a946", "comment": "Malware payload", "value": "a96d714bece3b14cd277832caed1a27c", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "IDFC First Bank", "colour": "#AE5266", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251382, "uuid": "8198e864-31fd-4da4-9ba9-c8381e9ad404", "comment": "Malware payload", "value": "6373050c7195670f6d75966c2a9518ed2f1b04683291bebdf8cb55c62c2389b6", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "IDFC First Bank", "colour": "#AE5266", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251382, "uuid": "cd2858d7-84f1-4ea5-82a2-3e51b6b28713", "comment": "Malware payload", "value": "5df02aabf536415756f1c9e244cc187c59185159", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "IDFC First Bank", "colour": "#AE5266", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251382, "uuid": "cdcb0019-ca19-4133-8f41-5c13676ec424", "comment": "Malware payload", "value": "3bb01015db5c5b83011d9539ca15642724f1accc6a62ca4e04316d5b1511fe9cd029fe9146ed9bdccdeab910c2768c6c", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "IDFC First Bank", "colour": "#AE5266", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SpyAgent", "colour": "#4243C2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251382, "uuid": "98b0a9b6-cc50-40a2-9e43-1dcafe1db83b", "value": "T18DB612D6FBC4492BC4779032C96A12F1225B4D568A839F877504361C38B7BE84F9ABDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251382, "uuid": "224a939e-bea2-4239-b9ed-668f83201fe6", "value": "196608:7avXPyZt4G1sGj8DXDKAlWohKAvJ9nHnD0wrCQsqw0pEyYdAgrZNc/rmGn:YPHG19ADXDp/h1xlHDtMFXKn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773251382, "uuid": "b1b28a94-f5d5-4e6d-9c3e-904f06fdb455", "value": 11454580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773251382, "uuid": "fb7d1ded-1b89-42f9-8b4c-bd3c3b54cfec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251382, "uuid": "988e5f3b-5576-4b2d-b2d8-92e69ddb89b9", "value": "IDFC Mobile.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53ef0bf-1d78-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773254077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773254077, "uuid": "e37e3137-96df-4768-a59e-30e681f41801", "comment": "Malware payload", "value": "698d811173c6ea3e5ae5f37251a8855e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773254077, "uuid": "3123246b-c661-426a-aea7-785f3ff7c986", "comment": "Malware payload", "value": "63a19cd37e5f23ba982d004e587472bdc30d64af04e1b321419d8173a16c60cc", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773254077, "uuid": "5b8ba848-d588-4a50-b744-3ee278ccfc76", "comment": "Malware payload", "value": "491718ab8a3745376f7d76ff5696e373d3bd57e7", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773254077, "uuid": "ada5ba6b-04fe-47c0-9a95-e6ffc25748bd", "comment": "Malware payload", "value": "f65218630c05139f8bc78c5bfcdf872d5ed0f52781c6e053e4968b230461bd352fbe8240b30bbf80a99b14198087f5d5", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "Tiktok", "colour": "#0B1B37", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773254077, "uuid": "1beb57bb-cb87-4144-8644-abc61599aaaa", "value": "T122A633D2F716492ED8B604328DAE07752B555D928A92870B7168373CBC3BBD84F98FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773254077, "uuid": "c775c086-08f3-4e4f-8847-a844e5cb3d9d", "value": "196608:OsXyrMOArjv2K4Id5MpmRY3PDgvv1ktR7rGGlpgoLyStn0:fiQjrqKPpRY3WeRuGlpgoLyStn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773254077, "uuid": "a62efc5b-abee-448b-b808-b2ca9f78818e", "value": 9541790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773254077, "uuid": "fc906b11-1360-40fb-a02a-84347dfdb5bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773254077, "uuid": "8b4919c4-2ee4-432d-9627-5a8f1c5fa81a", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1b9cba-1d3f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vjw0rm)", "timestamp": 1773229206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773229206, "uuid": "b53a3857-b70e-457e-9e46-5f439c2d5506", "comment": "Malware payload (Vjw0rm)", "value": "8f23f5ab2326351ff30a4d42736dd7db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773229206, "uuid": "50b47509-09de-41ca-9d32-47203e8ad865", "comment": "Malware payload (Vjw0rm)", "value": "64a92d23f6efcc17cdd3016a52e0503a13350f037785220a08b74b46333a3eee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773229206, "uuid": "69b315b5-bb8e-46e7-a5c1-b98811507619", "comment": "Malware payload (Vjw0rm)", "value": "cc4d5c8ed5f1c2a9908235c50dd2c25387ce6ece", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773229206, "uuid": "a9b6e131-a3cb-4c33-8ffa-5f015a22eac3", "comment": "Malware payload (Vjw0rm)", "value": "adc1dbf61af509294d437593505a89dba5c6c3a7cb92c9e5a1d2626fd44faf7bcfaae2d59b59889f48f9cd9a220c1e26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773229206, "uuid": "61ebf9d7-28cf-4418-b562-8625fd4dd28b", "value": "T17395E109E2D452B9D1E2A2B1CE52C675CB337C4A5770A14B03F87D6B3F6F5438929B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773229206, "uuid": "b3ded9af-f797-4868-92e5-843b35fe0193", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773229206, "uuid": "e812f04d-626a-4f1c-a7f2-e6998a1753fb", "value": "49152:FgTbH94Yx3btqsZgTenU8U8+udvwLsykJ:i2QtqAADIv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773229206, "uuid": "7b4f6f6b-ec0c-47b6-9ec1-d98453ba9ec8", "value": 1908876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773229206, "uuid": "45d4f760-13c1-4267-9689-bc91c9875fdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773229206, "uuid": "3ead7a2f-0fd3-4505-80e8-8c542f6ba3ee", "value": "x64a92d23f6efcc17cdd3016a52e0503a13350f037785.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11fe1c5c-1d7c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773255414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255414, "uuid": "53bc904d-5fbb-40eb-a3bf-9cfc4e2a5abb", "comment": "Malware payload", "value": "c9c6d72ee6da8c2f4e3a1aa505e6fd64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255414, "uuid": "3b1aec88-2a22-42bd-9f05-2eb56eb29cce", "comment": "Malware payload", "value": "65e37468d4466f5775b82269f74cfa6de5f54e4b338588c4c6c68fa45e009698", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255414, "uuid": "b58618eb-d2ee-4c7e-8b48-f559473160c4", "comment": "Malware payload", "value": "6a87e26ed40f5bab37ce7c7784d1ab4629e7f397", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255414, "uuid": "681889a7-1cfd-4c53-9019-c5ccce4a1a19", "comment": "Malware payload", "value": "90fca8eb3cc72450a8319b8488bf350995d7ec6aaf78d266c67b9c0b10e63c00880625ec46872e7d92b3571db1d4d7ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255414, "uuid": "69a6ae12-3cac-4840-b890-b469278ffd0a", "value": "T11A767C07EC9595A9C0EE923189629252BB71BC485B3023D33F60F77C2E72BD46E7A354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255414, "uuid": "cb878b0d-6b3c-472c-b016-70f86db6ac5b", "value": "98304:tq9W6lcUJFqqEWEhl6HM6XktANC4DFSF/IDy+mMK53aY/lQ:ucUJFqthECYS1F+PKIY/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773255414, "uuid": "c30e8463-1541-47db-9d43-45f5cb14554f", "value": 7315868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773255414, "uuid": "e93d29f5-05bc-4730-86cd-1c2b19e905e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255414, "uuid": "4922584a-8bc3-4ba7-b236-df6bf92ee756", "value": "cnctest", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffface98-1d6e-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249800, "uuid": "b4a12d22-6a24-4d0a-a459-50909951e326", "comment": "Malware payload (WannaCry)", "value": "a37d2c48a43fb29df5e1a1444ca7c33c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249800, "uuid": "5428a1af-9056-4202-8094-0f9a7301511d", "comment": "Malware payload (WannaCry)", "value": "65ea8566229a3574811323d9f29caaa26df976daaaec2b49caee33d1ce759875", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249800, "uuid": "0f2388bb-25ab-480e-87f0-c1499fddf64b", "comment": "Malware payload (WannaCry)", "value": "49cd0eb8a85a79746d6f1978ebd2b297aab552dd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249800, "uuid": "b87fac18-d428-40d6-8bf9-8afe6b75cd73", "comment": "Malware payload (WannaCry)", "value": "9a11c0aa7eb56a63a828ed3c5d3801de6480eb8b861cf8b025b6ffa21bc46d6c8a45f67f3ef9a94a29a46f443d9523f8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249800, "uuid": "e3d79e7f-0045-4488-bda3-0e27645b2573", "value": "T1983633A5A23CE2BCF1050DB44463C927A7773C6567BF5E1F8B9085660D03B6BBBD0A42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249800, "uuid": "97282af8-4883-4a75-8d19-89b996ad8b62", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249800, "uuid": "87fc8360-c83a-480a-bd04-9285f2fa86ab", "value": "98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yA:TDqPe1Cxcxk3ZAEUadzR8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249800, "uuid": "8fe65676-a0dc-43a2-b638-1dc992bf6722", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249800, "uuid": "674f0184-820c-45d9-8657-a2a2527871d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249800, "uuid": "1aa93a33-7455-4c6a-8710-87c518d03d69", "value": "65ea8566229a3574811323d9f29caaa26df976daaaec2b49caee33d1ce759875", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02d70606-1d74-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773251952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251952, "uuid": "40e113f9-459a-4d8d-9385-5334a7b57e17", "comment": "Malware payload (WannaCry)", "value": "6b5a9da099c8dd5b63a63c01c0256210", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251952, "uuid": "3cad167f-2b33-4466-9355-dd773b7a1673", "comment": "Malware payload (WannaCry)", "value": "67787992efdeba0523cd2d4d2a61903473e74430ee8e82b25d55fe1ed7001440", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251952, "uuid": "6bc91087-55b7-4f3d-869e-53b6b8b40df8", "comment": "Malware payload (WannaCry)", "value": "6cf798c80bff0d7131b26a3d3c6b8a69fdf6d5b1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251952, "uuid": "954de586-6aab-4923-b954-e149eaa2071e", "comment": "Malware payload (WannaCry)", "value": "f83ba20501dda66144d76c3d8499fb05539253703284f072283399db54424d09446e67abcab0249c2324505c17b3e123", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251952, "uuid": "d24dacbe-1461-4261-bf87-ee35d0e7e530", "value": "T1AA363390B62CA1FCE0950AB85463462973B73C69677B8B1FDBC083660D03B96EFD4B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251952, "uuid": "163df071-9c67-46c4-a78c-82c92803da39", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251952, "uuid": "020b73e4-749e-4d2a-bb2d-680ffea1ce3e", "value": "98304:gzqPoBhUk36SAEdhvxWa9P593R8yAVp2H:gzqP3k3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773251952, "uuid": "2405a921-5e0c-401f-ab17-74d0e5d00852", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773251952, "uuid": "998d84dd-9449-4ee6-b06e-c6bb32b48f47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251952, "uuid": "86c1b68f-b564-4930-8d13-917d3c4940c7", "value": "67787992efdeba0523cd2d4d2a61903473e74430ee8e82b25d55fe1ed7001440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d61b5bd5-1d19-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1773213222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213222, "uuid": "0f501003-bc60-4755-a755-514d16618f39", "comment": "Malware payload (GCleaner)", "value": "dc9ce671275e188dd3d15deddb98f9e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213222, "uuid": "83bf6bdb-6d46-4c58-b03f-acf3dc149f51", "comment": "Malware payload (GCleaner)", "value": "68b2ba043b5c693aca54c6ee5a41009732676ca07a4ff2c4c33e1c681b795833", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213222, "uuid": "272d513e-e064-4e73-8b44-b4a0612033f2", "comment": "Malware payload (GCleaner)", "value": "72add7c365b27cc59aa8a4abe60d4753ed25901f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213222, "uuid": "69990fba-0d70-4e93-977b-c9839f9ab7e2", "comment": "Malware payload (GCleaner)", "value": "81deeb3264789e29499fc6f2a761c13f1bf09a929bc8e1a77496febcfe5b5c2906dc333a3c68eeb8a3022768b67fe032", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213222, "uuid": "15046522-5097-48e1-b5e3-90859877483c", "value": "T10F158E32E2B15437E1622A789C5B637CD426FD03ED2A9C4F6BE55DC81A392417C263B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213222, "uuid": "9e051053-5a24-43a3-9c8a-4e9da255a1f4", "value": "b4f23b226dcba875353fef47ef080ee2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213222, "uuid": "0575132e-f750-4ccf-806b-e018a06ef14c", "value": "24576:xN5C3tVVSbjhj20Evgfls7eoSno986CO6:xDC5j0E1SMp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773213222, "uuid": "ae58a810-ce09-4e60-8548-95c88d5e4b94", "value": 876032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773213222, "uuid": "3818feec-43c2-4d59-9f7a-76773abf75ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213222, "uuid": "a622e85a-31df-450b-acb0-3366af062049", "value": "dc9ce671275e188dd3d15deddb98f9e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d72dc2-1d90-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773264119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773264119, "uuid": "33c82ad0-d30d-4dad-9f22-a2764d483ea1", "comment": "Malware payload", "value": "aa23921ab098315112d5ed2874886c83", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773264119, "uuid": "3282e07b-516e-49bf-a400-09e43daccfe0", "comment": "Malware payload", "value": "68b9ebbdad21e0b94c958fc1cc1d23dcc43429ea254087c3fb30ad9901d65915", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773264119, "uuid": "dac648bb-21cf-46ca-bec9-0ee2a3b79655", "comment": "Malware payload", "value": "1aac9ed1916209b3148bc6a0309d6ca2e628a2c1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773264119, "uuid": "9b2581e9-b9b2-496c-beee-9243c86245af", "comment": "Malware payload", "value": "9d8ccba2d8834fa9714fe1d86294eeb59a27f6132136b9c0f4fd0708b1a974aa48cfe058e2580f4a548a3491c2665778", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773264119, "uuid": "aecb4ec3-afd9-4379-964d-4045cfff823c", "value": "T1A7F47B47B9C70DF5FB2B4A39C45EA60FA77DA0845B60CBC78B294AAA59337D020357C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773264119, "uuid": "f8e70f7c-8325-45c1-bf7a-c78cb2252313", "value": "92d0bcdf910414677abafa7e91a4c9c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773264119, "uuid": "f0f43087-f228-44dc-838e-a6d4e5e4a1bd", "value": "12288:55pypv3YhJvhWWkPufpTVNLIe9RA3a4IKZbCNZbNE3Du:3AIhhI+fpT/ET3aY9m36C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773264119, "uuid": "0282444a-566e-4bed-9696-382af7aa66c6", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773264119, "uuid": "730d5d6c-0c62-4955-aaa3-f37a8ade7e90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773264119, "uuid": "a2977792-35be-4527-9cc9-780e81f04238", "value": "SecuriteInfo.com.Win32.MalwareX-gen.66985111", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4e2f4e-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217927, "uuid": "5970c593-d588-40cc-8e3f-b43cd6f8d895", "comment": "Malware payload", "value": "3873ecdb6f8023e4a59fdca83d43d81e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217927, "uuid": "4c7530a9-730d-4529-b8fd-b474de69988e", "comment": "Malware payload", "value": "6944f3ff1de239c94e1433e84e4fa9004c68b68c7a458eb3f16345d09e945165", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217927, "uuid": "ad08e611-2acd-4e1b-bad4-b5363aec57fa", "comment": "Malware payload", "value": "c0c29cd9e0fbab317697e9617da2f71ad47b9be2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217927, "uuid": "2d781bc5-9a3e-4e94-86a0-b9a25f916e46", "comment": "Malware payload", "value": "e9f6688b6fc55ec9646798a87339dfbe8f039b012a4eddca2be372d4f98f2f8369c641ed0483f1848ded9a11a26d2b2e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217927, "uuid": "b8f1585c-a80a-4da3-bd9a-ae77b923aa8b", "value": "T1BB537232C68BF5AC4EA9BF31BB07AF43C65A9760B42C30D3A63591CDA68774149C7312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217927, "uuid": "89a08e5c-9ec6-4a67-9515-c1c9583d322f", "value": "1536:mjg2faix9zg1ABo48fizPDBDQN0O8CfMRZq+02Ojfn4ZghPzVp2Kn0a46PkcJxhb:/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217927, "uuid": "be2ec900-8e63-4a90-b8a1-af565b89e02a", "value": 61287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217927, "uuid": "fb37df7d-2b5d-42db-a2fd-7517d4a08c83", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217927, "uuid": "ad608429-73c4-4b06-bf9d-31fcf6d371ab", "value": "3873ecdb6f8023e4a59fdca83d43d81e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19bd2f62-1d21-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773216342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216342, "uuid": "37aa168a-8816-4d45-a7cf-66f94bfa68d5", "comment": "Malware payload (ConnectWise)", "value": "4efdbb15eb8b95bbf916ef5789fd7f2a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216342, "uuid": "5c98fa8a-c87e-4bc0-b70f-d0812703e75b", "comment": "Malware payload (ConnectWise)", "value": "69a16f5949b183de2eb06686ab5588d50e711ba80e8af95bdaccc2dcd0355b2b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216342, "uuid": "13e79dee-2070-42dd-8e63-00df919aedfe", "comment": "Malware payload (ConnectWise)", "value": "18045286e9d6d0de1945027f913d5530404e401c", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216342, "uuid": "e8defb75-57cc-481a-9b83-0a56980ed96a", "comment": "Malware payload (ConnectWise)", "value": "10c865dcef5c3eeed51b2d918a9ffa91db145fd3bbce911a6fa197b34ab9c26907fb52576abe28ebde9337d9337a4441", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216342, "uuid": "8bee943b-97c9-4fa3-b497-9885cbd297ad", "value": "T1B73152DFAC06D371453286A3A37B6D3DDBE59117755080A47E11D98A4D304FCDB6C06B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216342, "uuid": "32f5215b-58a1-4722-a2e2-6fec1d75ee98", "value": "24:2puwAop5BhDSP39WynUd3F6Ys4gAZubY8oKkQhJV3m3kaWI3ISXIROML0AHL980e:2puwAof9eZYs47ioKLJMWIYT0AHO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216342, "uuid": "b2564012-a335-4c0a-861b-0bd7d4b8ae6b", "value": 1691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216342, "uuid": "6f7fb92b-dd09-4ff4-9ddd-7c9db8477f76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216342, "uuid": "151fbd53-b30c-4832-8a3e-a06e1b647df6", "value": "AdobeReader_installer.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "222c67e2-1d1f-11f1-a769-42010a9c0008", "comment": "Malware payload (Fuery)", "timestamp": 1773215497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215497, "uuid": "9352fd36-0e77-4fb5-8a10-c5cbb7241426", "comment": "Malware payload (Fuery)", "value": "cf7c00f102d4c6950a9896a6ee7162bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215497, "uuid": "6a8b007b-a479-431b-92a7-92f99deac7dc", "comment": "Malware payload (Fuery)", "value": "6a961af4e35488055057fb199555b02b135f81b8eca22d1b500d13054aaadb63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215497, "uuid": "6a46afdd-ff49-49a3-b3a6-f80c2f5a046d", "comment": "Malware payload (Fuery)", "value": "8fc9e0c6e8a0e4193d6369fb5563540b2dee2a57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215497, "uuid": "817297d3-a262-4ef0-98b3-708c0c2e7501", "comment": "Malware payload (Fuery)", "value": "08133f5204b36ae387466addd60656345a871bb206a036a2c9fecd94b5fb049d9cf68616977fa2481d1516e727842ea8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Fuery", "colour": "#5C56C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215497, "uuid": "68702d5d-2ca3-454f-8faa-311fdb266987", "value": "T1F5854901FEC744B5E906273269EB22EF2374A8090F369B97DA407A7DF9776D60932305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215497, "uuid": "d0ea88f2-5f22-448d-ba00-17c76d1b6fa1", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215497, "uuid": "38bc4099-0588-465a-9e0e-933719a50c68", "value": "24576:NGb+1l97xc6Ht5DecD+HcLxBZllWAFhOhgjgcdEPTlpepyFD:NnFp9xV3gcdaTlpsy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773215497, "uuid": "fbe883a7-5c5c-4c01-92ba-0da4b380d931", "value": 1826304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773215497, "uuid": "30e3244f-022f-47fd-ad9b-35d17c4ed3db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215497, "uuid": "6c5ca974-83ce-448b-bcc8-49cb22533d87", "value": "b1JNsvy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c87ab84e-1d43-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1773231238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773231238, "uuid": "729ede0e-79ae-493e-a316-6fd759556457", "comment": "Malware payload (Phorpiex)", "value": "3f4d6d5e5dca0759c31e0ef945331087", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773231238, "uuid": "c89e92dc-603a-4f47-8c57-7a749e9c25ce", "comment": "Malware payload (Phorpiex)", "value": "6a9abdb273d46783f6d81f91e60a8ed7c2f55385ef5cb0743a6d98d8b2aa5ccb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773231238, "uuid": "56caf42e-5574-467a-b9e5-9dad44f19ede", "comment": "Malware payload (Phorpiex)", "value": "0e4694cb158dbf996586a8886e5e229ebe686be2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773231238, "uuid": "04bb7370-5cdb-419c-92b0-74a703542575", "comment": "Malware payload (Phorpiex)", "value": "0ffc6dcf171ad6f5fb9f8b3786b372de09275f4166a220826d5be6491c524962673b8d084461f6ac6c33140dcabe54c9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773231238, "uuid": "bafbd867-d3a3-4de5-b99d-553bcaa7f8b4", "value": "T11F823A0FB9814227D1D100709A62967BDA7CA47237D854DFF7904AEE1B686D6F83314F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773231238, "uuid": "ed68bd07-5648-429c-adb3-665e9c35d3dc", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773231238, "uuid": "09b3e57d-cae6-48c3-914c-1cb15068df24", "value": "384:p0kGIUVp9ccgXwHBb0uZWXND6av8U9c2i4:1Eicl0uZK8a0Ul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773231238, "uuid": "e40cdeb9-c55d-4f78-9bc6-6d873a627f7d", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773231238, "uuid": "654845da-c1c0-482b-a42c-cc852967e006", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773231238, "uuid": "54c27de1-e461-4301-a521-40fcaeced3ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc1d65b-1d70-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773250410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250410, "uuid": "a89aa9c5-dc64-4649-8f50-62cde743a1e3", "comment": "Malware payload (RemcosRAT)", "value": "87357533f5c9d5680e0da8b88f504626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250410, "uuid": "baff6b86-e1ed-4b84-815c-a8fcf5be57ec", "comment": "Malware payload (RemcosRAT)", "value": "6aa18520f34349f6dedf94181ad75b901f1ce2e3da1814d079a1a0618f5ec3b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250410, "uuid": "ff741c7b-5951-437b-93b0-049e2fa55246", "comment": "Malware payload (RemcosRAT)", "value": "773307b1ab6ea05c358f41b2fad8907d9d9e16c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250410, "uuid": "6b1038f5-f04a-4e3b-9c56-09cabd0d5221", "comment": "Malware payload (RemcosRAT)", "value": "33017321a13eee815f36eba7e0c8e6db6c680013a7947398cf186bf9eb169ec561ed3a7f7da17d38f7491d22d4ca8b00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250410, "uuid": "59ef532a-ca41-475d-950e-9718430d560d", "value": "T158B4BF01B6F2C172D97664300935E774DEBCBD201836997BA3D61D9BFD30190AB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250410, "uuid": "dfa5f676-2725-4230-800a-29319cf2f3c1", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250410, "uuid": "ca8ff1bb-f1d5-468a-bcce-eb01fa6a136d", "value": "6144:GXEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZlAXiBcew:cENlHV9FGeDWv3jADnyYiCNrsPZlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773250410, "uuid": "96e97e25-f606-4538-aabe-ce9d0db68e44", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773250410, "uuid": "5c1b6b00-7983-4549-b951-2bc8dcd60eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250410, "uuid": "a23a27f8-c3b9-4b3c-8f56-9b571a806086", "value": "remcos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de19896-1d74-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773252051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252051, "uuid": "8a5908d2-f61d-4f49-a804-6d51660c9306", "comment": "Malware payload (WannaCry)", "value": "0ce717b7017066eb098170421ffd705e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252051, "uuid": "a2f2e78a-dfeb-4a2e-8388-0893740d4fbf", "comment": "Malware payload (WannaCry)", "value": "6b23054db140a57b6a262f6022fa92c2dc18410158a2af4a0416e1a571360497", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252051, "uuid": "be0665dc-4938-421a-a0b3-bc359513b392", "comment": "Malware payload (WannaCry)", "value": "05be72c2f3a8c9679432f1b35302226c7eb41142", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252051, "uuid": "d232fccc-4a5e-46d3-bdd1-50a5f589e6c0", "comment": "Malware payload (WannaCry)", "value": "7cfc79832a8bc3a858eecc6e78890e11bac332494d3f8fd4049584dc93b081e291900e4b674c1da3e59f782e1ea7c23e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252051, "uuid": "09d8c601-b97d-4c39-9050-0b6a5b12560b", "value": "T17436A611A5E86B14E7F35EF626BA9710463A7E898857D25E0225710F0C33F1CDEA2F2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252051, "uuid": "5992d79d-c80c-46c6-adcc-eaae6d09a967", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252051, "uuid": "0a75505b-5350-4a27-8c1d-e8e72302f674", "value": "24576:JbLgdeQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626Wo/Gs:JnjQqMSPbcBVQej/1INRAW+Gs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773252051, "uuid": "4acc9269-7788-4559-88fd-fcf4d985fea5", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773252051, "uuid": "924c2e28-8648-42ac-bd0f-40e3842bb39c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252051, "uuid": "c7aff804-79f8-4d61-bbc6-549a0d3dbdd1", "value": "6b23054db140a57b6a262f6022fa92c2dc18410158a2af4a0416e1a571360497", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d27090-1d57-11f1-a769-42010a9c0008", "comment": "Malware payload (PureCrypter)", "timestamp": 1773239527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773239527, "uuid": "c1b1081f-e8ae-4df0-b97e-40a0b0befda0", "comment": "Malware payload (PureCrypter)", "value": "168c2732e0b38dc5bed4f86d503e1035", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773239527, "uuid": "ac1d4019-196e-472c-a032-e790dcf35952", "comment": "Malware payload (PureCrypter)", "value": "6b60813635717e89b5c122b1607d45c8730ddfae86c4dbff7f625328082c8ea8", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773239527, "uuid": "04e40cf1-a998-4938-b2d1-a0f7ae371ff4", "comment": "Malware payload (PureCrypter)", "value": "2fa08d52f17c7b85c68cb4198db6e765badc1ec5", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773239527, "uuid": "5787d6c1-139a-4de5-b259-d3e4809a6281", "comment": "Malware payload (PureCrypter)", "value": "ed02b8982e1d1d6e89f4cff96d10d06ac02ef2c9e598272c82b67a9912cefd4face20fc2f67c7346bb34522e507ebc22", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773239527, "uuid": "232b993c-0713-491b-9ff9-b51ac67d1121", "value": "T1AFE6333B18D289B4D3295BF3EB469258619CC94445A0C5E7F38AB2DE07BE8D34D2F1B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773239527, "uuid": "de0f7406-6d23-4503-b873-92766b98dbb1", "value": "393216:CSUBVthwy9I07sOy1ZFVlXu6zfapSNcicm9aMcdXkkkNO:YBVthwD07sOQZFVxTcm95cdx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773239527, "uuid": "78509b45-7656-4315-939a-37283412c0cd", "value": 15247360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773239527, "uuid": "62ffecde-9614-40af-b9f1-5ebd53595080", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773239527, "uuid": "b26fd71e-3de3-4332-9d13-67594bd222b3", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a60ec552-1d64-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773245354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773245354, "uuid": "5f13d2c7-c4e1-4bb3-8a31-f564c6365e58", "comment": "Malware payload", "value": "d68871fb7a4dd5c6bde1e4b7986e9222", "object_relation": "md5", "Tag": [ { "name": "BadPaw", "colour": "#7D4010", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773245354, "uuid": "a2e4b916-f238-437a-9e11-ac18fdb2fbfd", "comment": "Malware payload", "value": "6cad470e10c09151b5d337a082a088cfe25d697ef295e02759e1e68e8b3bbbcb", "object_relation": "sha256", "Tag": [ { "name": "BadPaw", "colour": "#7D4010", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773245354, "uuid": "c368a73c-ae7b-4a8d-8cdc-a35c25af9ba1", "comment": "Malware payload", "value": "a378db27df2dfed4172dfccd18bbb580a4b5cec1", "object_relation": "sha1", "Tag": [ { "name": "BadPaw", "colour": "#7D4010", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773245354, "uuid": "daadfa78-753d-4403-9701-96501497009a", "comment": "Malware payload", "value": "fb08a4cf8bccb393e5e42b5c6bf1e577e49b3048b15c8312183c2c34441634e543d39334cc89b4bcd323e5116434c4c9", "object_relation": "sha3-384", "Tag": [ { "name": "BadPaw", "colour": "#7D4010", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773245354, "uuid": "ae4b6c89-d272-4bad-a6a0-f125bec11287", "value": "T102F33B2E76944F12D56469B9C1E3C93407E3E9877733D68A3F0826DA1F113A4CE8A7C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773245354, "uuid": "f5743f4e-a843-46db-bb5f-582514928280", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773245354, "uuid": "f872c6eb-af9f-49b7-beac-80b9974624f4", "value": "3072:4pRW9WlYP9C1GQmxYWODKbXBhWOmGHLOM0NWcDXsk74:myWSgwQmCWODKbmWjWr7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773245354, "uuid": "7753b517-cf67-4119-8cb9-234ebdc3ef95", "value": 166912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773245354, "uuid": "feffefd8-3468-40ac-939b-c5d34169ebed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773245354, "uuid": "97e25e77-9506-46cd-93af-e6e7a748c0f4", "value": "6cad470e10c09151b5d337a082a088cfe25d697ef295e02759e1e68e8b3bbbcb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82413437-1d20-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773216088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216088, "uuid": "8ed3796c-49d6-4685-b9a6-8cdb2e491218", "comment": "Malware payload (AgentTesla)", "value": "eca6d87e4e948128f109a06cd0082e42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216088, "uuid": "2c1fa462-1a15-40f9-b845-5eede82e8c7f", "comment": "Malware payload (AgentTesla)", "value": "6cfba064bb55d51917b93d5850c0ed845bcbcc68857d9ce0dd77ad63e9d90dcb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216088, "uuid": "bf27bd93-9747-4f6d-86df-0356da3f4ff5", "comment": "Malware payload (AgentTesla)", "value": "f503af7b2acc031cb3295c8fec23c1f8737effaa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216088, "uuid": "181fdc76-3d28-4216-960a-a279f2738f35", "comment": "Malware payload (AgentTesla)", "value": "7b23aa2359d9acedf3b55ee6642c3b54a600b90cb2ca17427a533b9a67353cfb1e8bed9821d44119e9452089897087c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216088, "uuid": "7614f049-8c0d-4d7d-995f-ac5bc9869e3f", "value": "T1DD559E714D99BB2ECB022F2AC8EC318E86F529908BB7354582331949DF5E5C1F57A273", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216088, "uuid": "de1ee6a6-351e-4b66-9dc6-75e13082d35c", "value": "12288:2OXwb4fPmv+woIxBlTuS3cxQXeKQO7bhdF+u6gzU/BlQYKg5SJku:2Q32M/q1+hgz4XveL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216088, "uuid": "2894b043-fbf5-4956-9c0a-ade9d87bb297", "value": 1341355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216088, "uuid": "bd79e043-3796-431b-a794-dfbc0e31da54", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216088, "uuid": "95dcde25-33f6-40fc-a3a6-132c5ff8ef75", "value": "eca6d87e4e948128f109a06cd0082e42.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22358eb5-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773217645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217645, "uuid": "f13f29ed-3062-475f-a5d5-b5c383eed5f7", "comment": "Malware payload (AgentTesla)", "value": "8265325f473fd1a78ceb79b27b5066f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217645, "uuid": "f11cbf0c-2b39-411f-a238-be37fec484f6", "comment": "Malware payload (AgentTesla)", "value": "6fd94735cc14b05e30be917b68b8957b3f3fb711cfda0202e401e5ad41d35bb3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217645, "uuid": "e7c6b4fc-fa33-442f-93a1-dd5dc5852f22", "comment": "Malware payload (AgentTesla)", "value": "1dbd6cfde3b631bb672eaaa9475410861a474ea4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217645, "uuid": "10412949-bf17-468e-8b2b-cec0a3a2a48f", "comment": "Malware payload (AgentTesla)", "value": "4dbbe236440ab3039b71bf6a936acb0fdbcce7dc19c36f0b878dc1144eb18295da26a7c4c38083cb90da115b761e886b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217645, "uuid": "b288536b-2e19-4fa8-a750-d3b2e592304a", "value": "T100558E60EFB069ECA6A1DD23F27D42445341924A8113FEFAFB1926437EEBB44570B44E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217645, "uuid": "27822c01-4e93-40cd-b34b-50eb4648a8a3", "value": "24576:8DNxoG/7IUu8C+WBwHVnaMGAdRvsRyClqj8Pv1QRhxC:u/sU/e6+AjU/qj8Pv1QE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217645, "uuid": "2e9fdf15-61bc-4326-acbb-78ff9e05676f", "value": 1343204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217645, "uuid": "dbaaacf6-abd8-4fe9-b6af-b4cd6d977f68", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217645, "uuid": "3b7e698a-4085-4714-9cc1-acdcb502374b", "value": "8265325f473fd1a78ceb79b27b5066f2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cab1b21-1d99-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773267967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773267967, "uuid": "11443c80-313f-425d-8e72-1f13da25b192", "comment": "Malware payload", "value": "bb8458f8d585f44db2be68429c3971af", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "download-sefazemissaoweb-com", "colour": "#C5EEB5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mt5-sefazemissaoweb-com", "colour": "#E8BD33", "exportable": true, "hide_tag": false }, { "name": "sefazemissaoweb-com", "colour": "#411D8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773267967, "uuid": "c31c2b35-15fb-4fe5-bdc6-595d94567893", "comment": "Malware payload", "value": "70532acb7cc38d8c0573a463cba94da9ada2c6464836eb0bf3a53a4a0f1372a4", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "download-sefazemissaoweb-com", "colour": "#C5EEB5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mt5-sefazemissaoweb-com", "colour": "#E8BD33", "exportable": true, "hide_tag": false }, { "name": "sefazemissaoweb-com", "colour": "#411D8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773267967, "uuid": "b23a0a9c-c3bf-4e65-86c0-4e05a65889bb", "comment": "Malware payload", "value": "20b5b08f99c1e36e461e4e2ddf7bb424b5643a09", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "download-sefazemissaoweb-com", "colour": "#C5EEB5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mt5-sefazemissaoweb-com", "colour": "#E8BD33", "exportable": true, "hide_tag": false }, { "name": "sefazemissaoweb-com", "colour": "#411D8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773267967, "uuid": "481a6709-735c-4635-af78-1b6d2aab1a8a", "comment": "Malware payload", "value": "8873f4a237838ad76689f580c0843bf49d18a2dd46360e3b04e45a4ec02b366c6493c29b0d82145a2214ae043bd3a40e", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "download-sefazemissaoweb-com", "colour": "#C5EEB5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mt5-sefazemissaoweb-com", "colour": "#E8BD33", "exportable": true, "hide_tag": false }, { "name": "sefazemissaoweb-com", "colour": "#411D8E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773267967, "uuid": "0fe9ce58-846e-47db-bd99-4eb828ae25d6", "value": "T128A64B026F9A58A9C09AC870C74B8A675F2130DF1776F6AF51C112962F7ABB07F1D318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773267967, "uuid": "4d80989e-8389-4ecc-ad70-30f22745a111", "value": "60fa1e4659937becb11853211e62cd42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773267967, "uuid": "a033df78-9264-4b8d-999b-e771d9e1902a", "value": "98304:jgul8O7oYbauUrGJXe9mUGqvQRVbP3z3VZLCekG0n+TEG2j4:f55xUd9vc7zFZLCekpm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773267967, "uuid": "8b3e9610-e632-44a3-95ec-b4ceec642ea1", "value": 10194432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773267967, "uuid": "4dc81e46-145f-413a-9960-36919b41b6bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773267967, "uuid": "9f704a0b-c540-450f-8a51-fdf424506a6f", "value": "libcef.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b83ec42-1d43-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773231136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773231136, "uuid": "49fcb106-a272-4eca-a9e0-0d068b3228e4", "comment": "Malware payload (AgentTesla)", "value": "d5f39ea321bce32918095668b87e04c3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773231136, "uuid": "eb492186-386b-48c4-ae11-bc7835f10497", "comment": "Malware payload (AgentTesla)", "value": "70734cd5302b7101ac987a36e54df5e692b1d01241bc0e27aa89b27ba1c1325c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773231136, "uuid": "50af41c6-0678-47f8-b993-52cd0d687f9c", "comment": "Malware payload (AgentTesla)", "value": "93b0a17e173e31f0169ccb8a3755224532ebf16a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773231136, "uuid": "d4b57c2a-2dbc-4649-aa82-9d9325b702a9", "comment": "Malware payload (AgentTesla)", "value": "01ffff3a49b96bdcd2af1aa9f4b8046fbd777902427e05e790fe362544e65fec88f7f18042b4804159a4b1a1d3541a0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773231136, "uuid": "cc642435-6cf7-44ea-b5b5-274f49ab3be2", "value": "T1B40522213E1CF4A7D96029B3159585D24B223E6627D1072F2322F76FA563283670F7FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773231136, "uuid": "a564465d-857d-4a2d-aac5-813be2a78c51", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773231136, "uuid": "4818d95b-7d00-454d-848e-ea22893cd3d4", "value": "12288:oMwXFVoY6rDWVMAsIAp485e7cN1PamQOgifXZk0ofPwi/kFn2lbiuVjR6Nbl+xq:oMwsY6XOQb5e7cNSOhofPwixb+Nxiq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773231136, "uuid": "d07a27f3-c9b6-4458-a100-f863dcba0088", "value": 843688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773231136, "uuid": "5251656d-d95e-4545-901d-14b7a75ec5d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773231136, "uuid": "2405c882-3a21-40e7-9f6e-d73159c766ab", "value": "MT103 Xerox Scanner11032026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862c42cd-1d2a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773220390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773220390, "uuid": "33224eb2-55d3-4e8a-8c44-e48158d2b933", "comment": "Malware payload (Mirai)", "value": "1647a598401616825a323005baecaf6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773220390, "uuid": "d22882e0-ea37-4abe-be74-90884b9661b4", "comment": "Malware payload (Mirai)", "value": "724930d0644542e600a23259b1a6d3cb12de34b68d3bbbb46d479048974da3a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773220390, "uuid": "760d5b87-826d-475b-be2d-38460e17f99b", "comment": "Malware payload (Mirai)", "value": "23139df8ad96e71f863be422abefb80233f61a82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773220390, "uuid": "84f586b0-1be2-415d-879a-50ad0a388cc4", "comment": "Malware payload (Mirai)", "value": "96d446c56e6c7c906a43664562e976cbe8110c16ad4958480d1fea81545c60347e9e530aec8e144882bc2aaa46bf58da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773220390, "uuid": "c9690dae-54f5-4fc6-94a1-f1c1ce4307f9", "value": "T10124861E6E228F7EF768873047B74A31A76933D626E1D644E1ACC1105F2439E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773220390, "uuid": "c836df61-3c9f-4d01-b911-f0c56427d1ef", "value": "3072:9XcA5jKo/9WgqX39F5kiNkRtMCJuTe++4lxc:9XcA52o/9WBXSikDJf++8xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773220390, "uuid": "83388758-b85a-4861-ba52-4d227d8aad41", "value": 209404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773220390, "uuid": "a67ff534-7004-4111-9bf1-65fbb8de249a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773220390, "uuid": "75e2d140-fe18-4699-9c6a-22b606cb1b0d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e69e273e-1d6e-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249757, "uuid": "122023ac-b2ca-478f-b0c1-4ae6df04f3ae", "comment": "Malware payload (WannaCry)", "value": "dc39340c42b5b9ed517c023d9cc130f5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249757, "uuid": "94098c5d-09fc-4284-95a0-99e2956ea6ee", "comment": "Malware payload (WannaCry)", "value": "733a09e8bc0b599dce6637508e9464718f4455f7b77dec412e54c36905e13348", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249757, "uuid": "0a21ce0b-684e-4486-8081-218ba91f6a6b", "comment": "Malware payload (WannaCry)", "value": "20db8871efd08617d3c729a4ff7d5f15a99526f0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249757, "uuid": "a9fa7dac-8a89-47da-a267-e73d7a7ff6d4", "comment": "Malware payload (WannaCry)", "value": "5b647bf4a5199743b984ea8d17e025905aa61a061add77d69c4b9057cf444d118c1d1d4cec53edcbb20b3bf52ad6286f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249757, "uuid": "110b3baa-aac7-4ef4-a33c-4cd7783b2212", "value": "T1F6362388366C91F8D60A56B4A4738E25B2B37C6921FE470FDB5087221C13B91FB64F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249757, "uuid": "18be5434-cdda-41c2-8d88-a88c85c4863c", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249757, "uuid": "0d2aeea9-1b7a-4ea8-ae48-da3c9ff30a63", "value": "24576:RbLgurishfdmMSirYbcMNgef0QeQjGuRdhAdmv:RntqMSPbcBVQejuRdhnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249757, "uuid": "3fec2c87-8415-4493-be5c-b37ba3bde3d6", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249757, "uuid": "4f871c82-c7e5-4099-822e-0d1ca64a23ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249757, "uuid": "2f8d960d-2943-4aa7-8aeb-77a8a0c752a9", "value": "733a09e8bc0b599dce6637508e9464718f4455f7b77dec412e54c36905e13348", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b4525ee-1d8f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773263777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773263777, "uuid": "38c5cbd4-3efa-4869-9450-89cfc1a162f7", "comment": "Malware payload", "value": "710901b0b8a2894f9ff7a6f8754a2342", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773263777, "uuid": "4d8837a4-533d-4340-b92d-aaefeb02f627", "comment": "Malware payload", "value": "73801526437b53c9b5df8e7b59c70ab10e8e86fe44fb21e7ba017b4a6acbd4de", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773263777, "uuid": "cb7221ce-8c18-4170-b922-b4ca49594cae", "comment": "Malware payload", "value": "3fc03952ce9b4e0f0e643500d7658dfb953082e4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773263777, "uuid": "bd21a470-2fb8-4cac-bec6-aaabdbc90566", "comment": "Malware payload", "value": "3b0dc2b1707697dceebf8708aaddc539746527ac866d4811bdbca15e4471eeb070c54399fcdcf2b997910a70df1e1fc6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773263777, "uuid": "1bdf2af4-1eb0-4411-a57b-82aa04873418", "value": "T10F925CB512896C79FBD0CE39AF3C6F4DADE8C2C42124A3ACBA4F39215A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773263777, "uuid": "99adb3aa-1329-4a9c-aade-00a966fe87ec", "value": "384:JFcuQpWx+BL0SWL0gFzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:JF8i+BL0SI0+zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773263777, "uuid": "44e47f67-fc2f-47a9-923e-f8188760a62c", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773263777, "uuid": "86e62fdd-1cd1-4055-9e1d-656cef9575d9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773263777, "uuid": "6e23c881-d17d-474a-afc6-df1d22989dd3", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09398d04-1d23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217174, "uuid": "e652702f-04a3-4636-952d-0d85e3ab7040", "comment": "Malware payload", "value": "8436d49442e17ffd50d69cd1f6663d2b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217174, "uuid": "7ca0022e-c1be-4aab-b852-0dc6fa32d8a4", "comment": "Malware payload", "value": "76948f59b636edec1110800884b41d14b1a8899f44fe4f61b9160528e0593107", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217174, "uuid": "06517581-03a9-4f52-8729-4e08e8b01656", "comment": "Malware payload", "value": "97bf6be34ca4da4849ae439fff4622ac3b620af9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217174, "uuid": "090ef985-4122-42bb-84a9-3f537c7899fa", "comment": "Malware payload", "value": "898f0f7335aa109fef2fcf091ea2a2f31c0e37c515bafef41ee9c0e2d8422468270723d671e3a645e49f3566cf9c977b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217174, "uuid": "301f2bf6-24d0-4a05-a21a-781d05fb481f", "value": "T15D02F63B96E883A5452B4EDCB73C02DD3165CBA813267E204B4F9C27EFD1469CE39181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217174, "uuid": "c57f3739-e018-4aae-96b2-ae7f8d04d5e6", "value": "192:T8YC6+BVIPtrdeu63SsXcEa9PEUiqJHfQ7feHRgl6itlemsf:AY4Atr0ucSmcpPEU1dZRgl6oemsf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217174, "uuid": "1e3eab6a-f41b-4613-81df-b776e9465a7c", "value": 8299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217174, "uuid": "8b20d7a6-f3df-4269-93a1-0b30cd15dc02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217174, "uuid": "db6bf16a-d69c-48e3-bc23-8a91bdbb47b0", "value": "8436d49442e17ffd50d69cd1f6663d2b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2b010d-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217663, "uuid": "bb6ebb5b-4731-4921-952a-3cba95dafe6c", "comment": "Malware payload (Mirai)", "value": "f066f27aa3d2e725088b5aa45f5cf28f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217663, "uuid": "9a7f08cd-74a2-4f8b-b894-7939a3416ad4", "comment": "Malware payload (Mirai)", "value": "76cd5d88764ee08a5c7118b4e85ca3436848d364b6bfa7370d30ef8f2d4808ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217663, "uuid": "c7b6115a-cccb-41df-8f4f-c8a433e9ad3c", "comment": "Malware payload (Mirai)", "value": "8a3d7cf597498a4910cc139e1a269949d2163c11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217663, "uuid": "9c5ee589-dcdd-4850-943c-d2ea8ee7536c", "comment": "Malware payload (Mirai)", "value": "0d3b3167215c358dab41ac261a60192b10259f5fb7071592084a87a887767ed533311264c5708803e94c1e65b6fc2409", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217663, "uuid": "df46fbd2-cd61-4340-b443-fef430f22342", "value": "T17FA53350BA0075879DB2D70EB84882D13CA29B738FD6FBB46BE927113D3472B45D0E99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217663, "uuid": "28d8fc9e-de07-45cb-a376-5664d0bb91ee", "value": "49152:qjhHG63IXj/8Y1cMQxlvnFaaxfol0yUJxrxUrUoyHZEv2ykbrH2:q2TknxlvFaB0DxUUoGGv2T32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217663, "uuid": "a47b6941-95f2-45dc-99c8-8cb1320b862f", "value": 2131376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217663, "uuid": "86beb39e-2ace-4f64-93db-a44a9f2b8062", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217663, "uuid": "f16511ae-101c-420e-887e-ec75a4700490", "value": "ksnapd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2669db8e-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773217652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217652, "uuid": "8d55bc87-bac2-4594-91f6-1f32e955b72e", "comment": "Malware payload (Formbook)", "value": "af67942dbe82661c2e7f411f97a6f27e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217652, "uuid": "4304e2d3-bbce-46d8-ac97-7b2b633d6cee", "comment": "Malware payload (Formbook)", "value": "770165df1cb9509cd4a8b726d1132c0cbf0161d50ee2649fcd27bab024869a6f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217652, "uuid": "0c8118d0-370b-415d-8868-9b0c5d3fea4a", "comment": "Malware payload (Formbook)", "value": "543e237b278864c39399f90ae7707d47ffcfc894", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217652, "uuid": "7169ac82-7ad0-44d0-a7a3-66d982c3f87d", "comment": "Malware payload (Formbook)", "value": "1035835060fc7b69d02b5ad235d8ba27b7f7d02158f41d3c49199b771eaf774ec74bcf3e5c773f38de1924e1b34ddd28", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217652, "uuid": "ad3c830d-9b45-49ea-a346-12d433861ef2", "value": "T19A53E2E1B93796CB05BC077C5FF6C9115C0D606EC63651EAB22136EDEAE2C0629BC724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217652, "uuid": "9ce68132-626e-434d-984c-85016b5cff38", "value": "384:O+lANSrW5up8Pg/P03wOPJOZQeMHdh+zOxruh71xb/V5piFbenN9qxcI7myd9bs5:DEIBgmigXRz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217652, "uuid": "5d1aeeb3-8672-42c8-bc98-69f4e05d5ea9", "value": 61485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217652, "uuid": "1e2e7f48-921f-4470-9222-b22a6a686bf4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217652, "uuid": "dc302794-6d84-447b-941e-eea07d47b6ac", "value": "af67942dbe82661c2e7f411f97a6f27e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82633aad-1d56-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773239281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773239281, "uuid": "5e6283d9-02d1-4928-a69c-6fb736cf13a4", "comment": "Malware payload (ACRStealer)", "value": "66bf99c66d0b19c3a7f45d376a63e5ef", "object_relation": "md5", "Tag": [ { "name": "141-98-234-8", "colour": "#7F1625", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773239281, "uuid": "8497c634-26e6-4694-a6c9-09299fe7cebd", "comment": "Malware payload (ACRStealer)", "value": "77c243c3cec0fac1c789ad271bd09ba34109672a13ff96bc289c2a99fb68a76f", "object_relation": "sha256", "Tag": [ { "name": "141-98-234-8", "colour": "#7F1625", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773239281, "uuid": "d25630f3-40d2-46b8-81d8-a509def495a6", "comment": "Malware payload (ACRStealer)", "value": "81652165fae56d6a91e699cc93b5e7fa6ec5da1e", "object_relation": "sha1", "Tag": [ { "name": "141-98-234-8", "colour": "#7F1625", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773239281, "uuid": "d5e08076-e03c-4777-8de2-bc3617f16812", "comment": "Malware payload (ACRStealer)", "value": "0ca7b075e48f5074644303fa319baf020c53e0422dc0146cb1e04e9de2aaa4a7399eac0c16b933d08510a667fa49d155", "object_relation": "sha3-384", "Tag": [ { "name": "141-98-234-8", "colour": "#7F1625", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773239281, "uuid": "b94b9085-0e3b-4a18-9572-fec44774dfda", "value": "T1E38633C4D83C5D82E477EA74A6911780EFF546AA41B153A3C3A8A8F4BDCB2C50B5C61F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773239281, "uuid": "20ce75b3-e281-43ce-bf13-f6a217179349", "value": "98304:FRUVmtpugIpDfDYeKTe40DZidFKpGzeAQcR9EHyVx+8Lv6w5LrVhgybnP7I/tfSv:FRltpwpDf0pe40y/qfm3+GL5thgAPqly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773239281, "uuid": "4f087553-cc5b-4076-9ff4-e880cf771b9b", "value": 8433207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773239281, "uuid": "c501f1a2-1c2b-47b4-aef2-7374d5c84e34", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773239281, "uuid": "02d1e3a9-45ec-4877-bda8-02e735249bf3", "value": "Full Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8950867a-1ce6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773191189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191189, "uuid": "c2d396f5-eacc-40ab-93bc-013685489da9", "comment": "Malware payload (Mirai)", "value": "90eefc6b04f68b9272cc82200debfdd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191189, "uuid": "87958a7e-d00e-4be8-a2b6-c6a01aaed115", "comment": "Malware payload (Mirai)", "value": "7819509e1693d0fb4a35a95ab4b2e8adac2ad66c0e77a602c8d670eda66c0808", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191189, "uuid": "2cbe6fa9-140b-4914-b8c7-23491e2de923", "comment": "Malware payload (Mirai)", "value": "06c78201e4d516f1e87b4bcf9f70aec4a87fd84b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191189, "uuid": "b375d269-584f-4f27-bdf6-1360acfd46a3", "comment": "Malware payload (Mirai)", "value": "f64bc789f3a45a4766b2dc3078630d9883afe9c7bc319e3ce146bcf52e517eaf27b71b71c1efb9ca4c2a75bbf3a2b8e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191189, "uuid": "b1816994-40b7-467f-9672-f5537d7f0599", "value": "T11A834BD7F410DDBDF80ED77B4463490AB131A39219831F3A639BB967BC321943966E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191189, "uuid": "1bbd930d-8a4a-4d88-8e5d-d24e23586c10", "value": "1536:mEOAoGHPzE5HqZWaDX+aZ8oyCsFTNHFFaWonzs6N2uAQJSYh2a4rsvg:mEOAZHPWqcaDX+aTyCsFJiW6zsKAYh2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773191189, "uuid": "cde913e8-75f9-422b-9fdc-d199f9634d83", "value": 85804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773191189, "uuid": "3f853d71-2cfe-4ec7-984d-86996bd986af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191189, "uuid": "de6077b6-7e2a-47b0-9ba0-d7c22c21740a", "value": "pm68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f88cd6-1d19-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773212979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212979, "uuid": "bfe9e5a1-e134-421b-9b53-1990f706a65f", "comment": "Malware payload", "value": "7a7a99eee3855c2fe0fe0f5c20d0490c", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "TransparentTribe", "colour": "#862286", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212979, "uuid": "883af72a-2f5e-4fdb-99a8-5fe355392378", "comment": "Malware payload", "value": "785c48c170d677ceee0112f843d8959ff7b701866283c2e503451c96c82f63ce", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "TransparentTribe", "colour": "#862286", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212979, "uuid": "b39468c6-e30e-49b5-814e-606bc4bcd889", "comment": "Malware payload", "value": "8ad35a846868037787ef8ca0f06c3ad902c234a3", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "TransparentTribe", "colour": "#862286", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212979, "uuid": "e8f7fa83-0d56-411f-8bf3-e0b1f4e518cc", "comment": "Malware payload", "value": "ca5b90c78950f0e26b2b9fb4404894d963cd1ff442e362329c7428eec11300a3a69c28ef296c0eb097f1edd90215cd43", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "APT36", "colour": "#B7C6D4", "exportable": true, "hide_tag": false }, { "name": "TransparentTribe", "colour": "#862286", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212979, "uuid": "2f9dccba-6b6a-49cf-bd93-e0090fba7086", "value": "T1E5330152E0307E8DCA2584FC97990FB24D5949756F20AFE6FD60CDDC3E8168B35098AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212979, "uuid": "ab8e9064-a666-4c9b-8f24-0b6f7d274caf", "value": "768:AK66xWpl+5Bfz1nsyWkGYqq6b/DQ0g9a3VICkjnsDmgMGHNKaF04FxUp8GSjOrmD:AK66xWgzdsZpYETAalIRkdM45xCm/3JB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773212979, "uuid": "6ba4ca3e-624e-44aa-956c-704c0e7ee417", "value": 54127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773212979, "uuid": "2928283c-a989-4455-9ebb-f8bbfcc829c3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212979, "uuid": "6563b173-1954-453b-bffa-f2a3028ed002", "value": "DD_MCO Quota Available.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f488e4ad-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773217139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217139, "uuid": "2605108d-eb63-48f5-a91c-f9143439f63e", "comment": "Malware payload (PhantomStealer)", "value": "efd9d888cd2337ba4e4a50b221a62af2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217139, "uuid": "1526a60f-6098-490a-9da2-7d593f4607d3", "comment": "Malware payload (PhantomStealer)", "value": "78cb946c8055882c8763c4ee5b4b060990582edecc58e633cf7be1b3a8b674e1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217139, "uuid": "6f811540-6caa-49fc-b89a-5ba94d0a8603", "comment": "Malware payload (PhantomStealer)", "value": "105ac071cfd3a2e3e817a1ec881c76b039df813e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217139, "uuid": "bbf08326-0f6e-4916-95a2-5e51caf008e5", "comment": "Malware payload (PhantomStealer)", "value": "099b1ea4f08cd002ecd36b72373f292f13961830dc166610644cf9db77826d6020a1d13109b5cfe8ac8d58547f6c0600", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217139, "uuid": "8797af74-531a-4144-acf9-67c29b9f77d7", "value": "T15A269E01496267EAC6A04F7B96FC744C12984F4B2C921ACD753EBC49FEED74DA0232D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217139, "uuid": "017e709d-83a9-49df-978d-0830d1552c3e", "value": "49152:ClxBiEbGomQt8qz2vks8NJvU2nPBQ/MFM:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217139, "uuid": "35a13acf-9550-4366-bec7-a752a1893ba6", "value": 4603987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217139, "uuid": "cee4d5dd-750b-4364-9a3d-df758503af77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217139, "uuid": "c98f332f-e038-4000-9c74-eeda6561e049", "value": "efd9d888cd2337ba4e4a50b221a62af2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed3ceb46-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217986, "uuid": "13aee6d7-1950-49aa-83af-1c43ea5157e7", "comment": "Malware payload", "value": "c8d115339fafd261e95664629292ab84", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217986, "uuid": "f47df1d7-287a-41ef-9803-2713ae3ce5c3", "comment": "Malware payload", "value": "7972c22e2d28d300c1f30d5fa7595d0cc7dd4eff0e97f9a234b6433d8d4b2a87", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217986, "uuid": "883c84bb-fb75-47a8-8210-1144592c355a", "comment": "Malware payload", "value": "e4c4cb52d2d6731086f6049afe02dc7e7810fea8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217986, "uuid": "651962b4-0183-4d3e-bad3-c19d4700c6e8", "comment": "Malware payload", "value": "f27477dda2e55868aac9a8400d970f2e5d48eee8a16a03eb96d57333009f3b6ca9c012976c88d5f3c70cb135ecfdd881", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217986, "uuid": "bdd4a93f-24ca-4cb1-8251-4427b58a6c48", "value": "T1A636133515BFC2C8279911F3A2B8B6249F894052F616846DB9D0FCD683DE738EF63A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217986, "uuid": "54dbf16b-8893-4113-9074-ba82dc2e33d8", "value": "48:tWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW6:AuGwtemMXGVUCxqPmuJjtP5jI+dqv6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217986, "uuid": "0aca78f0-c4f4-42ea-9db7-f5978865a92b", "value": 5095586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217986, "uuid": "501c5a55-5e2a-46d7-8bbd-a8ce9fef80e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217986, "uuid": "8994d59d-2af6-479d-b094-b0e6003a45f5", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0ed79f-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217687, "uuid": "f38488f4-a6a1-4fa3-add2-86e0e18033ce", "comment": "Malware payload (Mirai)", "value": "0ccc008c818473707eea489b2b90cb8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217687, "uuid": "cd7d5e5a-2a6c-4b51-8825-2ad1674badaf", "comment": "Malware payload (Mirai)", "value": "79e2f36ac44647db4610eb122f284a16c40468ddcf9c53b4e5064d5f62d1660c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217687, "uuid": "f6c4abb1-b90d-4566-ba4a-3774999b5466", "comment": "Malware payload (Mirai)", "value": "279184d570a5927d344b3547a344a661dfb586c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217687, "uuid": "551cc708-73fd-4385-ace1-33a70c6d3502", "comment": "Malware payload (Mirai)", "value": "22cb019becc75f66fc75da706d0c6e3e9a1ca1f7f4e80381c180fabad0971778a9a943c6357d532a4c1946bf6d76459a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217687, "uuid": "2c1fdd76-ad0e-42db-9f26-224f6bfd613d", "value": "T11AA53339AA0318A82C75E77575E6F8C3F973A4F0438ED96D8F62A16C53631E3921A443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217687, "uuid": "a6afa090-255c-425f-89a1-1316c4fb6df5", "value": "49152:gmRigHcf9UT2awDGAaVlLsgQd1PrxAqUY4md3tyX2pZi1np4:z49UyhDGAYg9vPdTXA2pZi1np4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217687, "uuid": "69ae275a-16c5-41ac-b992-52dc334fc796", "value": 2122936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217687, "uuid": "46614703-3b95-4473-8605-d2d78c5bedfd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217687, "uuid": "867ca8bc-f81c-4592-b672-c856701f08b8", "value": "mdsync1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2bfd18b-1d25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773218371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218371, "uuid": "cad5fd0a-ca62-4d33-8ec0-0047a82f71ee", "comment": "Malware payload", "value": "e05954841c43c95b86a8bcb4219416c5", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218371, "uuid": "923d487e-84dc-45bd-9456-34171f2d873e", "comment": "Malware payload", "value": "79e42591201841a09d6f39fc58c5d3b9154dd7c21615bf1c43ad743ccfcdee0c", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218371, "uuid": "9073f0ef-6e4a-4d1e-8771-eafa972d7658", "comment": "Malware payload", "value": "44857aefe03f981846652968fdeb86d913ee5c2e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218371, "uuid": "2d96cb3c-7885-48ca-9604-acf5691a001f", "comment": "Malware payload", "value": "7854284364ab3f9e33a580f4bba63ba7f916ad644876ed0a2607f30ce986c7bbdff3967fcc2053db6fcf32ef6ef73da4", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218371, "uuid": "5f748936-9351-42ef-9443-a64d7a326a92", "value": "T16B8533DC2F313B9EBE86CE770569BC1828255DD0805B2356633A7D1EA63A336173066F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218371, "uuid": "15b4d0b9-6e3a-4733-aeec-89fbde72cc82", "value": "24576:/YB0IqKL8T5Y6veNsS9syZHXCXje//R8Ilur1OQqRcZXivlg6xUjkYTSGOu1OVBj:/+qL9YTudpe6UwXcgIWtOg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773218371, "uuid": "3aaba13c-9851-4522-b9cb-b9eab134e6ed", "value": 1741645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773218371, "uuid": "68dfba01-deea-4f89-a727-dedc54b66258", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218371, "uuid": "12350e35-2569-44ed-8a22-868e530c7a6b", "value": "1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da33541-1d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773256480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256480, "uuid": "851d7d4f-8564-4ff9-9192-2bbf7cda902f", "comment": "Malware payload (Mirai)", "value": "1ab00ee7f9df53673aa3550809738fc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256480, "uuid": "a00db371-e0dd-4063-b749-ae26fc4a687a", "comment": "Malware payload (Mirai)", "value": "79fc00acb18c99cc8611290380f079c7efcbad52423881b4e2da43842ca0b689", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256480, "uuid": "f9aac22d-9ab8-4d87-852b-fc4ad1a500a9", "comment": "Malware payload (Mirai)", "value": "5898a73dcf1a1de7797425cf02bb515a068b5534", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256480, "uuid": "d24e2b60-edd6-477d-98b9-c6110760a1ff", "comment": "Malware payload (Mirai)", "value": "4e6583ac1dac1ab0cd710500929863443614faaa389f784de812fc4405451095c94a1831c61d70c9ae931d04e9859b11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256480, "uuid": "88c8f92e-84e4-4bb8-9b3a-8280ee9844cc", "value": "T122633A81BD815713C6D112BBFB6E418D372613A8E3EE32139D266F21378786B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256480, "uuid": "5bb33b31-f6e2-4390-8899-1cc704e583ba", "value": "1536:nv5bxamD209LfsLoom/gd78IOPYqqDIxRepMLvzo:v5blDD/g1J0hk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773256480, "uuid": "7037479d-f0d3-4616-afb4-1247b44df07f", "value": 73364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773256480, "uuid": "6f47e9e9-ce98-4313-9bb9-43d848be57d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256480, "uuid": "3891f50a-fced-4aa7-9851-c2a6d5c42b72", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dcd8462-1d97-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773267083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773267083, "uuid": "7358273e-cfb3-450b-980b-d1147907b8b3", "comment": "Malware payload", "value": "775043c36a758253b86a5754eb0b61b7", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773267083, "uuid": "9214e1ab-0d2c-43e0-b7b2-ead2ca2bbeb0", "comment": "Malware payload", "value": "7a3ef21dedac77ffebe53414e9f7163d55baf9ffd86891b15f61741a7adb1479", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773267083, "uuid": "b0f66f6c-eeb7-4853-aca5-c45de410bf32", "comment": "Malware payload", "value": "9c9eb64ae150be90bdd3344cf4270433f389d0d9", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773267083, "uuid": "7b6103f6-b3a7-4f94-9c80-e8bbe3ea919a", "comment": "Malware payload", "value": "4f76c48f53b72a4571f916d983693b49a0a1a83a05ad8496ba022fc13e986dfbef7029e8a541fdaf0a3d9c2f78067c53", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773267083, "uuid": "adb7c786-bcab-435f-8adf-0c0efa75b576", "value": "T13BB58D217A89C937C5EF47702A3DD76B45B96E713B7B45C3A3D8AE2E49B08C11230E52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773267083, "uuid": "06bf6b41-e35b-42c6-bb8e-513fde310085", "value": "49152:8PJrMf+7UVZDEFeA4vLNgmUESIEjPMN2lv+oByYGMV3eVougTDALpI:Eq+h4veHjPMNa2YGMV391AVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773267083, "uuid": "4d71e802-10e9-4d10-bb10-7843c942e5e1", "value": 2437632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773267083, "uuid": "d5240e1b-aac9-458b-b6b3-c78ade74a57c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773267083, "uuid": "7919c9cd-3a97-499f-9e30-082d35257258", "value": "Parasitic Training Insect.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ad58d3-1d60-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773243506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243506, "uuid": "4d8850a5-76bf-4f0b-a605-127f6e2ce264", "comment": "Malware payload", "value": "d939a1dd891e9d98410e88c3b25b9e33", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243506, "uuid": "f46e6e5a-534b-491a-b838-ba4115a468d7", "comment": "Malware payload", "value": "7a5dac55bbd70ab07af0cf584f6c7c19567c29cd340bbac698a012e64ebd57ef", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243506, "uuid": "55340003-1026-4374-8868-57dc52e9dc16", "comment": "Malware payload", "value": "c0189bcf8ed3f82c5fbb149c0ad799662d2d5319", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243506, "uuid": "a5590dda-f9c4-4fb3-9c28-49988a289176", "comment": "Malware payload", "value": "fd0129af0f0a5bf9565e486b4d1e6fbf96bf6adbaeffb079c2fd05078d610723f09366c21744bef47d107f236a1da642", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243506, "uuid": "c81a00c8-bb8a-4baf-a46d-be1b7156d83d", "value": "T1B594FF739AC57EBDD86902F760237470760A6E838574B6B1062317DD8C1AB4E7A1A0FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243506, "uuid": "05849fc4-89d1-4f2d-96e0-68652c615480", "value": "12288:Jktl/NXlQBkUK1DvgdQOcr8ow5noJtN8CyQqm2:sx6k71D4Kgr5ne5l2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243506, "uuid": "296f9b49-5862-4c81-b6c5-239db39651d9", "value": 421330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243506, "uuid": "1f2a0ea6-da3b-405f-92b6-4b9eb359c3fb", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243506, "uuid": "619faacb-94f6-4d2a-9fd7-5606ccc1fb43", "value": "Purchase_Order65721.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8defe1ac-1d89-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773261205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773261205, "uuid": "e83fa1d7-1f11-4e27-b915-fd0d28ef896c", "comment": "Malware payload (AgentTesla)", "value": "c829c4aa35f415dbca3ae507d553b038", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773261205, "uuid": "99b156dc-0796-4628-83ef-2203680b3c86", "comment": "Malware payload (AgentTesla)", "value": "7b7bc72a8a947916d4d51faa6ba3a041c3f26df6aa4b8939ba466400f171779b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773261205, "uuid": "4cc54807-c9ef-4d3d-acbc-dfd3471dc5e1", "comment": "Malware payload (AgentTesla)", "value": "ba9e4a498f5d10d537ee07fc3d2285cab84e73f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773261205, "uuid": "6dba739e-b991-448a-a145-86222a8b90c6", "comment": "Malware payload (AgentTesla)", "value": "a0ee45a3c6bdff3f20399001e052b204562a35ce23b8e847f4e5f3e0959d082fa727892daf047482c618bb2d99354cd1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773261205, "uuid": "bf05b670-e2a8-4e02-993b-ec405c82528d", "value": "T1E735AE027381C062FFAB91334B5AF6115BBC79660123E62F13981DB9BE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773261205, "uuid": "e4882f6a-b5ec-4c49-ba75-25eafe178d63", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773261205, "uuid": "7542c487-646f-49e5-9aca-e4f9d2653f91", "value": "24576:p5EmXFtKaL4/oFe5T9yyXYfP1ijXdaoNYbVBErJn7bjz:pPVt/LZeJbInQRaoyVK7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773261205, "uuid": "060806e8-7f38-41d8-b85b-2d9ca3acd148", "value": 1136128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773261205, "uuid": "61f0f021-d47d-4f2d-b1bf-198634a70f76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773261205, "uuid": "55c84be8-ee2d-4cdb-b418-07d714102c8d", "value": "Confirmar los datos bancarios pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2025be07-1d21-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773216353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216353, "uuid": "b0812e7d-b4f4-40f2-8207-9281f9dbfbdd", "comment": "Malware payload (PhantomStealer)", "value": "6d3636908f21827b18cccc9fe8a81702", "object_relation": "md5", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216353, "uuid": "b23437b7-35d0-41ff-a84d-71a903282bf4", "comment": "Malware payload (PhantomStealer)", "value": "7bc9dd1458d565239f3c8d6010b6e9c8eaea833cec55546aee0d26b82d787499", "object_relation": "sha256", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216353, "uuid": "1cdbb06a-d381-4d89-a2dc-4492a86d1a71", "comment": "Malware payload (PhantomStealer)", "value": "6b4a6576b5dedf2bb8fd4b542d90f6174e920559", "object_relation": "sha1", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216353, "uuid": "2de2617b-195a-4524-951c-19a24924f117", "comment": "Malware payload (PhantomStealer)", "value": "0f6eae72b4f1ca883d13f4964741adae7f7631b4d35bc44edb94b7f219c6a9750e6ca19ec7cbea6727362bcfdd891a64", "object_relation": "sha3-384", "Tag": [ { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216353, "uuid": "ff109943-c11e-46be-97b3-deadbe0a8279", "value": "T1E6B21E3EC9859FF00B6A31A1A56F791659140363B9383A4C7CCFC1AA3B36654CBB11ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216353, "uuid": "f044bc4b-27c1-4d12-8f98-e14a4bf18b66", "value": "384:K4s60GQTzj4IJ80cVwhiiNo6OMAQ52TYCMQEX5Ntd8Uopnrr9CqtE3wCywrcW5rb:KVGAX4ISzHvQgULuzrqACyu2d5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216353, "uuid": "33f91018-cca2-46d6-904a-60cc96096bad", "value": 24463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216353, "uuid": "2b48c376-ac6e-4e09-b0a1-26936e8a7c08", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216353, "uuid": "0b6f8150-42e6-4d33-8c9b-9950536efd37", "value": "6d3636908f21827b18cccc9fe8a81702.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5bee1c5-1d69-11f1-a769-42010a9c0008", "comment": "Malware payload (SliverFox)", "timestamp": 1773247635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247635, "uuid": "c373747c-cbd1-448a-a90e-8f622d906105", "comment": "Malware payload (SliverFox)", "value": "d435c6ea359c0b4cd90252be48f2e5d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247635, "uuid": "f1746c53-dccc-4f8b-87da-5e8f136af629", "comment": "Malware payload (SliverFox)", "value": "7c4bbb982d99092e3afa1ea99f0b5b4b24126800db166389f870a335c1ab55cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247635, "uuid": "e20b137b-6cbb-4e31-b42e-267a30b41e81", "comment": "Malware payload (SliverFox)", "value": "2a5ef8f1a0887212b9205c2c6e3d7721207f8a3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247635, "uuid": "66c5519c-cd60-47e2-88ef-f57c2b3c5551", "comment": "Malware payload (SliverFox)", "value": "6dc1e3c58cecb30230b6bfc8492e177c18973f210d1cd3a9aa4abb108b6352b2d0b15c096713f8c9cbfa17a842db539b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "SliverFox", "colour": "#76DC89", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247635, "uuid": "a63f32bf-5c46-4f71-8c75-f86baa97c2e1", "value": "T16965125AEA16C8D4D162CB3489626745357D750BCF246FEF1388199E1CB23F08E38DEA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247635, "uuid": "fdb71f91-9e56-4e68-bb81-2a96216aa37c", "value": "24587f39ebe7f0e9605e30bcc578e5dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247635, "uuid": "43bb03b1-265b-4480-9d8e-76bced734759", "value": "12288:xNm8OncWfkAy4BJLWYCPPEmCCou28dumZy94aJM5hObDUHobCgX8EFN9FsYXi:bvWfkAtCYCPcmfq8EP940gIbCS8a9usi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773247635, "uuid": "e22403f7-9872-47bc-9a03-ed71d06ff2f7", "value": 1509888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773247635, "uuid": "1c83128e-bdc5-4d7f-b91b-4350ac139306", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247635, "uuid": "9eae2deb-828c-442a-b147-b8fd32c282a6", "value": "2026.03.11.... \u4eba \u5458 \u4fe1 \u606fMpwoqiepoisjakdsahdkkald996.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6459927-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1773217920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217920, "uuid": "4c9a3a62-dc10-47e2-bf9b-7ee2c37246da", "comment": "Malware payload (a310Logger)", "value": "1e367538219c87f927a253a0d4ee913f", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217920, "uuid": "e860fef2-d48c-4454-bfc8-bd9cad7a3e66", "comment": "Malware payload (a310Logger)", "value": "7c7776559c3950b67aa37811f7ee60a5ba958439771464c8f3e5546ba83441d0", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217920, "uuid": "c1d01de6-ac9a-40a2-9178-d8a5bb83d26c", "comment": "Malware payload (a310Logger)", "value": "6e72ae6b9a07d01980b7e82d3dce57170704f283", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217920, "uuid": "fec4166d-ab58-4b26-9d06-09b8ab4fd331", "comment": "Malware payload (a310Logger)", "value": "2ad20b8dc4cd49ca212c4b59c72dbb5846a145939e19acb2dc2c14796231542c1495f98f0fb26bce4f1492a472ebb34f", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217920, "uuid": "5025d7a8-f47b-4806-bc8c-9eb70d8c2fef", "value": "T1EFD5A0E154F8489A8730530A8AF709052F2329E9E9F5BED54FE1BE6E7DF6048017F906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217920, "uuid": "d9ece884-3836-4f46-81de-03db370a4ca4", "value": "49152:O2n/ngfk4UUjP33dzd5IvdfG+1meEx/79S8e/LKYZ28DRm+33pkJJk9ZM27:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217920, "uuid": "b053dc23-941e-42ee-976d-1324b057fc94", "value": 2818331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217920, "uuid": "e7a4d13f-7fef-4e8b-9aaa-ec0cb4be7b13", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217920, "uuid": "4e87ef46-afbd-49ec-85ff-e0e337144342", "value": "1e367538219c87f927a253a0d4ee913f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71b2c61-1d75-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773252738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252738, "uuid": "c087a38d-8154-494e-afe5-019ca8cd53e4", "comment": "Malware payload", "value": "e3ef3812bf208059bdfd01a5a972fba9", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Axis Bank", "colour": "#BED76C", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252738, "uuid": "ce27e0e5-c560-48c6-8a14-6352edd39916", "comment": "Malware payload", "value": "7d66a60bcc92d38789d530fbaddac8132b1285ae23bc51e51d929b1eec7ce8dd", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Axis Bank", "colour": "#BED76C", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252738, "uuid": "536f504d-8a1e-4c7f-88ac-db602050f146", "comment": "Malware payload", "value": "4254ff94cc635305742e470d915c68af2b1d3397", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Axis Bank", "colour": "#BED76C", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252738, "uuid": "51acdd2e-b6c8-4dcc-950b-06d28725a171", "comment": "Malware payload", "value": "935a809ff7543c8da628576af51cf4c8f126aa6049d4dc93ab7a68e49240d3c6152bfa5764214de0dba14c1ba6f62d45", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Axis Bank", "colour": "#BED76C", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252738, "uuid": "f946c3cb-7ce1-4723-ad07-7b13e67b800e", "value": "T129F6BC23F50529A6DED6A130F5E7579576301E840393A239171FF026FDF26CECA26AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252738, "uuid": "8a0716f5-4557-4c5d-8e7e-ee4e560fb5dd", "value": "393216:WEYHyp919W1zolKZylIMvY6ikJfmNDcEs:RyzolK8lIMvcSfmCb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773252738, "uuid": "7d3400af-cc71-4118-a583-717e8ad2763b", "value": 15632316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773252738, "uuid": "fb1c806a-c785-4023-95a8-9c57de49c05a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252738, "uuid": "f1da372d-2cd5-4fee-8e47-e1d96b46110f", "value": "Axis Credit Card.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378cc0ba-1d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773255477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255477, "uuid": "68dadb32-aace-4e09-8926-78398a9cfbc7", "comment": "Malware payload (Mirai)", "value": "270ceeda1b94c5e4add194f02e9b3771", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255477, "uuid": "f3e150e3-9680-491e-90b7-84141612b61d", "comment": "Malware payload (Mirai)", "value": "7daeda0447e5e118d7ebd4c35c7fe5b5bbbb968923ba9dbcf7cfaf4cf9249bd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255477, "uuid": "f3d0ba37-4640-4e8f-a5af-c9fa56223d0d", "comment": "Malware payload (Mirai)", "value": "f9b96926a654eeb83183a34f9b4dede1139149e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255477, "uuid": "5bf988b9-db48-441b-b64b-334ddbae625b", "comment": "Malware payload (Mirai)", "value": "26f8c5e4eb6ad6a4b557e33390f5ed212fb05fdc7712e8fa610e793da775c2194b6bd67a6d1b212639d10837cfe8aff6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255477, "uuid": "4e974b82-d44a-4674-8b05-b993f667a85d", "value": "T17E733CC1B643DAB3C85316B421A3EB334A31F8BE176FD943F36CA9B6AD411897007659", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255477, "uuid": "fa90cf62-eb7c-4fef-8810-b71ffec51370", "value": "1536:lBkFSGAoik5skxqMEvsrWQdfkobqY4/+lQtUxvms09t5vA:l6SGAoik5skxqMEErWQdfZbg/+QmosYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773255477, "uuid": "c9d8d729-2386-4829-bf23-d69d30f316cc", "value": 74201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773255477, "uuid": "5bc82761-fbb0-4ce0-a013-9a86d9c40414", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255477, "uuid": "90df6628-c5e5-4608-9f62-6852e857e003", "value": "xdlol.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c3ed21-1d19-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1773213111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213111, "uuid": "a3f34319-0db8-4c28-a19d-fa22e5bbe6cf", "comment": "Malware payload (SalatStealer)", "value": "8be048e31c7366426ad824d5feb5194d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213111, "uuid": "7c7cd088-1d3f-40b2-ae97-f21c479e6723", "comment": "Malware payload (SalatStealer)", "value": "7de32e61db420a5bfcbc3af5362ef93ee4dea188d4087abba886caaa6f81db1c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213111, "uuid": "496cfbd1-f0b8-4e36-b95f-883b6894885c", "comment": "Malware payload (SalatStealer)", "value": "43d77dc2ad2c7d22a670bd0b7acca14a3fae183a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213111, "uuid": "89fb5e29-3154-4742-ab87-457147a760de", "comment": "Malware payload (SalatStealer)", "value": "965bcadb5d03d605c51b08589252ae3060f33a1bd7e15c81c0ff5ff9ee6d18fc632ae9b2d96295550d65e364c01b9bf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213111, "uuid": "8a483f6f-bbe3-45a2-89ed-e0187958c9ac", "value": "T1EAE533345931260ADABDDB7272F62C3A34F9DC764FA64399F18CC025E6479CA301CAD9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213111, "uuid": "3add1e10-65b2-43f0-b2c0-ce9513979bcc", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213111, "uuid": "a20ad2ea-fa22-499d-bb41-48091106485f", "value": "49152:BLC7y9+e8eIeANoFcjexKYXhPf7VyJ1FewwzQT/WvzJLvQl8NSS+xYAJzcEWsghB:tC7yRLnFcj+Xdiaz99kUgxYKnWseD5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773213111, "uuid": "6ffdabc2-f18f-4fde-a128-776740b53b26", "value": 3249152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773213111, "uuid": "4136b73d-aed4-4abe-8891-9c615cad557b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213111, "uuid": "aef730ee-618f-4a11-8232-4194ddca7afc", "value": "8be048e31c7366426ad824d5feb5194d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b6169a6-1d52-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773237498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773237498, "uuid": "61f7d744-59d3-470f-9df1-d26308d5cfa0", "comment": "Malware payload", "value": "4674a5741c526d7cbd61e34ba91459af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773237498, "uuid": "47daf55a-4720-4ce0-b401-d162d2322e6a", "comment": "Malware payload", "value": "7e0132d5d7aa09e09e6000a3374b8b3923e6e8b218f4610bf68fb005260578f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773237498, "uuid": "58771c19-8325-4721-bc99-7e180a95c9d5", "comment": "Malware payload", "value": "2d114cc5aa65d67e7395948dfbda9407742f0e24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773237498, "uuid": "d901d239-3e99-45a2-84d8-fdf02e52311d", "comment": "Malware payload", "value": "728ce37cdb23862dc2ab7e24dc00a5b6edf82a55681ca44aedf142ac5aba2453c3bf36c3f3892fba5c8d43e3f913a2a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773237498, "uuid": "e7bbc948-b2c2-428f-94d1-e0c276ad9400", "value": "T112D312D16426F2FEFD724C33711E41584AC37EA4FA28B6B19A15412ED621EC7E60A4F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773237498, "uuid": "1cc918b5-aae8-46cc-9470-ecb2e71b07cd", "value": "3072:r4dec+SrO9ZuIuoRT58P6Cvk4V9y9G398NuQRsxDVgvwkB:cdLrIuIuo5uPDMuE9G398UxDOvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773237498, "uuid": "9baba5bc-bfea-4451-8b6e-47d0ac5ca70c", "value": 139907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773237498, "uuid": "8fb1adc7-50db-4e58-b6e2-a78157b61aec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773237498, "uuid": "bae529f4-7e9c-4ec2-a920-41e3f8eb6300", "value": "poop", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db8bf3e-1d55-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773238898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238898, "uuid": "8b54deea-df7a-47ad-93b6-1370df7eef3e", "comment": "Malware payload", "value": "a67683d5f35f80427be8bd37c489bd8c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238898, "uuid": "7de8ffa1-621a-4c74-930e-7e4250a344d0", "comment": "Malware payload", "value": "7ebd67ffeebda248fade75c15719b8033a8f88eb289c226144dacf62b3cab327", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238898, "uuid": "4470b02c-77fb-40a3-ba4c-cf490c126964", "comment": "Malware payload", "value": "8b734a07a9260d3344d581020ed02dc243870fb2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238898, "uuid": "50fb3855-5db3-45e7-acd3-d9b39859a6e6", "comment": "Malware payload", "value": "f6ea4f48bdf0395a4212fa08ab8048122bbbb00c58735d065bd93c3725553c6727d5b02c0c454749cdc432980c13cf24", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773238898, "uuid": "ff93eddc-21fa-4ec1-8982-a078a53edfd0", "value": "T13B925BA916496C79FBC0CE7D9F3C7F0CADE481C02118A3ACBA4F39604A2069DDA0635D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773238898, "uuid": "a04f1e03-e23a-4eaa-85ee-995a5416a952", "value": "384:Yh0M3vgRjGlsaq7CzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:YxmjfezsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773238898, "uuid": "1eaa4a98-3365-412f-92d2-be2555bdb4d5", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773238898, "uuid": "fd4db2ac-1f08-41e7-875a-97b3bf45064f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773238898, "uuid": "46cf3957-76c5-470c-9d11-44ad922d1464", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37405003-1d60-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773243450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243450, "uuid": "3bfbb748-193b-41ba-899a-f5eeccc48988", "comment": "Malware payload", "value": "dda91720ef78bfa16207589b4fc92fff", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243450, "uuid": "88139c7a-667f-497f-8b57-dda7494e9c39", "comment": "Malware payload", "value": "7f5640425b0313d1bd19ba391e62b86826d6ec57b9040ce0c70656ed0b60ff30", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243450, "uuid": "88137e41-1f86-480a-b288-4b77aedda9f4", "comment": "Malware payload", "value": "e58ca62ae158462a7ce980c6953bcf2bf49786c4", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243450, "uuid": "781c3c20-f2ec-4d1c-85c4-82b28c55552c", "comment": "Malware payload", "value": "9277f879d99c89c890ff9880c600990ea59ed83ec88c255a67e95def3857bd4f3c7810423c582c51cc46ab32a0c14204", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243450, "uuid": "3ba4c7b9-c2e6-4d6b-9fc6-e13d582feda5", "value": "T1306423001B51BAD10C8DD63DB99BE29C6BC419EF1CD28BE8B9CF20D1F70DA4594A9F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243450, "uuid": "aadcb66d-b8ba-46b1-a8b9-43c456715bbe", "value": "6144:FKIHjEncu0IgfOBUsZrLzJiYJVqxZtPumOS2/I1ziG9EbXTOM3j:FNjacu2GBUsZHz9/qxnumlaI86EbjOMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243450, "uuid": "5edc391c-bdf7-4a16-a338-9690e2845f4d", "value": 319371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243450, "uuid": "b2b9c284-f801-4555-a4eb-2be1db6a0d38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243450, "uuid": "e93c9138-c953-4955-85f9-3cb92819989f", "value": "7f5640425b0313d1bd19ba391e62b86826d6ec57b9040ce0c70656ed0b60ff30.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d10c169d-1ce6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773191310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191310, "uuid": "2de120ad-0869-418c-a03d-1386b7447a55", "comment": "Malware payload (Mirai)", "value": "0631b9b933f8c7ce1c54ab9b827976ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191310, "uuid": "5a973aa3-3c09-4751-873b-8136057a11d6", "comment": "Malware payload (Mirai)", "value": "7faa83e79c35adde6aa1d534fde59758681d49daff7a123f5329a4e65405d09c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191310, "uuid": "98069be8-3c7e-45c8-8d32-83edd47fb316", "comment": "Malware payload (Mirai)", "value": "0330a9807918a13d05b1e04b3cac58b97b5c4efa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191310, "uuid": "0c2321b5-96d8-4daa-90ac-f9475edd1b25", "comment": "Malware payload (Mirai)", "value": "55ebd95c6703a44871eeb55562b02e02900a5c2cd82d0f52c98270c6b93aad0d9304953adc763bcbf47b18697dc529bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191310, "uuid": "359762a1-ef8c-4493-98ee-492b4bd2d7d7", "value": "T18C734B42731C0B47D0A35DF42E3F27D093BEAA9120E4FA85651E9B4692B5E331196FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191310, "uuid": "4fb75f70-988c-46a9-b141-ccfa88d7b5a2", "value": "1536:fzAs6AEpRO5XGAkwYJzXah14IN7w+08WKF2Bs561d6ER:ftMRHk14I6+Rut9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773191310, "uuid": "2e048275-db1f-401c-bc05-25935e3f4219", "value": 77412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773191310, "uuid": "d985da9e-eea4-4e9e-8c12-704f64bb77aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191310, "uuid": "4d8fe6e3-5e20-4e35-b20d-15eba72aed7e", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f33d5d93-1d2d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773221861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773221861, "uuid": "bc79c5e6-5367-4b22-bb4d-bf053bf15cba", "comment": "Malware payload (Mirai)", "value": "90ce9c072ff578a6b5345352e28c1f86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773221861, "uuid": "f7853191-79f6-4197-baf6-ad9744640a01", "comment": "Malware payload (Mirai)", "value": "80551c87db15d794c02974165e9a6086a5239f820831042e5573d49a26de9227", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773221861, "uuid": "72d8c57b-4b8e-4903-a3cf-eff61ec4b0bd", "comment": "Malware payload (Mirai)", "value": "172c01648fbd7c01d8793906db28ed87bb01365f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773221861, "uuid": "49de8e5f-7b47-48ed-bb96-37ba32398620", "comment": "Malware payload (Mirai)", "value": "163cfb241f3bfad6da87fe4e3cab26c1784514b8c8a519e2272b53206bfd137b0d569b5d78685a85b43236d926a513d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773221861, "uuid": "f278a9a2-df3f-4285-b621-ace2f864efa5", "value": "T10B343945BE404E37CBD4627AFFED42CD732623BCD3EA7102EE015B25369A56A0E36542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773221861, "uuid": "678021ea-7206-478d-bc17-8f076106febe", "value": "6144:ZJUyfsGme9ROLlRZp31272GkU6vVLgmRfMb5F69aCi0Y+aTY9QSw945LQv3Pl+xw:UyfsGme3OhRH31272GkU6vVLgmRfM5FD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773221861, "uuid": "b718951a-9272-40e6-9574-6556f7d1308e", "value": 238008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773221861, "uuid": "f293308c-b0b2-479b-b901-edf416e9b8ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773221861, "uuid": "a5f9e28c-e6b2-4a4b-9741-b56cafafc492", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c46fe21-1d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773255538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255538, "uuid": "d4458d78-1c7b-4625-bbd3-dfd871d8d6a0", "comment": "Malware payload (Mirai)", "value": "1953881d7dd194599fb796ec1aba4046", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255538, "uuid": "e4ff03fd-8b8c-4306-a073-6d3a1895f539", "comment": "Malware payload (Mirai)", "value": "80c565d50769670a5ce1f18bcfec4af99ffcf89a964d0119eb7c66c8f28238aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255538, "uuid": "d9672853-f32a-4159-90d5-4f2350efc24a", "comment": "Malware payload (Mirai)", "value": "b1bac5f50074905f9f6c381c81bd7df2c104a178", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255538, "uuid": "c9842772-202c-4880-94c0-47597e6fefcc", "comment": "Malware payload (Mirai)", "value": "941753d336d6682da021e7941e0c15693c3021a72f530f5a08e8a592ab9f87bff3c737a78a21bed6aed6e035489b8ef5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255538, "uuid": "45856de5-9c06-4bc9-9beb-72d03eb6a2e8", "value": "T177733B69B402DE3EE80BE6B944D70F24BB217B954B830B16A266FDE329332C47D15F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255538, "uuid": "8db141a0-90dc-4630-bc2b-c83cac436df1", "value": "1536:K4Ptt1375brQE4KDuIzSMWFtZb6eRV87Ka8Fu:Kytj9YpHyBmB6cAPou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773255538, "uuid": "03e20d5a-84dc-43cf-8292-555e1acec2cc", "value": 80295, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773255538, "uuid": "a5b972f4-6191-444c-ba25-da0157f8c1e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255538, "uuid": "f14fd7e3-a1e3-4289-ac9d-307ee4b8eee5", "value": "xdlol.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60637fdf-1d5f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773243090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243090, "uuid": "f943e3dc-4762-4fa1-ae7e-5fc6888d2a18", "comment": "Malware payload", "value": "3243f7bf3ad3c1dc708f4c06c1b36f1c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243090, "uuid": "f1f9b147-37e7-4194-8ab3-7e2785d9daab", "comment": "Malware payload", "value": "80e25df31d75f883618cd77ef0881406dce057d35620f1c84470a5fcde3cdf49", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243090, "uuid": "0abcfb23-65b2-44a1-953f-245be74ba5fc", "comment": "Malware payload", "value": "6545b3c4366d480701b8278e47a04f85933da24b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243090, "uuid": "86f64168-7965-4ec7-b6d6-05a3c269feb2", "comment": "Malware payload", "value": "d5df7ce704b3a44ca628ea88737b8975fc96e0fe9ad2ac3bab9c42e67961fd0356cb7fbc12f7ca7c4ed857851e315b14", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243090, "uuid": "a00884c7-cfa6-4be3-b2a8-f7e7c87e7b37", "value": "T1EB925DB512896C79FBD0CE39AF3C6F4CADE8C2C42124A3ACBA4F39205A1166DC705359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243090, "uuid": "bdf304df-42c9-41e3-a124-a4dece0ab35c", "value": "384:KFcuQpWx+BL0SWL0gLzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:KF8i+BL0SI0MzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243090, "uuid": "d7467998-ba9a-46c8-9cb4-022c5623a3c0", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243090, "uuid": "b6c127a6-bf50-4bc6-82d5-486e8e4f616a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243090, "uuid": "288e41c2-3c67-4c30-b094-ba4937097011", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e152be74-1d59-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773240729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240729, "uuid": "928c8165-67b0-40c0-9877-7bb05c9989e5", "comment": "Malware payload (ACRStealer)", "value": "8a1a8b78ae65caa05e895dd1a83f950c", "object_relation": "md5", "Tag": [ { "name": "141-98-234-16", "colour": "#B07C16", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240729, "uuid": "b7654a44-653c-43d3-9793-2f8cc8f4a975", "comment": "Malware payload (ACRStealer)", "value": "8130acbf5a8c859d8785d6ba291b0ab496c3c3f6df7387a80934e17a8d844848", "object_relation": "sha256", "Tag": [ { "name": "141-98-234-16", "colour": "#B07C16", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240729, "uuid": "2ad80356-44ec-4729-bfe2-5a303aec8069", "comment": "Malware payload (ACRStealer)", "value": "207d2825645a806a004b2262074ad4e721516e0c", "object_relation": "sha1", "Tag": [ { "name": "141-98-234-16", "colour": "#B07C16", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240729, "uuid": "b0e9ad13-fd1b-4d38-ad57-e0b74c527d37", "comment": "Malware payload (ACRStealer)", "value": "48232e05675f546d746d996c74ea318255a3cfda45f246e3cf40af0b963df384cb30e455d4a2da3f04a1975ae2bf9210", "object_relation": "sha3-384", "Tag": [ { "name": "141-98-234-16", "colour": "#B07C16", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240729, "uuid": "187a3869-ceed-4890-883f-4b33fcf153eb", "value": "T100B633F1F00D8C49DB93DBBCF0AB59975CA0805EA339F29314D115646EC5DCAAB2362E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240729, "uuid": "8c33b49b-4323-4c0b-bd2e-9a3df58c1d99", "value": "196608:BQvqi1VIosRLLXpolB4gnx3jbSboD4KKqldFt0fn+o224dcKl4SmCTnygsr8142Z:BQvtVIdZLXpolBbxHfKq9tsZ224r4SKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773240729, "uuid": "7d96a911-1254-4c44-b7d7-d2fb85af47e8", "value": 10705368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773240729, "uuid": "e826bab2-fd9b-40d4-9f6d-c8a561b7a4ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240729, "uuid": "a238ded4-542a-4137-902e-e186b5d31656", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6914af7b-1d61-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773243963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243963, "uuid": "dfab79bb-39e1-469b-96a0-7ca118ebfec7", "comment": "Malware payload (Formbook)", "value": "10792033a3550529536af5ab9bf98688", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243963, "uuid": "3be3b019-48e2-4659-b3c8-d2fae0e047c1", "comment": "Malware payload (Formbook)", "value": "815278833a20e95cd14f6ab44f46b46f2eb22d224742220bf2c4ad753afdbf38", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243963, "uuid": "b32e37b3-21e8-49f3-9bd4-2c6841c23f88", "comment": "Malware payload (Formbook)", "value": "23d93ed92bf24834869c9a937dc999fe9e1d61b1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243963, "uuid": "628c09a6-f528-49d1-9507-a8c3cdb344e4", "comment": "Malware payload (Formbook)", "value": "34805aec293631854c8aa421a7787e220c595f2b564145a576ab7c466cd00ebea8b43b6a3424c900f9d9836541d53635", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243963, "uuid": "d5db5632-9c0d-4789-a8b5-227d2ab412e1", "value": "T156551DE3CAA1709516821119E58117FEEF5B93D6FFDE2239E21C8AD37F9306071212B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243963, "uuid": "2c1d5aa5-6521-4599-aa25-c54e65128aef", "value": "96:mvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvT:ExnH5AU5HpxH8HWL45aV+iFnO9VUDP7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243963, "uuid": "55c15385-6f1d-4ec7-a527-e9ae32b3f614", "value": 1300040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243963, "uuid": "8b17245d-fb0f-4e6a-8d31-8851fd0e24a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243963, "uuid": "b126261f-06c0-4417-ae36-2148ddbbdf75", "value": "10792033a3550529536af5ab9bf98688.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04bebb1c-1cea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773192685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773192685, "uuid": "746877f5-fcc9-493f-aa1b-39a37e613056", "comment": "Malware payload", "value": "dc19805e1b4cb6712c450b428f130abe", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773192685, "uuid": "18d3bbd9-a40b-4e9a-851a-103665687760", "comment": "Malware payload", "value": "81df7102540b8d871efbf8a77830f5d12ae3fc5652fb450f979ca227cda013cb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773192685, "uuid": "8d4795aa-83ec-45e7-97dd-40f5eb688f14", "comment": "Malware payload", "value": "38c286275b6d5483a4abb919cacadbd4e3d87808", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773192685, "uuid": "26382c23-72fc-43f8-99ff-d39e7b6ed141", "comment": "Malware payload", "value": "52d02e93ea8ec97389739dcb959c786b3448820ca0cdba45cbcafcf73eca91b573aff548608ab9568b0307e11a5d4eec", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773192685, "uuid": "262acace-4be0-4701-810c-1ad7af9eba5f", "value": "T151D6336067E65AA3C5A3D23C77435486E375E2633987C2423B4CF3ED9F3E2A04B54986", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773192685, "uuid": "759ad19d-cb38-4b56-873e-3947b22cbb35", "value": "ed211f07e785e19a34ec9ab48263f8c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773192685, "uuid": "f75e64ad-6ab3-4312-9919-f5eda10341ff", "value": "196608:XxfoYTdxWxZz8AE5zhX7oL9AYBgm7ItghswvWtNhXjeZeSu9emU+LCKZ9S0bBL2N:XxQTMAkdohgm7I+hgXhjkiA/OSEBSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773192685, "uuid": "124e024a-ec22-4b7b-990c-aed6d7c3b3b3", "value": 13818657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773192685, "uuid": "748c1cb5-4f88-4bf0-ae4c-4ee13fd117c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773192685, "uuid": "0a5f7606-08df-4dcc-99a8-4842de26fe0d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6df8d20-1ce6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773191239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191239, "uuid": "3256bf64-73e4-4f07-8179-4c0809412dcf", "comment": "Malware payload (Mirai)", "value": "d2a9e7f20fd461a28ab2d4a9443493e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191239, "uuid": "56cba2d2-f40a-4650-8e02-7d1399325434", "comment": "Malware payload (Mirai)", "value": "81fcb882ab914cb3c3dbe2948f229f67311de0091650c9f3b2eb4f7240cbc908", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191239, "uuid": "6229f951-6e5a-4cd0-a8bd-b2c389f9c9ce", "comment": "Malware payload (Mirai)", "value": "b3f5437a330ce946f1b2b88f4a716b6106abd142", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191239, "uuid": "b798b796-6753-4df7-888d-3a56169d1a05", "comment": "Malware payload (Mirai)", "value": "d04dd63ff71a05cf43b8ed55277e474740dda1c9b62c1046d0f01481273aa8492c23e35692b04fce3310661c2e9f54c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191239, "uuid": "c13a944f-cc5e-40de-911b-309d75f45064", "value": "T1D1835C91B9815B13C5D012BBFB6E018E772A13A8D2EF7213DD26AF11378781B0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191239, "uuid": "d602b859-4509-4d3a-8d09-1d6cf108aaef", "value": "1536:K1gjTcAjL0MRlhSkLumT8tOs/ycdt/F15wvb61d6ow:K1gjXL1LuOBQ+qRw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773191239, "uuid": "ed941c60-21e4-429e-a15c-4504f1d373f4", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773191239, "uuid": "cad42e11-ea19-4c0f-a48c-78a6f60f2d7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191239, "uuid": "d453d05b-a39b-422f-9ae0-e4d9e9947e81", "value": "parm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6d50271-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217894, "uuid": "2bf4762f-295d-4777-912e-15a97ca3100e", "comment": "Malware payload (Mirai)", "value": "64de25ebff9a4b6e2015a1d573233093", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217894, "uuid": "ccd4b18d-db87-42a1-9fd7-2a026dfdf685", "comment": "Malware payload (Mirai)", "value": "823900c665b32b5c9129b3e87a894ec19542e80e79d204c09f0eb2c6213c0d9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217894, "uuid": "dfd9cc6b-f976-4c5c-8b41-8181278b97dc", "comment": "Malware payload (Mirai)", "value": "1cb5d945b68f60c2db03990c5f6f4014f80daa72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217894, "uuid": "f1db4f87-1d98-4b03-b094-deec6d7b2d0e", "comment": "Malware payload (Mirai)", "value": "5ac6a564d88b438ade8c10dc76cbaa5ec7252da939b581a1664113929bd8e300bf0a2884cbbc2f4b2dcb644180bfb22f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217894, "uuid": "d297f4f6-a9de-4816-b500-403712ebbd46", "value": "T1A7865C46FA196FA5C924483399F3496023726C586B319B82F704F3BEA9F62450F53FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217894, "uuid": "040b4ec7-2348-4a60-a068-9afe937c15a7", "value": "98304:OhG1Gzh6TYqpIOpSSy52mGOf4xsARRGEv:OhG0z+V7Rjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217894, "uuid": "72522bad-307d-4401-a9e1-28eca1e84a4b", "value": 8257684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217894, "uuid": "ff2e463f-3e04-4620-b27c-184aad64c866", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217894, "uuid": "640f1e27-b324-4b22-9aab-4f07dc07d57d", "value": "ttmswapd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "824f34e9-1d1c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773214370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773214370, "uuid": "841cb064-d61e-4fda-b4bf-c496540dde83", "comment": "Malware payload", "value": "bcb654e93d258ecf0cab1db0f7cbcabe", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773214370, "uuid": "43c8c33b-fdc6-432d-8b44-19af0a4a2484", "comment": "Malware payload", "value": "835734079549b6932e3512b705eb51e4b051622f81f3e541f1ed041c2fb8b813", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773214370, "uuid": "e056dbf5-f948-4154-af2e-c835221a504c", "comment": "Malware payload", "value": "81a9e0422d1ffe62f77060496d318863cf3307c8", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773214370, "uuid": "caa3c4ee-155b-4432-b209-474dd446348f", "comment": "Malware payload", "value": "fe88e4e365509782acffa35d9dd8ac6062b6b697375df9ca2ef69a1b61ce508bc6e89c32ec4c7d258814e81cc42d9a0b", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773214370, "uuid": "536f51c9-9108-4981-9a54-604a0ffa5d5a", "value": "T1920512A2A74C519DC3015C7E6F9B9585902CBC13DF4B670B39EDB30E38322795AD2A36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773214370, "uuid": "733018f7-9e99-4448-8a4c-c75ab5596285", "value": "12288:Oq+/puKucJxfBTIj3J2q+/puKucJxfBTIj3J+MhXD3yb3EM5nLqJjbaG:OqcuKDrBTq2qcuKDrBTq+MwoM5GxbaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773214370, "uuid": "e2468cf9-f6da-4b3c-a1cd-02cec317b362", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773214370, "uuid": "cc878a6c-6119-4e7e-b0ee-0f6b9d6d96d0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773214370, "uuid": "4aea83d2-6dda-4226-8be7-19781b0b401e", "value": "bcb654e93d258ecf0cab1db0f7cbcabe.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f5840b9-1d75-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773252537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252537, "uuid": "0e9e831f-cdcc-4b77-8485-09a4e545a95b", "comment": "Malware payload", "value": "586662f4de6511ad3911ae71529c5efc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252537, "uuid": "f01b9519-78eb-4b18-97a1-0f89a818751e", "comment": "Malware payload", "value": "83a4529e7a82dd954690c915d6b0f02a6222d7f333a51fc9ab5ad66099c2981b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252537, "uuid": "d3ff5ef5-e565-4f56-a645-7ba2959d7ed2", "comment": "Malware payload", "value": "d40bd37e75086bad551dc66000cf66698f8d17b4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252537, "uuid": "4317fcb8-5d9c-4d90-94d2-dc040bb37523", "comment": "Malware payload", "value": "c86e03b22c531791cd939ed79324e64f6db94868d7b1b29b8b3e7ef83adbdf13074fc8e9ca4892156498a67be8de251f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252537, "uuid": "96a43217-6f85-4db1-af2d-948e5c62928e", "value": "T112530755BD929A17CAC4537BFA5E42CD372623A8E2EE3213DE155F2132CB42B0E7B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252537, "uuid": "22825ae6-dfa3-4255-b0a9-2b843ab6745c", "value": "768:fq4OHoKVnm5eETi6QpfOTpYkOwEM0oOHhWE+5A+6vpNqC0enmTI5pAx+irwlDF6G:Sl09Q921Edo0AT6RwNOb5pAFyJR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773252537, "uuid": "fdb7bc73-bbeb-41fe-861d-a73d91a862b9", "value": 62688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773252537, "uuid": "ce27221d-c15e-4a4a-aa73-1911dbca71fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252537, "uuid": "3d79fa3f-93d9-4753-9290-628d98b26d7b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d15598-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773217973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217973, "uuid": "e4bd9713-165c-4b06-90f6-40f2b665b83d", "comment": "Malware payload (AgentTesla)", "value": "f9ecb4fe349c3ae0489bdc7f50a5a352", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217973, "uuid": "42ae734f-e476-42b1-85f1-340657271092", "comment": "Malware payload (AgentTesla)", "value": "8426e0e8958cca0cd429fa8f384e6c31cf32ad82e51668650f191c431b0b2bb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217973, "uuid": "07dbceee-fe3d-45d4-9844-9b39da42e427", "comment": "Malware payload (AgentTesla)", "value": "1e0244b8409b39e5ca8aaa3535fccfcb6f505dfc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217973, "uuid": "ad418a9d-ef0d-4599-9860-0893be443d71", "comment": "Malware payload (AgentTesla)", "value": "2ac600539af5a7106d4fc19568a4730dc9254096c56c5c78ccd215288a7deb853e7b603e9e8a59494cdb35e2a63aa122", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217973, "uuid": "41fa7df7-6ff8-4559-8a60-0e5693553dc2", "value": "T136B2664C3EC6BDE4139234276937B16FD93ECD483ACC9298C9566064FC68F28D77A894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217973, "uuid": "73e4bcf2-bc5c-44c6-90be-af95e276da90", "value": "384:BkeQIWeiEslfREx1svao1WIeUA2bYuhcPM1/lHd4KkbJ7It9NFD5:BtQIDiEsl6x1svaoLdA2RDWK4189Np5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217973, "uuid": "a47de3c5-425e-4bde-a4dc-c969c1d50765", "value": 24531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217973, "uuid": "6542731a-7628-44e6-8c4b-dd20750ffc81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217973, "uuid": "6e47bb4b-6dca-42ab-9565-54f85d6baa6a", "value": "f9ecb4fe349c3ae0489bdc7f50a5a352.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a10cbec-1d28-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773219403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773219403, "uuid": "6ed247c7-e216-4915-b3c0-5ecb1ec5368b", "comment": "Malware payload", "value": "25c4a2e136fc6cb50b320145453fe6b1", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773219403, "uuid": "b4b2117f-d351-433c-bad6-8c822cc7cc81", "comment": "Malware payload", "value": "84379bc1903b7d32f76e375a7c5d07c6feec8daeeb0615c0281ac3448e2054b3", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773219403, "uuid": "04ebc2bb-c671-4728-801c-618a976826ba", "comment": "Malware payload", "value": "53716d550c5cc872617006a26420d5b7277e5d39", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773219403, "uuid": "5164027f-ff64-48a0-b638-d7a095ceef78", "comment": "Malware payload", "value": "55f6544925ec3720ea409b8e089c33176a9f431142060ccc73db7197f1330327029763b0a789bed7688357f968b47d36", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773219403, "uuid": "2dd5ee85-e34f-4b64-96d2-e0e8ea9a14b4", "value": "T187051251A74D919AC7106D3B7F8744D6826CBC13CF5BA30B3AA8B31E743127A46D1E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773219403, "uuid": "55c42974-b8e8-4df3-964d-e8771abbc2b9", "value": "24576:tqcuhok8Nmpqcuhok8NHzWqdKAhSFkLMY:tqcsoNuqcsoNyqEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773219403, "uuid": "8e1fb33b-6f6f-4a74-89d7-597a9695f9e2", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773219403, "uuid": "dc482303-d03a-4295-b0f6-680f8a72f17e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773219403, "uuid": "d3cf73ab-7213-4bd3-9da0-cb37df98972b", "value": "Cotizaci\ufffdn de m\ufffdquina.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb2bd6b0-1cf5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773197823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773197823, "uuid": "53c2233f-195a-4d90-8214-2880fe51d99e", "comment": "Malware payload", "value": "b0583cbca711451ee4fcde92ab4ee7f6", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773197823, "uuid": "e41303e5-ca42-4185-82c0-4b290abf4f98", "comment": "Malware payload", "value": "84c9e0ef4b05b19efd1efedaa3731a83f2a0c9c65050943ce428522a198c9419", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773197823, "uuid": "17c2e920-0469-43c5-bdda-4659160cd5e2", "comment": "Malware payload", "value": "cbb5650d3083632029696a43d91ee654aec7fd4e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773197823, "uuid": "d06a2a02-904c-43b1-84db-20c858c0f886", "comment": "Malware payload", "value": "9f329ca309524824a9d6e324ee892b8db464696b6339e13c4650b1157a396c9dfc43a0077dedf9b6b156d58210035042", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773197823, "uuid": "0cdc315a-9448-439f-86fe-7ef92dedc2e4", "value": "T1B3925CB512896C79FBD0CE399F3C7F4CADE882C42124A3ACBA4F39205A1166DC60535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773197823, "uuid": "dd4f8bf5-9cfd-45d2-9423-b3d05b8b2ef9", "value": "384:zFcuQpWx+BL0SWL0g/zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:zF8i+BL0SI0UzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773197823, "uuid": "b943ed5c-d88d-4031-b8a7-20baf2ff195c", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773197823, "uuid": "d5ddb437-da68-4b8b-9013-9c9fed6e2455", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773197823, "uuid": "5c723e60-1efa-4e1a-918f-822851b3763e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e53c1ad0-1cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773199933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199933, "uuid": "771d205a-3dfc-42ba-9041-d63851a64190", "comment": "Malware payload (Mirai)", "value": "96c3d3134907a887b8c01cc81329e5c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199933, "uuid": "a34a3e6f-13f6-4ddc-808e-84f43bcc7019", "comment": "Malware payload (Mirai)", "value": "864ca68163ef7993f96808f68d18c7d5fa828349bc33da218ac5ead88da98eb4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199933, "uuid": "74d6b707-d61f-4f18-8e21-0355c08f1b9d", "comment": "Malware payload (Mirai)", "value": "f1e0cefeead856f24a06dc45f2b28146f3d91587", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199933, "uuid": "ebfe61df-95d9-431f-959e-446bf1bf76fc", "comment": "Malware payload (Mirai)", "value": "158b86b2313c603dc7b1da77be7afe58b070bc8a8e631628e3e25170577f1d85030bd1813a852ed7ddb22eee64d447d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773199933, "uuid": "85f67a39-2259-48d3-b977-ec0e802c678c", "value": "T1B6F30745BC519B13C6C656BBFB4E42CD372A17A8E2EE7203CD156F20379B95B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773199933, "uuid": "cc018651-111d-4aff-8e8f-5fc62004cc67", "value": "3072:VJxPFiRGpJW8mwPfdg7JETGBw93Ap245X22C6CIop/ObRWIC:VbPFiRGpJW8FnS7JETGBw93m245GNNIs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773199933, "uuid": "c78a4b1c-1cec-4cf7-acc5-1ee6e0f3a05b", "value": 168312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773199933, "uuid": "2e6a6ed8-620a-4d37-baeb-2c2aa980bf08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773199933, "uuid": "0e13c392-32ff-40d6-a54e-9443d45dab4c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ed0ea3-1d61-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773243956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243956, "uuid": "696e2a8b-ed09-4631-8c62-9e1b0f78805b", "comment": "Malware payload (PhantomStealer)", "value": "d4e5ff18acf7ce1f56cfc43c94e92fa9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243956, "uuid": "076df5ca-302e-43ee-a901-4076c5c85b11", "comment": "Malware payload (PhantomStealer)", "value": "86a5cfde032fe3e6d655391183e703f72b4e9a03101b1311b547bdb8bdd85f16", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243956, "uuid": "07c0c559-24ad-4d51-818f-b0280b7c89fc", "comment": "Malware payload (PhantomStealer)", "value": "3178c67e659ab0931fc1ce49a066c924d0588cd2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243956, "uuid": "2a4babdb-9b6f-4b7c-a591-fd8fcd686522", "comment": "Malware payload (PhantomStealer)", "value": "9d4a9ef74772ade15088cfc7a9aa647f9607c80935d2a62ee2f362d0638299acd6b929c1b56f315b8b2d349abc0e6048", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243956, "uuid": "0c94a466-3c57-4340-b3b8-2e35d3c97ad7", "value": "T1ADC2758C3DCAB568931564FB282FB09BEAFF0CC8B85D4184CB1919C5F879708D47AB16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243956, "uuid": "235ade8d-692f-45ed-8a2a-2e27ef3027c7", "value": "384:brZUkZOSl8wN/wz6hwWSCt5i1Igtfqm7LBhs0nrCk8ByRHrgU:brZUUFwz6hwW7iLF7Vhs7BukU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243956, "uuid": "3bded0f9-4b7e-4b92-bb98-193d10d4c625", "value": 27742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243956, "uuid": "d0c90de5-426c-4826-ba10-ab3a081073fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243956, "uuid": "29377599-ca9c-4bbe-b744-3e4b536aa417", "value": "Moflash-Proforma Invoice-FOB-2026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8b0950-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217634, "uuid": "ae3ebee4-7883-44f4-a16a-9e032c067447", "comment": "Malware payload", "value": "a474926e725ec4444fc25ba2c1d0e510", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217634, "uuid": "feb75980-b471-4afc-8613-ed590b888202", "comment": "Malware payload", "value": "8789320655b785043f30ed458ed5cbd84861fecd46c4b1fa710a29639cd02ecc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217634, "uuid": "57e6adeb-e767-47b7-84eb-e33602d3006b", "comment": "Malware payload", "value": "6e04f8df59fb4a180ebfd90682b1519dcf49009f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217634, "uuid": "83b33665-f30f-430a-9a8e-41d2889294e1", "comment": "Malware payload", "value": "4390044dd3708147e0b827e089532adb50afa4da1c37620fb06dbd962911587adeaf552c8650a6ef600e863e3323c0cd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217634, "uuid": "ad26bda1-9417-43cc-8088-4bbb0d7f6839", "value": "T17AF0028B3959307A0FA8413FA163E76E71C1256328608D3EB83DE2002F3C38D2798A64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217634, "uuid": "fa742470-37b8-4283-a81c-6fd327673b0f", "value": "12:sSMV6QEmFHiQHCz1Bm5sxiZ1TjP5PA7QoLCO3Cg9c8V5mFX2k6sVzxhFVS:stVYmFrHavWsUNP5PA7rc3d6izxjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217634, "uuid": "775c0402-e68f-45b9-868b-7363dcbdcac9", "value": 632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217634, "uuid": "c3624a58-9afa-4226-8565-93f0d29aa751", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217634, "uuid": "d80ba53f-4438-43f7-82f2-66da00eaa6bd", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b11c30-1d1e-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773215024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215024, "uuid": "452de788-2ce2-4588-a95e-87877808284a", "comment": "Malware payload (ACRStealer)", "value": "0322d337d0119d4d9b2cb7e582a1ad6a", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215024, "uuid": "5ea5a5b7-e5ea-4558-9ce5-03bd8412b957", "comment": "Malware payload (ACRStealer)", "value": "899f9c6fec07167f73bb346eb632a5494fa440bd14651da6cb0e21cbc9b69644", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215024, "uuid": "873dac7c-3dbf-4a91-82f0-70b09a1936ca", "comment": "Malware payload (ACRStealer)", "value": "0bf9ca4a11d1a210f97b62d1ca66f9d76aaf413a", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215024, "uuid": "4cbba1a6-d972-42d8-96c2-5a8a589a7c7e", "comment": "Malware payload (ACRStealer)", "value": "a57e7269052736dc00bc404e26ea8be0a014de7a8720583eaf54a10056b15d605347ddd4801399a27c700797fea06a6d", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215024, "uuid": "f8b9a6c6-5993-4de0-b153-f3fc4408c0bf", "value": "T180464913A5648622DC6D0C70A091A236FC712C5F3F2E78876F48BB6D1D37AD267B5326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215024, "uuid": "7e9f84c0-2677-4839-bcab-763f6585e6b3", "value": "01392ca861cf87b8d28ad9ea90016bb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215024, "uuid": "1aa45ece-d189-4322-8d56-ac548c1f3857", "value": "49152:T2ayEzkLfU3ITeqioJdXN0BMOwLloBruglW1PszNsQBeW4SkZP4sz9Mb:7EeqJJdXN0B7+s/W1PszhfkZc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773215024, "uuid": "ea7887cf-9614-4013-bdf0-1d4cb7f16c1c", "value": 5518266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773215024, "uuid": "f0c4b002-c136-4525-b67b-b5d008cafa46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215024, "uuid": "66bd5608-49d4-4fc9-b62d-8541ad2dc3f1", "value": "0322d337d0119d4d9b2cb7e582a1ad6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfa3096-1ce6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773191249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191249, "uuid": "5e5b3f33-0b11-49fc-a321-577a6c6f82e4", "comment": "Malware payload (Mirai)", "value": "54cb0cb12a36ef91b833b43104090257", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191249, "uuid": "f71cceab-0faa-4bbf-a581-91640f2ac30f", "comment": "Malware payload (Mirai)", "value": "89ac1aa0c157d680c95bc133517a183191e7aa758ec24f5015ae975b6a0896f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191249, "uuid": "c86aa653-5b3d-4dd9-ab73-8e90b564b761", "comment": "Malware payload (Mirai)", "value": "cd9162e961c7ac572e111f398c3a2180bf4720cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191249, "uuid": "155d4314-9146-43b3-851d-0b53551b21f4", "comment": "Malware payload (Mirai)", "value": "9df9cb0cecb576c7c6effc8facd90a40b593aa8227b528d62c44d4fc1c5e47a10b110a8c563196804e8d8e8b8e5f41c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191249, "uuid": "5fd2fd18-5250-4a48-bdf2-8906df72c2fb", "value": "T16F1329D2B8C29B37C1E0127AE56E805D3325A7E8D2CFB717CA156B417A8A41F4D77B02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191249, "uuid": "1e3e6dfd-d27d-4a1b-8c84-c5740ffe4ab8", "value": "768:fJlaRQ8XJe0q0QZWHsdzstNgMZeijbjz+SyMlMGWowq71dUx:fa/Xs09QWNgeRTDyM3w61d6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773191249, "uuid": "2c048f65-da49-43ed-b226-d0be8757b78e", "value": 44576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773191249, "uuid": "e0c75fa2-baf4-4ee5-b011-1d98ab4dbc5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191249, "uuid": "32f5c4a1-437b-48e3-84c7-f1bbddb4eb71", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78aeaf7f-1d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773256445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256445, "uuid": "3a53d5a9-a30d-4615-9d49-2cbbaa05e2f6", "comment": "Malware payload (Mirai)", "value": "cd755fb7ba8a95535e6d86641810d8dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256445, "uuid": "7dba8c4a-bc5e-46f2-8098-29066ee02828", "comment": "Malware payload (Mirai)", "value": "8a9e838fd4f74802a8f960b4994644c284fc45d4a75e51c78cec2d95665f0011", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256445, "uuid": "3f762763-6998-4433-925c-8e96895615be", "comment": "Malware payload (Mirai)", "value": "65fea20712c1374c01ab75b605d6d47dbeceada3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256445, "uuid": "f5cd077a-6fc3-4675-bd20-8fe260e956a2", "comment": "Malware payload (Mirai)", "value": "8c2b6e6914eea1921a0035e9a1e407a747e088b58f3097f9a60d9a0e03316dd7c2723d95a39426059f71b5766a2e2c55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256445, "uuid": "aff4e1ae-69f6-441a-8a67-be51a1ed3285", "value": "T14BF2E1BECE50D80AFEAD19BB425E0BB345947091679A4788A7024C9CF478E467C8E5F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256445, "uuid": "e833fa7d-afb5-4b09-9bd3-5a1c38c9f624", "value": "768:Bcic7wjLhOVP4kGcHBbkQzHuxhfpASwNJWsPNW8:Wqcp4NcHBbZruxhfpAXW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773256445, "uuid": "8909b5c3-c3ef-46c9-85cb-189948dd3080", "value": 37160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773256445, "uuid": "a14b0e5e-dd78-49ab-9d0e-0e5398e8f54f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256445, "uuid": "84436a6b-150a-4496-bb14-cfc16c6393eb", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7803b648-1d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773256444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256444, "uuid": "32940a41-f964-4017-a2c1-d19db39b6d06", "comment": "Malware payload (Mirai)", "value": "a7bd8b3f513e9c945f89405cbfe32c4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256444, "uuid": "b5a0ed36-9d95-4f2b-9981-b6da3915a9c6", "comment": "Malware payload (Mirai)", "value": "8d074bfce876f4c76d6d71fa6f7dc2e4a7343b74530f877272a6a82b11e23aaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256444, "uuid": "0e5c8f30-200e-419c-a530-3f980e9589d3", "comment": "Malware payload (Mirai)", "value": "a64461c79fc53fd35d87a51746b1e4ebebadbd34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256444, "uuid": "4f7809d0-8175-44f6-b708-00b24da20684", "comment": "Malware payload (Mirai)", "value": "a801e61345e1fa87aca35b15f90f18e692327a3751641d35d055d5a670731a74fab20c25e3cd32688db9704e0ae8564b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256444, "uuid": "074a2548-fa60-4569-a954-d3c77af647d0", "value": "T1F9F2F1962102EFB185F55CB6A91981452AE00F7C70FBB2B772354E89E2874433E79793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256444, "uuid": "676e79ff-7a7a-48cc-8d08-7ec81c68b734", "value": "768:Ps8gOvvs+q82wwPweu0ytWXFKiMgTF2LOGylZBDT/crDhMou9q3UEL6k:Ps8gOvvTYwWlu0ytWRvTF2UP/crDZTLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773256444, "uuid": "f018e7ee-3d3b-452b-9eaf-d0aed25dd52b", "value": 37240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773256444, "uuid": "17b99d48-d3c9-4fa4-a35f-66654065a651", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256444, "uuid": "d121c432-50b9-42d9-9fb3-00b7a4992f5f", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785128a3-1d20-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773216071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216071, "uuid": "fe70c143-10a9-4604-95be-24bd936de170", "comment": "Malware payload (AgentTesla)", "value": "b503da431d908851cc1fffd5e03354e6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216071, "uuid": "fa823cf1-c886-4b63-b6ae-33db6298d2dd", "comment": "Malware payload (AgentTesla)", "value": "8d3f8d779214180dbb96f21428064783885225f7afd8dc1d4328c0576c16c4a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216071, "uuid": "1cf4cc33-0304-421a-b25f-1cb44b018892", "comment": "Malware payload (AgentTesla)", "value": "64d31d44b8639213ef64f58414ed32c9c2f86bf7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216071, "uuid": "2b1f795b-3333-4fad-ab68-389dd0daa800", "comment": "Malware payload (AgentTesla)", "value": "94bacd91560dd74f44cc251fc6a42c59c641c14780e55212fac40b47fe36a046543e53eb5cd1d95e4b19ff2bcbe75903", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216071, "uuid": "43b0979c-866a-4931-8163-492af060f697", "value": "T1B02502A82566E807C55A4B384D71F67453AD6EEEA401E3636FEDBDEBB871B011C04383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216071, "uuid": "4a82e3fe-8dc7-4659-8aa4-8a4df3d7b9ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216071, "uuid": "a627f277-fd01-440b-a28b-159165b02d4a", "value": "24576:nEKLHtvw/UrylY/OQLvFOsYi3KONNCyAY:EKVwcWllQLv0snaOz7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216071, "uuid": "51190d4a-48e7-4ef7-ba1c-daaf2619e419", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216071, "uuid": "2a1c88aa-9976-4b76-8634-9e1ebac5eac7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216071, "uuid": "e0929d72-ed06-4294-a550-70ca7cfd57cc", "value": "b503da431d908851cc1fffd5e03354e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb6a1d37-1d18-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1773212829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212829, "uuid": "457d7dca-7214-4dd5-95a8-6cf25933ada4", "comment": "Malware payload (QuasarRAT)", "value": "21802a4e9dff98cf85bb6c978bf52395", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212829, "uuid": "16967a9e-eec7-4f4b-a075-d30bc562c6f6", "comment": "Malware payload (QuasarRAT)", "value": "8d7041ff5a0d74c5e24fd22a06a71c247dd16d880c65827b148533f71516fa6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212829, "uuid": "63fb8bd7-6c6f-482c-b3d5-8a262fcecf72", "comment": "Malware payload (QuasarRAT)", "value": "af2b648640908d16281a6888d3418934ce3deafb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212829, "uuid": "72e4540a-37ad-4239-95f9-9ee68e857c59", "comment": "Malware payload (QuasarRAT)", "value": "dea2bb1ba66e768449cea382bf4040165fcb0b95bef01f1e922f16bd8cce948fe4184be58ba46df4e7a677d7a7be5c08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212829, "uuid": "caea231d-6e2a-4b37-93aa-14d0eec10673", "value": "T1DCC65C69A3252A6CCC10B0BD694D0CDA5C8D4838929FD5F39BCA991F0037E774EB8767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212829, "uuid": "34038502-e7a2-46f9-b260-5ca935c52176", "value": "b2c46434026ebbd6efbb2d550f74cdbd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212829, "uuid": "18d8c542-3c8c-4771-9640-563842fee228", "value": "196608:LpV3hGGLbOUn6AIq5qfctNVYOqg6M7+g+dNFFJllllV99BVVFF1llpddVVNVV512:FRhGGLbOUn6AIq5qfct8Oqg1+dNFFJlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773212829, "uuid": "c62e7b04-fbdf-4e74-8531-515f9dcecc27", "value": 11860480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773212829, "uuid": "49f66686-62e2-450a-aae5-8581c55cc983", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212829, "uuid": "2df9914e-ec55-40c1-9530-aa102dde2b1e", "value": "21802a4e9dff98cf85bb6c978bf52395.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c012329-1d26-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773218547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218547, "uuid": "4d0d96ea-0210-4471-97ba-044fc049b78b", "comment": "Malware payload", "value": "90c59e9620a8da4e56a7f61fd188d908", "object_relation": "md5", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218547, "uuid": "5e73ea87-ff8e-4b41-ab93-308c9f19fe00", "comment": "Malware payload", "value": "8e53683133e7e1ddd1d8728b6ba8b9b80ec40f6772422c8adc8002bafe553f7b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218547, "uuid": "7134cc19-7e10-4246-ba64-7c5bdfc2f531", "comment": "Malware payload", "value": "3f4852ef07988b870b68e16c802b6e2b256e0b72", "object_relation": "sha1", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218547, "uuid": "4eb1bfe5-d720-4200-a26e-575277a44744", "comment": "Malware payload", "value": "5a4af669487b9e2938e135c857accb4ab09a91f51e3da42284354751bec021c08ecc13b6fe4a82817a02f62d4ece6fae", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2026-21509", "colour": "#F71FF6", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218547, "uuid": "d4039e07-1df8-4cc1-b372-b2b73c309c79", "value": "T1D86422A5F68DC627F56F08B9086B86922D67FC49477D1B43259D7C88EFB73A0990034C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218547, "uuid": "0657834e-cc0c-495b-ad14-0832d374ecf5", "value": "6144:bChPSjD5CtL+VEUYgF7wBkLgh77tPKBisHpUeHa2xFIzRTPT1:bBDQFtRCUBtNtCbae62xuRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773218547, "uuid": "27803978-ac4f-49aa-9dcd-13187efdf75b", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773218547, "uuid": "21cd9fd0-7b6d-4457-89be-bdebe273d6a0", "value": "application/msword", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218547, "uuid": "ed9f976b-e45c-4309-b802-b1e742fe131c", "value": "SIEHS Document.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35750bc4-1d45-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773231851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773231851, "uuid": "781f2c79-b49a-41a5-bf7a-ec841698095c", "comment": "Malware payload (AsyncRAT)", "value": "fb3095f8a4e85f83b17e8680d68145ab", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773231851, "uuid": "690663db-8e47-4039-a905-e4882b631b92", "comment": "Malware payload (AsyncRAT)", "value": "8ef8ea431b2ac612a6a556bd9e663fc2887f9b0499cf811eeb8b106f6d3c28f3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773231851, "uuid": "2867f036-f860-47e2-a2c3-ef4410c64370", "comment": "Malware payload (AsyncRAT)", "value": "29cba626cbcf2b14f8f2b75d76b780210e137c3d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773231851, "uuid": "e56670a6-8ecb-4a0f-a04d-bea6d3ac5e5d", "comment": "Malware payload (AsyncRAT)", "value": "a5ce869ce92d3a527416f9a93da197ef1d1170a4a9fe364e1b5643a99446442e4708071255b550baac0ec07305e19117", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773231851, "uuid": "f6737fef-12d7-4e76-ae68-b1ccda5838ac", "value": "T1E7033A08B7F84965F2FE5B7D8D7282005335FA579D22C79E1EC4508F5A63B88CA24FA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773231851, "uuid": "f4ec4e30-fbb8-4a58-b139-e22f5fa96412", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773231851, "uuid": "3ec351d2-ae9d-4bd7-a9ea-32c457a181f0", "value": "384:q7DC9cMCc9mYcbktl52bnTn8QHmp2M7739393bayse6QxnC7O+WRl3uuhGfrNP7p:qnCIc0YPlUbTpwFRbJpB+WWP7Lz1Uj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773231851, "uuid": "414a5fae-ef4e-4c6e-810c-88db6e95719c", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773231851, "uuid": "66af6b00-e306-4df3-b92c-863c59b35522", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773231851, "uuid": "85a8d1ea-a263-4e49-9a12-bc62b1110b23", "value": "PhishingRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aea8c858-1d19-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1773213156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213156, "uuid": "1bf61087-b57f-44f6-96a4-802659d25855", "comment": "Malware payload (SalatStealer)", "value": "978bf9e76249b6a4a03893d6963c4cb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213156, "uuid": "662aef86-c6b5-42f6-97df-53d3d62fccea", "comment": "Malware payload (SalatStealer)", "value": "8f857b06d1794f821f1dfad1c7ae2b57f93c6a8b17d0170b46ef4f3c08fc6986", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213156, "uuid": "31c3080f-bee9-4795-ad88-15d2a2bf9f3b", "comment": "Malware payload (SalatStealer)", "value": "f99cfe30549d7bb164bb5c28562ea76af840a898", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213156, "uuid": "fc367d4f-05a7-4162-a310-793531f0670e", "comment": "Malware payload (SalatStealer)", "value": "b446b78e0659a59bfafa0fe0d318f5e3bb76d7090a881a1847d013de4849b30464182c5401347aebc730f30ed9ec56af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213156, "uuid": "bba39502-80dc-427d-b2d0-b0f40dad4b58", "value": "T160B64A59FACB54F5E9032831416BB23F23346D048B28DBDBEB147E6BF87B6911C26605", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213156, "uuid": "33b0e27b-8535-47b8-a119-8b3ac1ece71f", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213156, "uuid": "fa70cac2-5d61-4f6f-8109-1439214c8052", "value": "98304:AwYcyw58KPQCdIhkAai8P76ZGbDuAbWJp+G0Zd0uhCrN8ySt:R5GgVVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773213156, "uuid": "91e6a1cb-120a-4ba5-95b2-a9e8ae3e635d", "value": 11420160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773213156, "uuid": "07617af0-fe7a-43c4-8309-207c01ee1d54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213156, "uuid": "6824d25c-18e8-442a-a93f-98dc66ee6c7f", "value": "8be048e31c7366426ad824d5feb5194d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3caa566-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773217084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217084, "uuid": "49d45f0a-3521-445d-8976-be24dcec9b74", "comment": "Malware payload (PhantomStealer)", "value": "a42120f62f8edf79ce08862437653a18", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217084, "uuid": "ae1e8cc8-3ec5-41ed-968d-7585c02a6e42", "comment": "Malware payload (PhantomStealer)", "value": "8f931f2d508a25939ac53803d9293feb9ca59c819c9a4add2dc1b78e9c93fd07", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217084, "uuid": "4157efcd-233c-4a38-a376-a32db3ff0293", "comment": "Malware payload (PhantomStealer)", "value": "78404f7f6d9834183a2e04239f49f4e28d82aa78", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217084, "uuid": "76929648-5cc1-4e1f-a75a-ad95847a2f53", "comment": "Malware payload (PhantomStealer)", "value": "846782f1914693701ec8895dfaa72ef2bc0ccb5779ac6941546be3e63cd577030c194193399391d40880d09e791e9a39", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217084, "uuid": "b18701f2-5198-45b6-b8c7-072ac7e34761", "value": "T1E4D2218D2EDFB528425A347B2D6BB09AF52E8C4C745C805CEAE71CC2F89D709C47B564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217084, "uuid": "f3d56c43-d9d6-4486-a30e-2d816abe612d", "value": "384:TQA3dcP+qBoaMModBG8REafOHlmm9O5vPsKbJhCKjtjyUPMfeM:TQEd0ZBXMMolCSOHF9wbJhhjyAJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217084, "uuid": "b13064ef-b21d-4151-b44f-51b6a3988134", "value": 29894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217084, "uuid": "1d8f0af9-50de-4df4-a791-55abd6c6e7c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217084, "uuid": "659bc725-9ca4-49c8-9336-f617ada30ea8", "value": "a42120f62f8edf79ce08862437653a18.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5702f861-1d61-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773243933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243933, "uuid": "a8d65e1b-7406-45c1-b640-62130f708c98", "comment": "Malware payload (AgentTesla)", "value": "4a2c50e81578f5d30589eb0f6e8de65c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243933, "uuid": "5a1dee4a-2001-4cd1-9ef1-4c6abb0f4ec6", "comment": "Malware payload (AgentTesla)", "value": "900fb30b0268a1074a5d9935a722d793d2a24c6c7d82e089583647a14fdcc6b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243933, "uuid": "61f8be86-55a5-4ca4-83a6-918beb5cdc8b", "comment": "Malware payload (AgentTesla)", "value": "2839dd6c7bb8cd4aa8b6647d5a636fedc9fa11cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243933, "uuid": "eee757d1-2a42-43c0-b1a9-cc23268e6ef2", "comment": "Malware payload (AgentTesla)", "value": "c096a62888a0295b9ecdc27b17424dbb6634a417197aaaaaa5aac9d9faa2e3f3356c9d97c9de182c504fa945e5c7295b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243933, "uuid": "1ab55d8f-c6d7-4cc7-a265-36e6cd17ab71", "value": "T109557C55A26BAE06DB97E320C4C536D042909C89F8EEC37A9F71B9C14ED4A9D041B7FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243933, "uuid": "611b1abe-2c25-48c3-8cb5-e58eab243282", "value": "24576:U0lE/dms6v863I0sgCUp/7biCjqSQfTZjNqz1/mW4SMp:CVXgI0sgCW7ofTZA1Cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243933, "uuid": "14943b04-896a-4762-a034-104bf2403d8f", "value": 1343384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243933, "uuid": "67900d3d-2c51-4419-afc6-cd54380d089b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243933, "uuid": "b8fd0e90-7f87-43f0-851d-e8668f617371", "value": "Transaction slip.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2bd482-1d19-11f1-a769-42010a9c0008", "comment": "Malware payload (VenomRAT)", "timestamp": 1773213123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213123, "uuid": "16c144a3-1a39-4871-a324-9ac1525be016", "comment": "Malware payload (VenomRAT)", "value": "7dc1d0c57750ff4426f0dc1e887b99d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213123, "uuid": "df9084ad-3a16-407a-a8a2-2552ead82a9f", "comment": "Malware payload (VenomRAT)", "value": "9100e92ceb94455d3159c4273b47a4d635f1d6b8add68e7c775e1849d3d1a9da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213123, "uuid": "560fa5bd-cbe9-46b6-b07e-a552dbd40214", "comment": "Malware payload (VenomRAT)", "value": "97f4a82d2cc6310d2a634328c71570fcc432996c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213123, "uuid": "d852030c-2a75-4808-a2ee-2352a464e4c7", "comment": "Malware payload (VenomRAT)", "value": "b58388a2476291a0af0463b7d41c62a50e14c4ef821dc7c9f624500447b1510d8245ea72c3d8f292890f71d0f2f5f2fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213123, "uuid": "56837e78-2087-4e69-902a-d95bd6fab98f", "value": "T1DC834A013BD88859F2AD4B79ADF359060EF8E9236002DE5E3DC414CE6E77BC585076EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213123, "uuid": "52e6be12-44e1-45a3-bf8c-6366500393e9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213123, "uuid": "f64da043-b212-4ef2-9817-297218f451ab", "value": "1536:WUxQcxHCapCtGPMVtk2taOILx1bW/gQBQzcJ90+4QVclN:WUOcxHCoeGPMVtkNDx1bWHQd+4KY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773213123, "uuid": "aad8b4b1-a894-42e2-956a-79987cbbf32b", "value": 87040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773213123, "uuid": "b7e9510a-7434-4cd6-95a8-c64ce84341ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213123, "uuid": "ca776f25-0b5c-4974-a0f2-2313a38ebc1b", "value": "7dc1d0c57750ff4426f0dc1e887b99d0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f97ff1f-1d61-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773243947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243947, "uuid": "fa7dffce-09e3-4163-a0f9-eb0020d736cc", "comment": "Malware payload (Formbook)", "value": "53d55a3675ab1f752e8dd9e98f2cf8e9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243947, "uuid": "2cd13255-af93-4f5c-8f8b-734620f1e5a5", "comment": "Malware payload (Formbook)", "value": "915a73abac69dccfa57f93ed1a98b46669b0c4d9ff8ebd4552ba1243d33891bc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243947, "uuid": "cd46725d-8277-48a2-8f2c-2ee170aa89e2", "comment": "Malware payload (Formbook)", "value": "d66ea9fe854f25ce6c0a3c4cd7d49f79ae3e81cd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243947, "uuid": "46d987c3-60f6-497c-8c83-2146cc8e81ab", "comment": "Malware payload (Formbook)", "value": "8a1e0ffb187188c35f04a6f07919b44780d23355b8b14814aa435a6b3d75988363df394194f2f08f386b09f7dbcabc6c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243947, "uuid": "e7d630ee-85b6-4066-886f-5020f21329cf", "value": "T1E095B0124DC2771E07D0584AE8F9037F2385EECBE58FEBAE5025F548B2EE529A5271D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243947, "uuid": "0653ef98-8006-4a2b-833d-afb0f4813574", "value": "24576:FpOtMqVWIZxRG1Sse4JVkxBymv09tcTiW0Q0RHT7OZkPAtjIh2e8ztgMu/:kbcBICDTWkzR8id", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243947, "uuid": "6afefda7-a1ec-437f-b5dc-f4783d548560", "value": 1991062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243947, "uuid": "3511ce7f-7d05-4b48-a91a-c358eb083f9c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243947, "uuid": "9d5fb30e-400c-4dfe-88b3-0e87f55a9075", "value": "Purchase Specifications RFQ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa59c2ec-1ce6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773191245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191245, "uuid": "9bebcb45-bb04-471d-af71-9560a4d567da", "comment": "Malware payload (Mirai)", "value": "3f8a23ab61fd310045dccf29afd61812", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191245, "uuid": "25e611cf-1b09-48f3-b796-5760d079319f", "comment": "Malware payload (Mirai)", "value": "93150b96fa334f084a6f3bcef26016ac77f861f0a31b188ad9b1d0fc06397d05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191245, "uuid": "776a9b44-6ec2-4172-967d-56acfadf305f", "comment": "Malware payload (Mirai)", "value": "d6f6d87325689eea293e27a84de90b35428f1446", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191245, "uuid": "b2331b37-14d7-4d82-b097-950307e29718", "comment": "Malware payload (Mirai)", "value": "952201ea2bdbbc2a9c5dd8e2e7bc7e0e3da8baeaf3fbc8aee9786b3fe97b1f0a6e4839bea922f919fbef09af5ae5beef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191245, "uuid": "a6187d71-7d83-49b6-9fb2-8419fe66e3fa", "value": "T1B3F33B46F6408A13C0D6177AB6EF42453323AB6493DB73059928AFF43F8779E0E67606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191245, "uuid": "967d5bb1-a6bb-4158-800a-4cd834997c7d", "value": "3072:SbzuII9vKpSaKJS4BHqmUoq1+7pTyVINSLZJiM/9b5J:Sbzu2SaKJS4BHqbob7ZyCSLZQM/9lJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773191245, "uuid": "dd842044-6eb7-4dd8-80c4-3d2c7fa51954", "value": 160442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773191245, "uuid": "f7b20cd4-9530-4bd0-bc76-3de13de845e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191245, "uuid": "97130697-47dc-4f8b-819e-87bb6a4518fb", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f570869-1d55-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773238900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238900, "uuid": "1948f529-dc54-4272-bd6e-0f6a1cc7364c", "comment": "Malware payload", "value": "4c62db8a50d991d467e2888d8779e0c6", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238900, "uuid": "0a8a392f-7830-4f9f-85e0-09ab99a54e6b", "comment": "Malware payload", "value": "931d4f828ecfd320f14eefb9857f9750d33d995c9570ec1f10b978fe74dfd760", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238900, "uuid": "c39ff50c-8af8-4f01-b9ed-14b3ba6c1350", "comment": "Malware payload", "value": "f20712e6276d13c6d561940675d1a3e741b29343", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238900, "uuid": "1056131c-58e4-4e90-980d-3ecf59cf3be0", "comment": "Malware payload", "value": "52daee2595785db338fae279239c10f952f3185ef6353889e4857073badd8343b9a5700c20c138a7c571154035eff7d8", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773238900, "uuid": "6859de93-8bd0-4c71-997b-ab85a662ab9f", "value": "T1FFC3DD9907AF8AF8E147BC54CA8B0502AFBBD413051CDAC4FE2CF6EA2F48559D1E58D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773238900, "uuid": "213c8cd2-b67d-4f09-85e9-f5a70d16db3d", "value": "1536:B1wRJai7FbJUkn1Heqvr/iAmKb0a749cHlUvcQ9cNtLvbHHJfWFPBN97VUlvoud:Koj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773238900, "uuid": "af07822b-473b-41be-8518-fd5c5bee5255", "value": 122097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773238900, "uuid": "4e9da5e9-59c4-4784-9352-38926ca8ca55", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773238900, "uuid": "66e3ec03-c23d-44ea-b1a1-c729007aabbd", "value": "Logs_Office__53.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f7e6f9-1d18-11f1-a769-42010a9c0008", "comment": "Malware payload (RatonRAT)", "timestamp": 1773212717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212717, "uuid": "33a76743-d840-45a5-a7bc-d8c0636de147", "comment": "Malware payload (RatonRAT)", "value": "468869a08a95e4b4543e9666300521f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212717, "uuid": "e2493b2f-c6df-4290-85d1-9cc1fbfbfce4", "comment": "Malware payload (RatonRAT)", "value": "938670650e7b5b498cafa10cb3df73b76ada493b366e5cf5effed73815c44bc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212717, "uuid": "a000d607-ac11-4ef3-8c40-34327cfadfb9", "comment": "Malware payload (RatonRAT)", "value": "406fe3127d1b2c9b837bb64b27123532abbf942b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212717, "uuid": "bc1dba0c-6641-460c-b593-bda0deba5bb3", "comment": "Malware payload (RatonRAT)", "value": "a90f920a7cd13720aad8123330d9635fc7f9ad92cd9b212152263b1f99d44efd9c7751fb7c95c1adba791a50c201fd3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212717, "uuid": "1271deaf-badf-4378-adb8-c1fd9b20a2f4", "value": "T1F006CF017BE4DE1BD16F57B2A0B257100771EC95B752EF2A19A036EC18B3780AD1A39F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212717, "uuid": "708a2808-712a-4f52-98c9-06543762e5c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212717, "uuid": "2fb2d1ad-1dc5-4f1a-8db6-774259ad263a", "value": "49152:blm9N8DfgVUBsHjkmiGWU5+5WeLGpMZ7iKPyg0asWfTSwgW:rfgVUyHjkDGjYQeqpgm4NfTSu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773212717, "uuid": "7213b5c3-34ab-4c85-b273-9822a9d23a19", "value": 3714048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773212717, "uuid": "341fe916-2c58-4e89-8f66-dc408c6beec7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212717, "uuid": "14b28c4e-d8c5-466f-8324-52b64e012f16", "value": "CaelusExecutorV1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b5d5c1-1d87-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773260285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773260285, "uuid": "c6e381ec-062f-489c-95dc-c1cba65ee90b", "comment": "Malware payload", "value": "a13075bef2a9158a5e2d4f3b98abe66d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773260285, "uuid": "758bcbae-44f0-4317-b7a9-0515fe5ae9a3", "comment": "Malware payload", "value": "938fc046ea8c8fe5f73a1213828ec110c25bbd96df9d22b313971230fdac6648", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773260285, "uuid": "a6ea3170-0f2b-4c2d-b01e-6e36ce15dc76", "comment": "Malware payload", "value": "4a2ba47187757e2adefd4775a03774988799d221", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773260285, "uuid": "e99c99a3-0b33-485b-a1ae-b304dfb32568", "comment": "Malware payload", "value": "968c7d8a2bdc52444ddc533488be01a40924b5405a1c821e8984ff25829b6dc69ac134a669b2aac3f3ff011cbf300382", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773260285, "uuid": "c17c654f-ffef-4116-8d5f-b74bc8de4a47", "value": "T1A5B326C54E9FC0B5C67EA436AAAF8C07DBD5951E120D85613B5F9948AF23B1CA07C3E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773260285, "uuid": "985b42d5-afea-4ddf-8d87-1a91aed4cd64", "value": "1536:qtQ6QkWIqoS0jwKlYmdl+vO45id6687COiEkxChn:qtQ6hWF0jwK+kl+zl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773260285, "uuid": "593bb447-d0e7-42ca-b960-0dd61484575c", "value": 111534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773260285, "uuid": "829cb535-7630-4f18-948a-48f4c9b417d9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773260285, "uuid": "05757134-842f-4f40-99aa-aa09a4e83118", "value": "Build_Clean_v3.2.jpeg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8acafd08-1ce6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773191192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191192, "uuid": "ff2d894e-2ccd-4f49-9678-13cda2304127", "comment": "Malware payload (Mirai)", "value": "1752e0302d654a1a6fab6880047beedf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191192, "uuid": "892469e4-b6f7-412d-923e-045358707257", "comment": "Malware payload (Mirai)", "value": "93b23bac5ea8cd4bfdcd435d23fe604bdd8f0b92b9400bdb9ef2a28d7a100dda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191192, "uuid": "d27c81dd-9ecf-4418-9f5e-00ebf88fabed", "comment": "Malware payload (Mirai)", "value": "90de4a87a6d6188fd7e52aabf8aca44e57eb6fd5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191192, "uuid": "22345e78-02ba-4750-a749-b98d730dc123", "comment": "Malware payload (Mirai)", "value": "2f930862e8eec899ace4525d553a60e72958ec20de6fabd9c3ca6394a69382bb292ae2d8f93c5faf3d897ac1a2dc00db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191192, "uuid": "402f050c-3f3d-4364-af11-66ef1f7970a9", "value": "T1BF03F16570C55CE1DADC7A73BD7D2672EB24A0C2A20A168923158CC4D76C252BD4E0FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191192, "uuid": "8c07ac9b-13eb-4072-8b42-59b42d0fe295", "value": "768:i6bMN2q8qb06Ds/8ywvgI6tXW2IQXUkwx4igsA8/STJusQDKj9yQWl:i6gzPb08y7IKszq78uJurDKj9yf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773191192, "uuid": "a4b6ec64-5faf-48a0-8302-a94b0f80c503", "value": 40032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773191192, "uuid": "101d8250-87ed-4f15-8139-ce2ae59e1f81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191192, "uuid": "e06bbf59-6d0f-4c03-a495-d1d18a912d15", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b46eb0b-1d15-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773211352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773211352, "uuid": "9bd5986d-6b7a-4d1c-aaf2-2c46e2826d01", "comment": "Malware payload (Mirai)", "value": "51a1dc3962d2cc9c284733197e59f5e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773211352, "uuid": "35d2330b-450f-4da9-aa6f-5fa8dff9b37d", "comment": "Malware payload (Mirai)", "value": "9435f5f34f606fe496c779c808b033d86c63b2a71a2b7d3c6617c43df9226762", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773211352, "uuid": "98db55f8-74cd-435d-b4eb-578d3b9a6d6f", "comment": "Malware payload (Mirai)", "value": "1103433b3aed2ed15667aa83ff875e9edab3019b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773211352, "uuid": "d66b2b37-4119-4df4-9e2e-bf0a49cb3b2c", "comment": "Malware payload (Mirai)", "value": "ecb8c51e7e0bef73df0aa9d8bab5d6fd65d4e9d9770586ed61a640899128cd2677bda5186d7bfca86553971f995d9e24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773211352, "uuid": "97771fbb-f85d-4436-8d7d-06b9a6f10844", "value": "T1AF145A43EE890EDAC867CDF086BF835B29E3669B88D1F1F4543C8C1C795D19A45E3688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773211352, "uuid": "e8bd7ac0-ae39-4c01-b9f6-106c1777d642", "value": "3072:I2LhkfBjd683WpldBT73KWXBYsO3l0BI/u0S5cbK5i7/a4ZfEs1yRnUq:qB53QHBT7anHDS5cbmU/nX1yRnUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773211352, "uuid": "1e8f1e33-4fe1-406f-965f-c19f6cc932f3", "value": 201124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773211352, "uuid": "2dfb60ba-8c26-4e77-ad4c-b3ac07846808", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773211352, "uuid": "ee7b077e-a1d3-4d88-afa5-23885c28420a", "value": "data.mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364c8bc8-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217679, "uuid": "45990125-f1eb-4e8e-a42e-0788a2cc0077", "comment": "Malware payload (Mirai)", "value": "022f8b8da885f4686c39a2afa494113b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217679, "uuid": "35e3ba19-0420-49b3-917d-5f8660ea3f65", "comment": "Malware payload (Mirai)", "value": "96b3fb6c037e47fdfe5fc1378ec6de36ab49d540956a30cf4b85923446c60b3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217679, "uuid": "2ffa57d1-4f80-4f74-98dd-74fd7c5afeb0", "comment": "Malware payload (Mirai)", "value": "7d2448482b850ec794e866b2ccada430eac6c3fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217679, "uuid": "3b41969f-8fed-4207-9286-5e4b3bc0a197", "comment": "Malware payload (Mirai)", "value": "10fdfaab2fa9081eac6ceb598a03195642a4bfbdc5c05fd025e628c2cc66ece31f7d372129c83deaf7a10cadc421140f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217679, "uuid": "08fe7fc9-aad7-48b0-9511-c3e0d6b3620b", "value": "T1AEA53326D02BEDFE422BAB5601503E99DDE8D5F494D886307110FE7ED5826F422EE2B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217679, "uuid": "41c512ef-9ad2-46ae-843b-434ae7da4f55", "value": "49152:wUyhGbhOeWxxVrFRfI/4ToLPKPtox7kskGyv:WohOfxxVrvIQT4KVoVkD/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217679, "uuid": "bab31f43-0485-4dcb-9878-2c2c0397b3a9", "value": 2264904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217679, "uuid": "33108f17-9cb2-4952-be6f-fd3240410f10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217679, "uuid": "470c01ed-1717-46b9-8f79-a6b817fed72c", "value": "kworkerd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea16a160-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773217121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217121, "uuid": "68dc7b81-3e22-448a-baa2-6b0d7ca7c82a", "comment": "Malware payload (RemcosRAT)", "value": "489bdc5b4aaddfece566f9519335f8c6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217121, "uuid": "e186f7b2-6f76-48ac-abe5-8b15d9933706", "comment": "Malware payload (RemcosRAT)", "value": "96f1b2bdd15ead0983a4e8a82828cb69a504f47c32ce1688466565a1487af4bd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217121, "uuid": "316ed0ba-e956-4420-8e7a-6d58586cac6f", "comment": "Malware payload (RemcosRAT)", "value": "18d000a19c70fecdf7d8367fe8adfdd800855dec", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217121, "uuid": "308ec706-be56-4310-8524-1ce98cced486", "comment": "Malware payload (RemcosRAT)", "value": "5c16f5604bb08d503d0a7fab970640244c89a3c99aac98e4f5f0bf1e3f625855f0e4443aa433be365a83ed46078d8272", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217121, "uuid": "5b064e15-3e28-4a9a-b4a3-bbfeb77b550c", "value": "T107E5C0825FC47639EE5AC73576FDA02A87FAC12EDCC4969B29233778ECCB7255106804", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217121, "uuid": "ce6eb102-5e06-4a86-9db0-21ed07be557c", "value": "24576:VVjqM4TMqReBKxb+IAVR9jPmer/KJxQzI8Dz13a2+dOrd4KnMHi9H6z6xIg22WsM:N9vKHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217121, "uuid": "07fb6dd6-0e9a-4715-b852-affbcd9eac3d", "value": 3288034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217121, "uuid": "7c30dd5c-2e54-4887-9ae8-36d6985b6e2a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217121, "uuid": "253d1fd5-b549-4c88-9b73-758055a894bf", "value": "489bdc5b4aaddfece566f9519335f8c6.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a150168-1d25-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773218195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218195, "uuid": "fd5d1693-4e9b-48b8-bab2-3369416d0ed8", "comment": "Malware payload (GuLoader)", "value": "785e36e52849512bb9b55e02b290291e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218195, "uuid": "6368c692-14cc-4473-9325-12c94cd0f6bb", "comment": "Malware payload (GuLoader)", "value": "9a295f144a635f69749c353220f2603450cfee2ebe299c9e221325903e9e0280", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218195, "uuid": "5e8bd848-ee9a-44fd-868d-c8def76c71ca", "comment": "Malware payload (GuLoader)", "value": "1f6a1c8221b10b489e333c3e4154518526bdeee1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218195, "uuid": "e05c6021-2f42-4146-8877-2255a92605cd", "comment": "Malware payload (GuLoader)", "value": "01bb0f938695dff70793cc2f0bb23943dec42577cfbb6f783283deea027a56aecde41913af2d2198928efe419002e381", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218195, "uuid": "c98216e4-c6ea-4965-a583-6a097c71553e", "value": "T133151239F2C9FA27C00655345C7AE62530F79E40965C4F2E32DDF91D3AB33885A84B9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218195, "uuid": "d283cb4c-4d17-42e2-b753-3c795207a5c1", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218195, "uuid": "9cbc6153-650a-4de5-b827-b1f8d72e88a7", "value": "24576:XT+ZnK9XZVF9MJGc+pr1Tz6g7QDsubx/GpO5Jk3TlHYmWRu:XT+ZKRZn9dz17GxZk3TlHVWc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773218195, "uuid": "276b8954-e186-455b-84db-27c3ff59f16a", "value": 958792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773218195, "uuid": "edcfe78b-e4ab-48a7-8ea1-7a72fc1967e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218195, "uuid": "6f714e35-e773-4ba1-a661-c3a981e773d3", "value": "Receipt_Inv_12345_WinRAR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c608488-1ce6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773191194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191194, "uuid": "3b7f7468-f18c-4a6f-bb2c-a192c098cd83", "comment": "Malware payload (Mirai)", "value": "a0f3a6d8911e4754a7de8f424a2d1a77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191194, "uuid": "f0ebea73-e5e0-4afb-99d8-dd809d524b1a", "comment": "Malware payload (Mirai)", "value": "9a7d4e38fc85a72456e53d87d8c9f566d9d298f930ed3be442a1df852e341ab9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191194, "uuid": "890ac27f-06c0-4e0f-a58b-eaf41c4c197e", "comment": "Malware payload (Mirai)", "value": "efe44ce8902e77c243913a3ffbca608a89bb1de5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191194, "uuid": "6e09689b-60d4-45b8-84c2-f026fde4fc8d", "comment": "Malware payload (Mirai)", "value": "e6b77756c40261b7fd38ca1df8e247994dd22c4a62fa529e10eff71929c55cf641073375ee9ed90752e194f831edb151", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191194, "uuid": "4f8be4ed-b49c-45fe-960c-86d8e608a38f", "value": "T1C5530284F05DF3C09AD00E7DD37646A74C686DB8C2EE705312B5960045972E7B2BCAFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191194, "uuid": "aa0d94e4-7628-4f98-9454-61ff063c3b01", "value": "768:4SalDl+sgnyDYtAV4m1ETCDeoqL2VBye1dqjrOR9q3UELLPPk805d6cvUMQ4tFl4:haBl+sbDYeOm4CDR5d1UjTLNtcv64rO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773191194, "uuid": "6e0eb639-2543-4c65-90ce-6219b02ffe03", "value": 61852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773191194, "uuid": "b99fec5f-8cf2-4404-97c0-95c318519649", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191194, "uuid": "f4a49147-7213-4f8a-a008-60501d39807f", "value": "parm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d5aa02-1d5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773241060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773241060, "uuid": "44d35b15-3818-41ca-9618-d84c74da4df3", "comment": "Malware payload", "value": "91da59ed75238c2f10c4ca2ad3ba655d", "object_relation": "md5", "Tag": [ { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773241060, "uuid": "c585edac-da6c-4dff-adca-bf0bb5115a00", "comment": "Malware payload", "value": "9b19124beeaf2e77aa0eaef6195644881902924e312e18b064b03f0211a38ae0", "object_relation": "sha256", "Tag": [ { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773241060, "uuid": "f0a975eb-a5ce-4c07-9004-e31fbad75bb8", "comment": "Malware payload", "value": "a1c4357d451846a3e869292c79066a2c307ee083", "object_relation": "sha1", "Tag": [ { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773241060, "uuid": "4b839477-c69a-4082-934f-e8ef91dd0f82", "comment": "Malware payload", "value": "4c0b1ee423a9b1f96ec2e33ecebb79e0eca2db035a8511e7e237a9a24dddbb06c1a0ebfd0007d167600e816047324fb7", "object_relation": "sha3-384", "Tag": [ { "name": "fullsofts-org", "colour": "#B2517A", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773241060, "uuid": "e4b6f364-2568-4edf-b79b-5680c19cf82a", "value": "T1646733C6D4518983C8B5837A84A45269DA50BD2687731C3B3E1E33BB59F77E43DB880E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773241060, "uuid": "0294b832-6466-4d4f-a888-45842a37c9a3", "value": "786432:LlLmYf16H/ZnUoQGwtUt7dhOklgEMaFrrpfH56JH:RCY4HybrtUpOhiJfH5QH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773241060, "uuid": "aaedf077-cb89-423b-8ebd-0528433bb739", "value": 29859840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773241060, "uuid": "4904888a-0605-4a51-94b6-b31c8f1a88d7", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773241060, "uuid": "5b5750e9-6b3c-40b4-9c44-37cb3a59039b", "value": "t9igncnek5.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f875373b-1d73-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773251935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251935, "uuid": "0a0c3e94-b75f-4b1b-99dc-00628f2971be", "comment": "Malware payload", "value": "7c0be1313442f3457e83ffe51cf04e0b", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "IDFC First Bank", "colour": "#AE5266", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251935, "uuid": "f39789b9-9897-4045-a714-9547952efa33", "comment": "Malware payload", "value": "9cd9c9469367f2b606f237ffe83dde2a4e8dcef74106f8e8985f4c9bfef202b4", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "IDFC First Bank", "colour": "#AE5266", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251935, "uuid": "43033536-5368-43b2-9431-d3c040680578", "comment": "Malware payload", "value": "1e58dcbb0e1c226b01ba0e801ece1670834eb48c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "IDFC First Bank", "colour": "#AE5266", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251935, "uuid": "459800e6-d334-417a-a1a5-d1f01548758a", "comment": "Malware payload", "value": "d2e0a45bb915e523b57b3209ece8ba42daea632bfc701b88d316459d6315f36b4079d6794dc4433c3a634be76ae4b468", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "IDFC First Bank", "colour": "#AE5266", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251935, "uuid": "63bf7e99-d349-4f88-a22a-dfcedee2c24c", "value": "T103F6BD23F5056996D9D6A235F1E7279133301E540393A279270FF02AFDF25CECA66AC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251935, "uuid": "053b342e-235f-49eb-b169-929e1dabf63a", "value": "196608:HprRlpa2XcDOGaq8Kuj5AMbpWSyBEtI7bIcPgCCQs0SFMM0t2KeTACmWqGCQQITF:JrRlptcPmaFSyWebfPbnsB0t2Kn+eNw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773251935, "uuid": "4fa0b909-114e-41e4-b9fb-1ff92b3ba803", "value": 16062036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773251935, "uuid": "46d8f508-a342-4596-bccd-0a012385b864", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251935, "uuid": "ece9598a-6809-4263-be4d-26977164049f", "value": "IDFC Mobile.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5fe644-1da5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773273096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773273096, "uuid": "421d4e8f-ef65-4645-b237-8e12105b082f", "comment": "Malware payload", "value": "7a01a890c858ac673cd2544c1788cd61", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773273096, "uuid": "86e74537-50a2-4ac3-8d07-61a0a70b87de", "comment": "Malware payload", "value": "9cf9d9de652b6a9cba01fe56b1626227ec48facb6d8c5d68e1dfb4e72e79a627", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773273096, "uuid": "21b7d8ab-e88b-4ffa-86ca-81736ebd7b3c", "comment": "Malware payload", "value": "c7907ee5bcdb59616d6df27ce11627673894c050", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773273096, "uuid": "872ec7c7-11f1-4753-b9f1-4a824086b05d", "comment": "Malware payload", "value": "aac7077ec8cd62a7b18d89a5e7ffd9c85524b0dee7794bdfb0d3da8b1f19a6549a2f92bbae9f0f82ebbfb48dff7cac09", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773273096, "uuid": "e8c6d805-bb19-447f-9786-23dfd19d2a42", "value": "T10256BEB9B8042DE6D16E5237C9A3A8D927713C124F9767CB5860B7D60E733E0ED36A04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773273096, "uuid": "36fdc4cf-efb2-4a78-a17d-e39f8680edf9", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773273096, "uuid": "94ffadcf-b41a-4dcd-96d2-94283bc5df32", "value": "24576:CluIHTyPeIWSbdqIhUuIqJzJHgfPLxrukgXRCD+0QT5AOIojSpBS8HDoHrs0jqS7:ClDzCezoYSU1qBJ+LZ+US", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773273096, "uuid": "715fc8ac-4dd3-4f8e-b5e7-5558faec713c", "value": 6209536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773273096, "uuid": "ec41ab65-eb27-45c7-94b6-5fb3281c5e90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773273096, "uuid": "eb17cf79-6333-46f5-8875-9b53ab323312", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a97f8dc-1d25-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773218062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218062, "uuid": "ff9ebdd8-26b3-453a-b16c-8f1eb7e37598", "comment": "Malware payload (Mirai)", "value": "2d73fcbee3b17c859646ffbd61635405", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218062, "uuid": "139559b8-a9af-49b0-8069-fa55c30470c2", "comment": "Malware payload (Mirai)", "value": "9d10014303682ef42af043574519091b9bd7cb9005b1dff41693ce4028738d6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218062, "uuid": "614148b5-5d67-4c06-ad47-3278334f0eb2", "comment": "Malware payload (Mirai)", "value": "a9804cad07c2b3ae7f16b04d5f57e481a2a87019", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218062, "uuid": "4bafe356-aae6-4456-972c-c307f729c780", "comment": "Malware payload (Mirai)", "value": "830626aae0b10b8f905a8d328db0003889db99d07eb7dd6b8f40c1bb4633b1bb494288a98fa2bc874f082add92e4919f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218062, "uuid": "9fcc3717-53ef-41ef-b00d-1778c0438bd8", "value": "T1A8D3185ABC819F15D5D526BEFF4E528933131B6CE3EE7202DE245B2027CA95B0F7A402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218062, "uuid": "468016ac-f567-4445-8deb-2fe82330d66d", "value": "3072:OQtqB+rvlhnpkjeVl4n+32xNIvuaU9uOi8IavBOfIf4S1Pq4TN7:7tqBKvlxpkjeVlMo2HQuaU9uOi8IoBO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773218062, "uuid": "5fce5c88-b317-4f07-b6e2-3339dc304336", "value": 138428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773218062, "uuid": "91bf47c0-7bbb-4e83-8177-bb0334233211", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218062, "uuid": "18f7d7e5-1034-4860-905d-e8f0d2cc0043", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8072bba-1d3a-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1773227399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773227399, "uuid": "de154472-d7de-4720-883d-88c771a1dde6", "comment": "Malware payload (Gh0stRAT)", "value": "9c811bc7bfc124b3476cd11bb1834504", "object_relation": "md5", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773227399, "uuid": "69cb5c1d-691d-46de-ad02-db9fa78ac3f3", "comment": "Malware payload (Gh0stRAT)", "value": "9ed5dc32d9ce2e7b49cd50141c15702bf2a21b769dd47ce32c460e41814fb055", "object_relation": "sha256", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773227399, "uuid": "b0d34566-3e7d-42bb-9052-69b7886589c0", "comment": "Malware payload (Gh0stRAT)", "value": "93abb77fe7469267230152f0cb15b2345ffeff2d", "object_relation": "sha1", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773227399, "uuid": "9b18e13f-38ab-44e1-b78e-763d04f06a85", "comment": "Malware payload (Gh0stRAT)", "value": "d27846ff2cd72ec120d2b9985a2f3862c0ef774318b81df7ad1628b71c48b98cd5efb86d42020b5e1471d4ed6c13ff0c", "object_relation": "sha3-384", "Tag": [ { "name": "Cybercrime", "colour": "#4422F7", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773227399, "uuid": "e324d4c1-f6f7-40d5-a7c8-5374cc753654", "value": "T1F8A73327F2CB533EE42F4A3709F2D6256D767121B72A8C8656E448C8CF6D4A02D7E781", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773227399, "uuid": "727c9b95-b50e-4b94-b2a4-eacd1a847adc", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773227399, "uuid": "f8781c19-564e-4b7c-a3e0-7de540d1d1a4", "value": "786432:zrGAQGOjLIpfJGElGjJgY5bWmPuXWcrHtN4hHAI/gGpLl/0PGBButl7P67j5Nw4f:zj5OKGjJgY5bWmGXxH4gI/gGpLiP0oTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773227399, "uuid": "ff8986a4-be93-4921-98fc-cc1c4af0e17a", "value": 44533614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773227399, "uuid": "125cd2c4-f9b0-46fe-bdb8-d69e6ec7a1c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773227399, "uuid": "d91d47b8-4883-4b30-aee6-3fff092d4f68", "value": "openclawAI 7beAolenc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6ea3f7-1d70-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773250331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250331, "uuid": "d8053de9-0876-435b-835e-6e5d1ad100e3", "comment": "Malware payload (RemcosRAT)", "value": "e0dd0e61f2e14c31b57ed001d7543e9b", "object_relation": "md5", "Tag": [ { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250331, "uuid": "875b24b5-20eb-4a7a-aa25-52cbe96b8e57", "comment": "Malware payload (RemcosRAT)", "value": "9ee870e25a34a8d70055cfe0a77ffa408e303dc51480ccf57b3f33db8d41527d", "object_relation": "sha256", "Tag": [ { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250331, "uuid": "7b5e35ed-a543-4c63-9f13-c0c30be3d16b", "comment": "Malware payload (RemcosRAT)", "value": "91efd0f75e6d40f0a51a25f0bbb50802c947e9cf", "object_relation": "sha1", "Tag": [ { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250331, "uuid": "ae4f2017-5549-4f94-8c58-679d04487189", "comment": "Malware payload (RemcosRAT)", "value": "e667a6fe41574aefe3d82f9402fd51e3f0bdde390d6a5799d5bda21013b3fcd300bff1ef9eb2170022f15add4cd0c78e", "object_relation": "sha3-384", "Tag": [ { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250331, "uuid": "11bdec69-a7e0-4b22-a1f0-1c061687bc22", "value": "T1A43519ED87C3F96DCAC5E753524A942224B4745279A0127E3FC0C5D7E7B182E8EBA10E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250331, "uuid": "5cc863fd-0bbc-4f68-a88f-911b4c57f970", "value": "192:zw0777777777777777777777777777777777777777777777777777777777777Z:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773250331, "uuid": "1919f122-e0fb-4c75-8b10-72a9730d6d88", "value": 1095680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773250331, "uuid": "2bf2441d-7798-4db1-a2da-c342df9b602e", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250331, "uuid": "5054b153-139d-48f0-acb0-2995d58e5563", "value": "91efd0f75e6d40f0a51a25f0bbb50802c947e9cf.pdf.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "384aa046-1d7c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773255478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255478, "uuid": "0cf0a57a-119d-4b0d-b414-016300f97b62", "comment": "Malware payload", "value": "f044908d3982a02bf7b68718756ec392", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255478, "uuid": "20fa01d5-c671-4910-95c2-7cbc64c614be", "comment": "Malware payload", "value": "9f08c07caca26eea95e718ca772535fcc3a061e71fea2ea160da039a09fe8fb6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255478, "uuid": "c91e8f53-8899-45bb-b62b-521f41ca7f5d", "comment": "Malware payload", "value": "f1bfe8faf422c67d765ba09df9fdf7d5c545bef0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255478, "uuid": "6eb1fbe2-4800-495b-b915-0841da8442af", "comment": "Malware payload", "value": "e988399ae8ad9b4a093272b5cc3e55d701d6ff665d2f6a22262d1ff926aa21e2f79155f57ad71f980ca4b8e6631b1afd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255478, "uuid": "5e764bf4-28ac-44fb-a5dc-36b1a5c4bd8c", "value": "T110115CCE65623E7FAA344F3C71B34630600D86D8A5674796F68A08364ECC7427A1DA8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255478, "uuid": "e136d877-b7e1-4c8d-b3bb-c537498e4256", "value": "12:xVI7LV1auEac+ViNIKPjVPp/K1IvV73cRKV3abYViIJ5VH8foyVapUUVE1vVYJ:o7dINIKb/K1I5duQh8fo/Kn4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773255478, "uuid": "cd523900-39e8-4612-bec0-cc4bf535f9c2", "value": 857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773255478, "uuid": "1db4c853-76e4-42f5-a51b-820656411bdb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255478, "uuid": "03a309e6-bb5c-4515-91ac-803844d6ad00", "value": "hola.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ddd8b3d-1ce6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773191197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191197, "uuid": "267bf303-e38c-437b-8092-2a9efe881b01", "comment": "Malware payload (Mirai)", "value": "a55d1f5ed50648323a9d31284f388eea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191197, "uuid": "4dc681ce-ab80-40c3-9444-85d0cb2d66ad", "comment": "Malware payload (Mirai)", "value": "a09006bd59a03472033d3e8fd71c160f37d3870dd04e94a0ab09fe15ee32db5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191197, "uuid": "8f1ed661-367f-40ff-bac7-cbb4575e4f38", "comment": "Malware payload (Mirai)", "value": "9c33211844e005742863345768f0ac4dea2b4c27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191197, "uuid": "8509110c-4bd8-449b-b6d8-e908d65cd99a", "comment": "Malware payload (Mirai)", "value": "4eb26567f1255e8612a896dc24493ea52cfe13912a1dc057dcea9843ae131e041b9310183ce90686a8134b9a30de5818", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191197, "uuid": "209239ec-6045-44a9-a5e6-d66566ad0a9d", "value": "T11692E13C50F9E431F6A00C35CB6DC848F653237C11F676602916D2A4FA8B645A67EE87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191197, "uuid": "6aa2d3de-2ddb-4e5e-bf18-3f41d1ec9934", "value": "384:0u1uGPCl4YYEJ9yyQ/9ceV14ThC9dDPwTgArE0SrqUhj1/ZhymdGUop5h5kFaN:rCl4189Y9csmC9J+gAgrqe5/Zs3UozWI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773191197, "uuid": "afbb998a-1d8f-418a-b65b-a1d3da64ebc6", "value": 20868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773191197, "uuid": "d1754da7-55f6-43b6-b833-36026c103ede", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191197, "uuid": "d8e2b746-df2a-4517-a376-1735c23d0676", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bfa13e8-1d23-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773217178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217178, "uuid": "5a44093f-0926-437d-808a-3014a24805be", "comment": "Malware payload (Formbook)", "value": "93d0243b2c05ac4aba4f2ae640ca7809", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217178, "uuid": "08198fea-468c-4763-8146-afa025ab8072", "comment": "Malware payload (Formbook)", "value": "a109ab13c65108d0f2a045a25fd47495c0c20fe3a1e06964a701bec1dc002806", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217178, "uuid": "6036a81f-e97b-4b98-9567-487cc953e4d2", "comment": "Malware payload (Formbook)", "value": "8549b30813f6631b05c531ac00b04ea31ed6748d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217178, "uuid": "bce642f9-b834-4262-897e-add0baa9a53d", "comment": "Malware payload (Formbook)", "value": "f0544a8353af5637ab37cd5ee88cef78c1b6ec26de14e2056e0074253b4f2ccd301eb6d1623fd8ee8d26a1306fee8aff", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217178, "uuid": "741c7a55-7db3-4672-9bd3-753c51e4e6b3", "value": "T12395CF8389086E7D97C5789EB1A28D1EC3D25213B2157B89FE766E835F7724708321CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217178, "uuid": "df049163-75bf-4163-a474-cdd499b94766", "value": "24576:3xoy4YGRZ8VDjSrTt8d6klpGfqq0b8rcSrkak+:3xFmR+JSur1Ss+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217178, "uuid": "b7f9cc4d-8b7b-4058-b7fc-c5ddf245c08e", "value": 2003574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217178, "uuid": "121e60c0-9bb6-4395-aaec-bfe4bd080ee8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217178, "uuid": "c575ec18-25ab-4e4c-9563-59c15a4a5605", "value": "93d0243b2c05ac4aba4f2ae640ca7809.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc585fbd-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1773218011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218011, "uuid": "1909115f-b542-4299-9d87-e4314ac2ea0e", "comment": "Malware payload (DCRat)", "value": "541110a0bcc3839ed8486d5ba717873c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218011, "uuid": "dd16a8e9-3ca3-4dd7-b70a-eff49fe373a4", "comment": "Malware payload (DCRat)", "value": "a1145ae7bbc7d896876d9bdd49c8186a6ced9103c847d5e86eeb7782057277a7", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218011, "uuid": "801b6b74-85f2-4fc1-9978-b4d5573e5b2d", "comment": "Malware payload (DCRat)", "value": "fd647e9b38d5acc1fa927cc6ee6b679d450b91e3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218011, "uuid": "55c8a8de-5ba4-4d0e-9aff-cecf17803956", "comment": "Malware payload (DCRat)", "value": "c691296acfcdf0dcf3217d18254c7ca2d69c30fb8b66982e854c515c20d4576d3a14e7e427800cfd05f18fc20a94887c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218011, "uuid": "52c8c99f-2576-4926-bb5c-7cbc54a18736", "value": "T1363605A48E4A248CE53EDFAC094D1FF5AFD25971225FCCBCB13890E3F116C1A56E512A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218011, "uuid": "49452cb3-03f5-474e-99cc-8e7c9d2870d0", "value": "1536:3fH9IyZ1a3/IynAFT/dtm+Lyq/dtexqIxb/dtQcERkgYJ1D8J8Kk8akPtDkiityR:TB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773218011, "uuid": "af7b1567-7c8f-4339-83b5-bf879fbe8b78", "value": 5183811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773218011, "uuid": "dd3ae5a2-ee4b-4627-915a-e4065af888b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218011, "uuid": "75cbcdb7-94a5-4bd2-aba2-a8b656a8aae3", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4849eb39-1d3d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773228446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773228446, "uuid": "b6cad363-ef7d-4585-a803-fc1948c82b19", "comment": "Malware payload (Vidar)", "value": "4686e59c5ef10e6da5f3f0546996c713", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773228446, "uuid": "fa032dac-2689-46d7-8e6d-6876e439d1ed", "comment": "Malware payload (Vidar)", "value": "a15044541cc9587c61dc7fbfa613b03045d323cc643d4fd08d8351d7cdd80a32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773228446, "uuid": "2771b270-7307-43e7-937f-fbf5b4f8119a", "comment": "Malware payload (Vidar)", "value": "d6668d8a3f43e0032ed5332fbaf8aa4c539e665d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773228446, "uuid": "be58f3ed-4fed-426d-ae11-4203aedf5ded", "comment": "Malware payload (Vidar)", "value": "b39ae7c4f91602751668ef4343fef6c2a2c0151dd2fc1ff514a153fab06c45096395ecca368a851faff2e997feba7385", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773228446, "uuid": "5ce30dce-2921-4024-af5c-10b78139d2c8", "value": "T1DFD42B7DAC50F326F70C90BBE286E3535E6178410636A99319BEE72001458B39B5B7FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773228446, "uuid": "3c6faab3-570f-4d91-af77-e30ca44e6570", "value": "57594b14471500698dd38c5d2e664b86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773228446, "uuid": "b7ccdd75-0cbf-4a21-a0a9-05cb2f186615", "value": "12288:ZU2FJXk2WjWnLFTM5rdwhFmdV8Bew2/1gdu:m2bXk2WjwBM5+XBew2/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773228446, "uuid": "76ae3043-6a00-40aa-94cb-839d2934440e", "value": 616448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773228446, "uuid": "01062896-5896-4948-bdad-b6675cf773cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773228446, "uuid": "f235a28b-b006-46d5-91d2-dd03ab878a92", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad4d8c8-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773217767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217767, "uuid": "8cd14af0-ff9a-4b08-a513-da2ea3a54807", "comment": "Malware payload (AgentTesla)", "value": "8d28147d18ee3b99aa9c13639d841511", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217767, "uuid": "1f932da7-fd8f-48d1-ab86-24f086044e57", "comment": "Malware payload (AgentTesla)", "value": "a1e7238bffe6f64643869edc5cd52b9c9cb5b080b3a72f2363f8601a82a8b808", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217767, "uuid": "8059c5e6-6a0c-460d-9d52-69e76efb5a1a", "comment": "Malware payload (AgentTesla)", "value": "bfbe504471470a6cd289272da8d537648d41d6bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217767, "uuid": "e12f9f0c-47bc-4b42-9178-0d6d4fe0cf3b", "comment": "Malware payload (AgentTesla)", "value": "3191573205bf3969674b44cc1ba54d92b2ad310050e7f8528468619aae12cbe06f0b783da192841b76fb5647b2999641", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217767, "uuid": "0d9d1715-804e-47a0-b2c3-8be208bf08df", "value": "T1BF55AF310D907EE51EFC7D84E1E2A11D71E785E891058BCD83AEFF96A325BE4E987060", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217767, "uuid": "72a73f4a-31f1-4449-b88c-f7e0324c5f64", "value": "24576:kdGJ7V7mf4dcLGDXuSiDNdqX6hJOXxJTRrA:kJ1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217767, "uuid": "9f4501b7-d36b-4606-a7a2-153f5df23d39", "value": 1336150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217767, "uuid": "e03396a8-5c1e-4788-8776-6ea1bb1403db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217767, "uuid": "8a64074c-b60c-4a70-bf4a-ba9270a29951", "value": "8d28147d18ee3b99aa9c13639d841511.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d123b86e-1d20-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773216221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216221, "uuid": "1196d09a-fee4-40c9-bee0-ccf6eddd9765", "comment": "Malware payload (Vidar)", "value": "472e65165aa5490496d6ce1ec0ea67ff", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216221, "uuid": "e0802ba6-5fac-4832-a37e-d7e48e12beb5", "comment": "Malware payload (Vidar)", "value": "a3e5d5f04adb29c7cfb294aa5aebe231920456e3c26691dc04eb23ffb9317ed8", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216221, "uuid": "3496b65d-1525-405e-884c-e70c64a81416", "comment": "Malware payload (Vidar)", "value": "b7bf4e4e19a0fe1f38665737efed9fce45f56923", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216221, "uuid": "c3d8d891-f5a1-4e95-93dd-f51bb2700fcd", "comment": "Malware payload (Vidar)", "value": "b40e778836bd017a9c1e9c71c9771a00377e68fcbef6c0b5c8ba268aec2b5fcd546ccc5077ccb9ab83370dbb5a72462b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216221, "uuid": "d6193fd0-caab-4f8a-8f8f-5262ea595b43", "value": "T1AEF0DDCBE82A8E6C9233A9F422F6E8ADD485C1811EE5DD337A80449E22487A5A784255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216221, "uuid": "d30e9c30-049d-4a61-a916-964bd287069d", "value": "12:TVxCwl2PF2yWTb0g/LfWdsJThH7MGKHiD95AIgpqnqOPnl3XS1+MWj:Lf2PAym0g/kyhJKCh51KqqOPlnS0MU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216221, "uuid": "67e74aa0-1d03-456f-8916-db2d1953fb8e", "value": 646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216221, "uuid": "657e7579-4d58-4b66-a96a-51c58549dbad", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216221, "uuid": "d11c3586-34fb-4bd9-babd-c68a5ab8c7cf", "value": "verif.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8822a809-1d19-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1773213092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213092, "uuid": "ba6523af-a75a-4ad2-b19c-fec3b47ad5a1", "comment": "Malware payload (GCleaner)", "value": "59bb6020079c840f5bb23c8834062fb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213092, "uuid": "5048f719-5fe5-4b32-85e5-d7d36403167a", "comment": "Malware payload (GCleaner)", "value": "a4e622d78682ce5defd045b37e9403e19161c7f3557a311dcfb08eac544e0900", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213092, "uuid": "9acf77e7-2408-42af-a582-3e7c457e315c", "comment": "Malware payload (GCleaner)", "value": "6da00d650ea0188365953e1bfea14e64bfc67199", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213092, "uuid": "f5bd665c-c81c-41db-9425-1b340bcd86a4", "comment": "Malware payload (GCleaner)", "value": "33d054416352e59f0f7e7e9f6cbedb39ae587dad458683a01323730c17ba811b0e9435255ce7d9ecdbab19bb3ba6aed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213092, "uuid": "099c7f13-c25e-4774-bd2b-321599359744", "value": "T1BE15291EAFB3C072EE63D5B2F6645221393DB82D173885CB62B0282DE9907C1DAF5355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213092, "uuid": "e0d6501c-f24d-4d22-b0f0-e6b17df20357", "value": "62848721a0fe32270ffbda7abe4e1f5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213092, "uuid": "cccb715a-4686-4a9d-90c1-57d37a2ea7fd", "value": "12288:7YEd//LbpeDJ4jfiIaBRtwfESz9pfYbVC3pKEVj4988fGN:7bJIJ4TiIaBYfTz9wC3pKqH8fGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773213092, "uuid": "eea885a9-7546-4e63-9c9c-8f64c1ca0669", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773213092, "uuid": "38ce9dfa-32bf-41e6-af52-0e7defe1b2b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213092, "uuid": "02efd43c-97d8-4fbb-bfbc-2a7df95b21a2", "value": "59bb6020079c840f5bb23c8834062fb5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3ecf24-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773217954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217954, "uuid": "e34adcad-79b3-41d8-ae9e-b522280d4d03", "comment": "Malware payload (RemcosRAT)", "value": "835bc9d8d84117c6730aa7334678f293", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217954, "uuid": "a06c401f-5191-4f3b-8ff5-d989500611e1", "comment": "Malware payload (RemcosRAT)", "value": "a5e8581ffa0b54efbb78db8401641213521a319a46b0570f4079a73b345fd1de", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217954, "uuid": "235f1e3b-a650-4974-aab9-cd717e14739d", "comment": "Malware payload (RemcosRAT)", "value": "c4f322aae1ac8a5912a8c40dfd7b2305105636cd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217954, "uuid": "33d6e182-9cad-4b30-80fc-8333efb792d8", "comment": "Malware payload (RemcosRAT)", "value": "93a10bc6c6f25aa5271cfa52b4b9fab7e2bdae994a230ccd513ff56189d70606be790a0d3f19fea76427e88adcaccc0a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217954, "uuid": "8272a888-22eb-4d0a-8cce-21ecc7a147e2", "value": "T1F335137CD20891AA5EA9DB0D065CF2D9CC2C4C83DCB71EE98912CDEBEE551F932B5124", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217954, "uuid": "ca60ffe8-868e-4400-b02b-e3ff7f7e62d1", "value": "192:333333333333333333333333333333333333333333333333333333333333333n:wjS3PQUv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217954, "uuid": "1275a0bf-7fa8-411d-ae9f-13a2e719ac05", "value": 1142465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217954, "uuid": "2dc12730-ff80-4465-be41-4441955c5154", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217954, "uuid": "8c9b5bbe-6147-4ddb-a448-9beef0f6bf93", "value": "835bc9d8d84117c6730aa7334678f293.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed73e60-1ce6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773191252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191252, "uuid": "2d4492a5-b80c-445c-b981-d2719ac15d72", "comment": "Malware payload (Mirai)", "value": "ae2d0da8125fbd2807a95fdcaa1bcb2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191252, "uuid": "69741cb6-36df-4934-85d3-f5e1029b93b7", "comment": "Malware payload (Mirai)", "value": "a6464b4ab96f2efbc141fde253e61a0c18a35716431b8ce4e58b984b7f9367c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191252, "uuid": "db50e707-74ce-452f-b41e-24ebb22fb1a9", "comment": "Malware payload (Mirai)", "value": "2c422bed6a11efe351475ae83cb66329bebfabd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191252, "uuid": "7fe7d2fc-727f-4247-9c2a-3c1fe6c8c65a", "comment": "Malware payload (Mirai)", "value": "dfeb43af432f7a9d5dfbb679e78caf9b8d84d408157a2daa3d87c125e82206b8027afad89e6ab3d9570a73d17e68dad7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191252, "uuid": "f87e7930-ccfa-4383-8949-1dc9afec27af", "value": "T16CA3D91E6F31DFBDF269823147B78A21979833D627E1D685E19CD2005E6034E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191252, "uuid": "34d69d2a-b9bc-4ddc-8895-912070878e45", "value": "1536:V4poNIjCa2VBI9mUpZrLNjkWQGjeuvFXz361d64m:rNIjn2VBIBhLdkWfjz25m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773191252, "uuid": "cc83e5c2-bdf9-4ee6-8b05-d181f29742d0", "value": 97912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773191252, "uuid": "e2e3b186-d930-4663-9089-445660a2eae8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191252, "uuid": "32ee9b2a-8767-4b2b-9637-7948cd439194", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0613c89-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773217051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217051, "uuid": "a040cac6-ccdc-4ae0-89bb-0edce9760172", "comment": "Malware payload (Formbook)", "value": "b6f5b1f28715b81d33e9dff2163fb862", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217051, "uuid": "784a9305-a120-428d-9fc8-a9dbd46407fd", "comment": "Malware payload (Formbook)", "value": "a6a20d36739bbebc6fdc39e9ae7fc150efa06b2f8638a7f4795fdde3b714ffd9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217051, "uuid": "fd042318-7908-40c2-a282-22605e5f31ff", "comment": "Malware payload (Formbook)", "value": "a88d5e77eb76074a5f0f4a341e769e708a26ea7b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217051, "uuid": "9200aea9-df86-4ae7-8ccf-45c3b8d5fd72", "comment": "Malware payload (Formbook)", "value": "672eac5b9b62eaff5bc097e175f491414ad563e84b421217b419d668e14858e47e6b6331fce72cc53ef34f759d96676b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217051, "uuid": "072d5109-4032-424f-99ee-a3225be1978e", "value": "T1A995CF017E947779F63CF62DE434040296A0BE2DD0CB20D8C9179E46A59F3E8E75AC7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217051, "uuid": "a8270801-a9fd-4f63-89e9-27a136675949", "value": "24576:UV+oxCAs7+EtQcteSjDhI/981oNaD5grwMd24ZOtOt8JhPtZsuhfNt27msymUKxb:o+LKCK1mTk3uIEkc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217051, "uuid": "6f8cdb6f-d4e1-4b97-bfea-5d14feb47eed", "value": 1985528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217051, "uuid": "bd3562f7-58be-4b00-bf82-24eea0a79d68", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217051, "uuid": "ac2ba9c7-f22c-45cf-8c68-86ca66fb59b4", "value": "Signed Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c80f825-1d3d-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773228400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773228400, "uuid": "f97955ca-b2e1-4219-a741-cdc3908fd374", "comment": "Malware payload (Vidar)", "value": "d9e4fd224f5f112ff42113fc8098bb16", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773228400, "uuid": "ddf36585-d07a-4b87-b37d-e71b68342c4e", "comment": "Malware payload (Vidar)", "value": "a6edec8bb8a1de71eff27deecd7aae78ef4514dc8e2ed3dd83aeaf25a7e4a188", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773228400, "uuid": "4f94d513-ee70-4a82-8fdb-bb8dd6328df8", "comment": "Malware payload (Vidar)", "value": "227d44ece06a5f683960f15cd51228eae8d25f06", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773228400, "uuid": "aa67b1ea-07ce-4535-b8d2-a51171f1010a", "comment": "Malware payload (Vidar)", "value": "eb36558e5e4d8f12a9f4efd73d89cac51e7676b2c4bb740f2e64b047d257d9486d076c9876db992c1527f1b8f45ba239", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773228400, "uuid": "e9561daa-825f-4276-b8be-a16c7035edda", "value": "T10C242359FFC0B15BFEB69D71D162C2E304BEF3344B194B8BAA41E4C850F9576890A287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773228400, "uuid": "412ee7d3-51d7-4ba4-bbad-b769d249166f", "value": "ee53c10aff1d01eafea53328179e33a2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773228400, "uuid": "011afd8e-3186-4c4e-ab5e-627b637b6639", "value": "6144:DEZxBLh1mxmcod9jCwBBBAhJJzqlSyAM/Kl:4BLh7X9mcbAL9yn/Kl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773228400, "uuid": "9522c6a0-5d54-4bdd-9629-adc1093c58f7", "value": 215552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773228400, "uuid": "8e19cdb7-e8b1-4552-8743-6b7a5fce217a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773228400, "uuid": "cdc2c514-6019-4ca8-b095-59f2a895b907", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c8c3c8-1d6a-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1773247936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247936, "uuid": "13893998-0363-4672-ac03-0c4b2d3011bb", "comment": "Malware payload (Gafgyt)", "value": "a4e9eeb2e1a290871133012d0451f539", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247936, "uuid": "80a25a94-6e00-4fa0-af82-714365d99e99", "comment": "Malware payload (Gafgyt)", "value": "a73387151a83153122cdcf3e42f444d95d93ae16fa6ab92489f35717cff9fe45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247936, "uuid": "a13f793a-336e-4be7-a681-43a698034714", "comment": "Malware payload (Gafgyt)", "value": "9231cbd05a147236f3e69c1e9558b701b0e08130", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247936, "uuid": "32df389f-49e0-4c6b-be93-e1da978ee44f", "comment": "Malware payload (Gafgyt)", "value": "b1ea1a7387915c09fa2106348b2fd707d339cf9322c2de4fe92a786ca3e274fa55f630cae7259aa3f17e1dda692af84e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247936, "uuid": "0194459f-d795-45b8-9ceb-98be68b71775", "value": "T11E93C709BF600FB7E86FCD3705A91B49358C641712E97B3A7A34D918FA4A60F09E3C65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247936, "uuid": "37626fe3-b32b-4b29-8341-afa2853d33f1", "value": "1536:tYp2epspvLLhc+0MjgBiBWxsQiC83uR9zv94lByLG4hN+CHOZxH/e:2npCzgMBasQl6u/U94Oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773247936, "uuid": "e0def6ce-ccf9-4d9e-a24a-f012477d2311", "value": 92644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773247936, "uuid": "c034bda2-dfb1-46a5-95c7-3797e9bd90d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247936, "uuid": "c91f7037-b38f-4387-84a5-0ca1c0f376e7", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e5291c-1d01-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773202589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773202589, "uuid": "06477e00-21c8-4fae-8669-258324ee3241", "comment": "Malware payload (GuLoader)", "value": "9ecde6043d08b2c053f9aa447333e840", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773202589, "uuid": "f33af9b7-e04d-4dd5-81a2-aed593f096e2", "comment": "Malware payload (GuLoader)", "value": "a7bfa5f42bcc9078688625f6517c6eabe4f1f83abc2e28a60bff88a1668aa431", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773202589, "uuid": "227c6a24-5060-4c90-89e3-a9718742ba90", "comment": "Malware payload (GuLoader)", "value": "8814914cfc83623a19c8a7639869b3ab03df9aaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773202589, "uuid": "754c6031-e566-4bca-b75d-d56b926c0edc", "comment": "Malware payload (GuLoader)", "value": "12215796d07737a4b987772ea2d3e4568802816e90eee56100d1ef0b4ff4591abeaf626f0c1bd9fb6f06ff1858769799", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773202589, "uuid": "05325bc1-2d96-41c0-af16-957581285d6b", "value": "T13E15129365E0C6B9C708E1F0A1E651734F796D7F6EA92233B100BAA781F781C944D2DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773202589, "uuid": "3b32bd12-8b43-4d7e-ace0-018b0b913dc2", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773202589, "uuid": "482fc19f-1e53-492d-af2f-7a984d0a74c6", "value": "24576:1+O0nBxqV0pQVYUK2ns3dDJtBo2PqNXiuF:gbxqCQagSdDJjoA8y8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773202589, "uuid": "c60c84a2-077f-42be-8c22-22f74a8dd749", "value": 917672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773202589, "uuid": "0b0147a0-b711-4d9a-9bdd-773ce5e32c68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773202589, "uuid": "971e7a2e-d809-4897-8bcd-bcd59e137389", "value": "scan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646d0576-1d5f-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773243096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243096, "uuid": "b5bb10c1-8fa4-4104-a094-af6116941d73", "comment": "Malware payload (Vidar)", "value": "ed924cd779fdacb8802f3f1b440ca4ce", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243096, "uuid": "fd3d0827-7a01-4028-855a-420daa98341b", "comment": "Malware payload (Vidar)", "value": "a7ceb4b5a57e3552d627007f8a966f6743d6896ae66390d040c90767186bd8c4", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243096, "uuid": "712d0c06-f730-4f3a-8b92-5663efafe7b3", "comment": "Malware payload (Vidar)", "value": "e63bdb17a42c95b714ea8a3f74a62060ba22d2b5", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243096, "uuid": "000f9f29-5e80-417c-8e85-9e23de889f8e", "comment": "Malware payload (Vidar)", "value": "d73e3c2f7ec5b89e3b75b4a7ae382692da5884053694aa5773b661b7cf005b5d3e2d9a0b2c3bba88c140cbc064842565", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243096, "uuid": "8374d720-8f0f-4900-8366-df118307e140", "value": "T156955A0BBCA548E6C4AA97318DB721963B75FC190B3263D31E90BA7C2E727E05D78714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243096, "uuid": "b73061e1-e53c-4bfa-80d1-a3b5968a51c5", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243096, "uuid": "b59a39e7-91c7-47ec-9ff9-0b79e99f7123", "value": "24576:LdDCa9hXb4cgR7pH2bnAGEaEHChV0f43jPSW8AI7aWtPMtiEYSG3:LdDp9hXb4cgRwbnAsPS+UaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243096, "uuid": "16899869-91b6-401c-ab73-023ef27d21ae", "value": 1927168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243096, "uuid": "f0eaabf4-934b-46db-9ea4-af2526d1afcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243096, "uuid": "5d7a879a-7f08-4afc-8cd4-07956eb3387f", "value": "source code of carbanak backdoor discovered.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af538241-1d69-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773247517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247517, "uuid": "ae4a5e04-da7c-49b6-8f1f-b399c1af9f67", "comment": "Malware payload", "value": "f322325e7ebdde90664fc6d9e7c9c800", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247517, "uuid": "f9bd6d61-22e3-45e7-8930-9e676aa60b33", "comment": "Malware payload", "value": "a85188389fe806216a778fa48b5dd1af1b41afcf735a10c8efa22784de801445", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247517, "uuid": "f514e408-c364-4b62-9ceb-f4fc9c103f15", "comment": "Malware payload", "value": "e035e3630ea4383e1e7bca1cf9f17a5753ce0cba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773247517, "uuid": "a34e7cc4-9597-4eb8-8f6c-a524aefc6d5a", "comment": "Malware payload", "value": "7a5a1e70af7fcfcd98907430dbf3ad5693aaa564bacdecc4ec9c3445e31e7c917bdf3972a24be6853b5dcd2e1bbf4c41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win64/Malgent!MSR", "colour": "#0E33CF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247517, "uuid": "cc98c357-f451-41cb-a735-5d29f1dba110", "value": "T1F785529E9E3D92C6C0AEC5F5B721A296B4103C4DD17077D76BC00B6D2723660E9EA3C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247517, "uuid": "a1220058-17c8-4fa1-8c1d-5967dd3accf3", "value": "0e6421c4f9fcf89bd5b84dae1d979cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247517, "uuid": "c5a8827f-d851-4186-a7b9-1026605cb840", "value": "24576:/8ZNyBcbEkxFCb8rys9nP/QeibHnTengur0f2exLf8Js:/8VUJxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773247517, "uuid": "85784cfd-5cdd-4041-baea-bfd4abb47ede", "value": 1854976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773247517, "uuid": "e8005b63-866d-4ce4-a3f0-6a8cab3df928", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773247517, "uuid": "dc0e3d91-241d-4525-b5b8-924ca2890634", "value": "2026 \u7b2c \u4e00 \u5b63 \u5ea6 \u4eba \u5458 \u4fe1 \u606f \u6587 \u4ef6.....exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42fac31-1ce6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773191288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191288, "uuid": "88d428df-a27d-4f7e-bbce-b3f6a1fcc402", "comment": "Malware payload (Mirai)", "value": "496ce071e988be76f3e65578b6e00c99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191288, "uuid": "0ee0aae6-8255-451a-81a2-f711f24222a2", "comment": "Malware payload (Mirai)", "value": "a8ef8939500969a844d1eb892e35b713ddd34a98af911127c1d75633127a68c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191288, "uuid": "2db072c2-46d8-4550-bcf4-66427e3974a1", "comment": "Malware payload (Mirai)", "value": "462ec6451712495ee482b751694cb378f74bc0d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191288, "uuid": "2cebe443-918d-4f85-95ce-523b629917e4", "comment": "Malware payload (Mirai)", "value": "78d3c7a5169ef4988095892fcec201b89588c9824a5b72d94e801df261461198a9fc913f7a3f696badb181cfd72e3253", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191288, "uuid": "fcd707a5-056e-4e3a-8787-38d82cc590d8", "value": "T16E639EB3C9393E94D25541B4B830CA795B53B48481871FFA5A98C6FA4047EBCFA093F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191288, "uuid": "ab30bc33-a5c3-4ed7-afc3-2c9587f4fd0a", "value": "1536:sa9wtr82FLQgB97HK9QATGRuzuCy2KNdwq61d6o:sib25QgD7q9sRuzu44q7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773191288, "uuid": "1887f119-0747-46fc-9349-7d0c4966cb81", "value": 69116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773191288, "uuid": "aea2f138-de6f-4a00-9ba4-14c047534734", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191288, "uuid": "90c1c86f-b5bf-4d37-b09b-7486a4935bdd", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55d91ede-1d14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773210860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773210860, "uuid": "88e3c8db-e74d-483b-bf8e-3c973688e2e3", "comment": "Malware payload", "value": "d85427494db36753a398563524308625", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773210860, "uuid": "cd1f80be-4287-4cea-a276-1b429d05a210", "comment": "Malware payload", "value": "a93c12202445a324a04eebfe872c8125ea453101513f6ed6a5c8ed274ecfb5a5", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773210860, "uuid": "38761662-1aad-4991-ab31-8b8a5534d120", "comment": "Malware payload", "value": "141430a29823bb080601b8ecbbbe8dc1536f239d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773210860, "uuid": "3ace467d-cde4-4019-99e2-7efea9aa58e4", "comment": "Malware payload", "value": "c0b81df5e5846f2f164148d8bbadb64bd9549573a03ff5bab2b9bf904a5b2d51a1729c164ec5507d5194a845e1387438", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773210860, "uuid": "57111427-2b3a-48c7-ae17-6e30e1cf3d28", "value": "T1AC924CB906496C79FBC0CE799F3C7F0CAEE582C42129E39DBA1F39704A2165DC609359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773210860, "uuid": "628e1cf7-2017-4212-8dbc-9e0ed5bdaad0", "value": "384:jOIncuxOLnVYMSmzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:jOLuQL+mzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773210860, "uuid": "5b1dcfd4-7415-40b7-b0cb-799644f7d2c4", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773210860, "uuid": "f3e2d84b-e273-4762-8e2e-114a10e9fea9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773210860, "uuid": "5391c9e6-8e31-493e-93e4-31818b9aecf9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737c0b25-1d34-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1773224653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773224653, "uuid": "a5e4c005-d4b4-4e95-a96f-89bb891aa200", "comment": "Malware payload (a310Logger)", "value": "5bc188e31a59c36f1b9ee0046edb3d91", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773224653, "uuid": "190418de-8c2c-4e9b-ad11-b14d219a7e1d", "comment": "Malware payload (a310Logger)", "value": "a9c13daf86047d15238ba16b3f38c419e3b863fa6cf2bd49ceb12e517b7db2d3", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773224653, "uuid": "3139ae42-12ee-4fa9-91fb-eb255bad9757", "comment": "Malware payload (a310Logger)", "value": "b15b618808b056814cd35cdd07a8b40c42453c30", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773224653, "uuid": "e3478b05-3d83-4177-8cec-e9544f214582", "comment": "Malware payload (a310Logger)", "value": "7cd0e8b10cf7198b002e8303df643f488f3e9759cf6a00f7d78e734491c07e5349660839f02c4ce8b2458e81b8f2a2df", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773224653, "uuid": "5de14e22-1ca7-421d-be50-9e0f4cb2ddce", "value": "T1B155CF0273C1C062FFAB92734F5AF6115ABC79260127A62F13981D79BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773224653, "uuid": "f9961447-929a-4b07-8980-95c39698cd20", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773224653, "uuid": "e8b20b2b-5d3b-4934-82eb-e031afc360c5", "value": "24576:w5EmXFtKaL4/oFe5T9yyXYfP1ijXdasMZM9CbQa7mQF97FMG4o/:wPVt/LZeJbInQRasMZ1QBa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773224653, "uuid": "96a840e2-b533-4c7b-ab46-112e6e7b48ef", "value": 1355264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773224653, "uuid": "6638b952-116c-40a0-8974-0b81a35d110e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773224653, "uuid": "c0a57501-5501-45d6-b7ad-aa032fd2e965", "value": "INVOICE COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4771d355-1d70-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773250349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250349, "uuid": "5913e854-4277-4035-83aa-9505edbb2551", "comment": "Malware payload", "value": "6915e0086a81230897e5dda597f942ed", "object_relation": "md5", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250349, "uuid": "9012bf96-cda9-4727-a9f1-4d64251b3193", "comment": "Malware payload", "value": "aa8f502fd31a1344abb4c177a76a6c839993645eea67b58f2a8327809af4db28", "object_relation": "sha256", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250349, "uuid": "d9c1e03d-0bbc-48da-ab3f-09f961eb74c9", "comment": "Malware payload", "value": "61938d6f10a053447a948b3b4c152622bea336a2", "object_relation": "sha1", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250349, "uuid": "8793f417-c80d-4b31-b7df-43bf395ec61e", "comment": "Malware payload", "value": "4ee6fc9640f4968cc85f5fbd46d07b4c6d8abfe9c917b09827996b7314b32d133b2388c9fc263ac1f58ef6575d6bf688", "object_relation": "sha3-384", "Tag": [ { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250349, "uuid": "61830d81-2b4b-4522-8edb-8bc75eaff70e", "value": "T124A5335E56EF2A1F5D5C0C6392CBF30668FB80F5D296A70C0D84D6668C79DEE60A8730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250349, "uuid": "a7006de4-e6a0-4011-a8b1-9bfc1be8ce4d", "value": "49152:obq9g1iDAizqZJeGySAR+voM3xZOU+H8HhV04fyVXVNe7KFRB:ob2go8P9ySUgoc/OOB+4fyVFNe7ERB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773250349, "uuid": "2ed39893-d178-46c0-93c1-05885e1d924b", "value": 2098835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773250349, "uuid": "b196c5e6-6316-482c-ba18-faa036c3f252", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250349, "uuid": "e77a39ef-f0c1-4c22-984c-015aa2017af4", "value": "img_181532.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1710f817-1d5d-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1773242108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242108, "uuid": "2f2de961-e872-4e04-bfa5-c97f3ec2050e", "comment": "Malware payload (STRRAT)", "value": "dd7d73ac2b830fba8042d57e564f015c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242108, "uuid": "49e4c10d-e361-468e-9eec-4b783a1cd1f1", "comment": "Malware payload (STRRAT)", "value": "ab43ea53d30e98d96c7738112fa92f6dc109918a4318d07473da1bb6d9a75f28", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242108, "uuid": "703900af-5a84-4698-a652-2ee63305129b", "comment": "Malware payload (STRRAT)", "value": "a4eeae720fb09d55eff6065f3cb26dfbf56a03f4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242108, "uuid": "42f7cacd-0f75-4d85-acfe-88a64e08c345", "comment": "Malware payload (STRRAT)", "value": "d17e4731789eec2ec1634cb393a3faed46fb14361ba8b13355784cab7de854670e6a9939a7013a6116f69c48e3d65f3e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242108, "uuid": "0a328ca8-0cd3-47f1-938c-7e666376b644", "value": "T1E914736E3F4B90B1E253A0334654D22A7D28A6EBD204614F1BFE5C5D9CB8C580B56FCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242108, "uuid": "d8dd5f10-d7b0-464b-bffc-ddf55e6e672b", "value": "3072:IYWWvAxTxB3NPbbbgjJeoMmnMjFz8QFktsr4zrY/g4S2Nz7w:JWWvETxB9/bg4oMTFMd4Tg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773242108, "uuid": "d6f99860-704a-41f2-a5f1-331e1ed28562", "value": 205541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773242108, "uuid": "f8141085-a09d-465a-b7cc-b6c27bf30b63", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242108, "uuid": "438205ce-a48f-4919-baaa-4ee2659ea665", "value": "???????? ???????.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff561d2-1d5f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773242982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242982, "uuid": "3278903a-be9c-47e5-ac61-2b2df7ba501e", "comment": "Malware payload (ConnectWise)", "value": "20cb53c50b90a9e3a4c1a3dd999b6a4d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242982, "uuid": "b3ba515b-f42e-4664-8eb8-717c2c4862d5", "comment": "Malware payload (ConnectWise)", "value": "ac1144b04ed7c668725b060d23a43ed3c7000db510859e8065183cf164651720", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242982, "uuid": "aaba4efa-107d-4095-9a21-cad184fca06d", "comment": "Malware payload (ConnectWise)", "value": "dc4b3ec829c95c7f60763b2e607354a969dd7e4f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242982, "uuid": "398731a8-3d09-406c-85d0-60db3bd525c7", "comment": "Malware payload (ConnectWise)", "value": "7787f893ae084713a016b5f7b06f367c8131025b9253bc5decc8116f574a6ae5a305a36cd4f9738c20e63c3f68b5cac4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242982, "uuid": "57ebe6de-4ac3-4218-ace6-bf4bf848ba18", "value": "T12EA6232153F9D028E0F35B35EE7AD165AA32BE618E12C15F1354780E39B1E8196B373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242982, "uuid": "7570a0e6-5d06-422e-b82f-9f99ad1863dd", "value": "196608:iBn2hg5kEWmXhcfKjSVyh7vGesBn2hg5kEWmXhcfKjSVJBn2hg5kEWmXhcfKjSVu:egdEEijDDG9gdEEijsgdEEijAgdEEij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773242982, "uuid": "19d2c831-fd21-4f65-86ed-1d311a377a01", "value": 10121216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773242982, "uuid": "41f7cda5-b23d-4f33-9e14-5c2b6eb7a18a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242982, "uuid": "933d9b74-cb3d-4785-8a2e-81f76d735b9b", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db94e7b7-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773217956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217956, "uuid": "076a1ae6-538f-4e87-a021-2114f3b92bb9", "comment": "Malware payload (Formbook)", "value": "02bd60b5c9d108b4ddaf5bb38f7ec5a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217956, "uuid": "d41bda8c-f7fb-4419-a27c-16b6dc8293f4", "comment": "Malware payload (Formbook)", "value": "ac5d5a1c08b75129823ff12311b40cab133ad654b70fb44a77c8c4c6453f3972", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217956, "uuid": "80e768c7-4640-4c81-9be8-74629a8461b5", "comment": "Malware payload (Formbook)", "value": "39fce3ecac71bc2a3db9915729bc9265bcb34443", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217956, "uuid": "75188af3-5bac-4b43-a9c9-6df90be17675", "comment": "Malware payload (Formbook)", "value": "93c28a175aa09d7d67391fc1117ec5de4f15af341b18b24f7a90416706b46ada38b436cb1f0d7b51ab11f6a1260070fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217956, "uuid": "4ec5e5f1-e350-41a0-b621-1f0a08b68c33", "value": "T17335F118276ADE42D5A15BF04970D37813B9ED8C6422C3138EF6FDEB7979F4528142A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217956, "uuid": "bdd7f3ec-2bce-4b79-bc78-ae2de6d15f55", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217956, "uuid": "7d418b25-55cd-4d2c-8b57-8ac041082aa1", "value": "24576:QhciaQB6TS4eNatvmjuBzKJdsZRxC9BL0MaNub:wc68AdckgDK0lN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217956, "uuid": "27fe12d7-9033-4565-be46-60b57bf05b93", "value": 1134600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217956, "uuid": "52117204-d190-4b4d-835f-b8b38316d912", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217956, "uuid": "3f71e7c6-1c3a-4269-a3fc-1fd7479578ef", "value": "OVERDUE ACOUNT LETTER.EXCEL.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52c722d9-1d60-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773243496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243496, "uuid": "7349c131-4ea9-4102-9146-a11df8a61633", "comment": "Malware payload (RemcosRAT)", "value": "eb5741628badcf40c1d2b44fd27f9d9d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243496, "uuid": "03939a2c-380a-4dfb-b555-74ead36fd1f2", "comment": "Malware payload (RemcosRAT)", "value": "acb23a2e393a86215da784a99b3f6c9122a76fd19c6ad9cf9eb2faf86daeb6a6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243496, "uuid": "0002a56e-de5e-42bb-9a21-268410bfd58d", "comment": "Malware payload (RemcosRAT)", "value": "5161fb1a341564ecf98496dc8b3263fb74713e30", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243496, "uuid": "7f366f59-b9ad-4331-b948-de17d09f925c", "comment": "Malware payload (RemcosRAT)", "value": "55bbcec2c0c46a0275f0f28ca532c828189517f4bc213c8ad4b602dae9d2d95e8b9c26b017be1dc307cdcb534eb066b2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243496, "uuid": "a66373f6-2e23-40dc-9f88-60053729612e", "value": "T1F966AFC590D027EFD81C1D395ABE7B1EB3E1A95EE4501B0ABEE3EC4E5FBC2115842246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243496, "uuid": "dbd6c536-3a30-4d91-8dfd-ec7b9af37805", "value": "24576:UjXhdqhu26o6J1xPenYvr69YaSVT/IEG9UrAIitFn6AyrlY2njXhdqhu26o6J1xW:mXhdj3JP/20K9sBjXhdj3JP/20K9sBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243496, "uuid": "dc1dc516-342c-4e56-88ad-912599efa488", "value": 6481434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243496, "uuid": "3042bb2b-ef44-492e-a84a-7bb2e7df55c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243496, "uuid": "d52cb8c7-db0c-4ec6-8ff8-5020a2ec0a81", "value": "eb5741628badcf40c1d2b44fd27f9d9d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b56c05b-1d5a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773240880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240880, "uuid": "757a2c82-1d33-4954-8104-463a6a0dc518", "comment": "Malware payload", "value": "00573009c19e767814562afb820018c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240880, "uuid": "d73e38c0-c174-4cae-b059-bac17e35a2a8", "comment": "Malware payload", "value": "ae0b55e34d5df993d181b1614a3171269a878151272c3cc747a6285aabff7d98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240880, "uuid": "194c6779-4d57-4fea-9a9b-b8b6fdd31eae", "comment": "Malware payload", "value": "5129259ea4248e0a8e6e986881d52e2d0756d98d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240880, "uuid": "1772208e-9e66-409e-98d2-d0ca35f5b629", "comment": "Malware payload", "value": "8bc8acf89bf34dc3c1f12262bf50577d8f3e60b830d511a43b61a8f4d2661820479b211f2ea040374125522b25f269d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240880, "uuid": "523704a4-b149-4eef-9a34-010a0cabe8e7", "value": "T109D623EEC4D502E4D8D34A80328E53CE71D0656E46FD6C2D3ACA1D11AF21D6F624ADBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240880, "uuid": "6d72864c-d565-4176-8d82-d741c98ba21b", "value": "daf9c730d161b8908dd2b73a28e6d02c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240880, "uuid": "40c90bd6-c985-44d2-b957-9adbe8a07c03", "value": "393216:GUBiB9TMCFTuG6ZpjJzuqYMFuOWTBtYWk0A:GUBUTtujbcMw1ttt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773240880, "uuid": "f8668afc-f558-487a-b250-6b839ed3b972", "value": 13828584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773240880, "uuid": "e7f8e499-a4d3-46e2-b948-e13dd3ed09a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240880, "uuid": "02fb035e-e41f-4bec-ae6e-df964e51f613", "value": "Download_Play_Store_Exe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9328131d-1d5a-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1773241027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773241027, "uuid": "6847b7d5-a5a2-4d6b-99c4-12c8343406f2", "comment": "Malware payload (Efimer)", "value": "c7ef521c3590204dc8a7a5f95abf7e0f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773241027, "uuid": "6e9e5613-8615-4cca-9a0d-c45fa050a083", "comment": "Malware payload (Efimer)", "value": "aeed5ccfcef6f171f2c2bd9c053b189ebafb694965679e3b5f8f23df56eb3a80", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773241027, "uuid": "b2708a01-e976-48ae-aca8-20ab0ac7d24e", "comment": "Malware payload (Efimer)", "value": "6b9aef958cfa97e2495ad0b0c960bdd4b3bbcf8c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773241027, "uuid": "708fad0a-d84b-4e78-b896-501e2beaebde", "comment": "Malware payload (Efimer)", "value": "6291dd974182a7e8b19741dd93c69a5498b030c3f8b02cac489757fc8b55bb6df74c8a0473c744a8294c7aa64b596bbd", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773241027, "uuid": "2332fab5-4ce7-4442-925f-4c5860e183e9", "value": "T1F3D6332C62D221DFD677D0703AF16BF0A4647A740170EE7B9158E3B1BC9F861A52A4CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773241027, "uuid": "ac90a725-7e68-40a4-90da-775e81d0b0a6", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773241027, "uuid": "7ff377e2-b688-46f1-a664-bf2530004455", "value": "393216:gkNPvdDv2uPl/+ZXMCHWUjXmcuI3/PGTAI:g8P1ycl2ZXMb8XbH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773241027, "uuid": "b5220c90-61bf-4a9e-ab59-2b8ec2a8b4b0", "value": 12619004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773241027, "uuid": "3a1b72b8-2e7a-418f-9969-56bfb2f52478", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773241027, "uuid": "96ab3871-97f5-481c-a698-97692e4c8289", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d009695-1d20-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1773216106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216106, "uuid": "c235b658-6587-4374-b787-f9a9bc2c8d12", "comment": "Malware payload (DarkCloud)", "value": "928ccaa963dd1e0fbb7bf6a494bc77f9", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216106, "uuid": "701420c5-5a1e-432e-92e7-40f7b0009f9f", "comment": "Malware payload (DarkCloud)", "value": "af1f1f18fbc394b317725e5c902b3ed9663f31f3d5e82a8a2ffb89eaf05b89a7", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216106, "uuid": "2661757f-623c-412b-8042-60c442c9b24a", "comment": "Malware payload (DarkCloud)", "value": "67c6a4cc45ae9fc2d10624ca291d0135c1d55ff5", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216106, "uuid": "c4d8bfdc-7817-4d85-9ccc-b7507ec87a57", "comment": "Malware payload (DarkCloud)", "value": "95c3b5da7bdb712e1311cd37b48543652f91be6ddb62369e832fcdfed090aafda3365eeb93ce6c5d783e86092ecc1863", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216106, "uuid": "652e277f-5d62-4ca9-9c61-af2c2e395ace", "value": "T138C5AE0879C934C4AFFAA81FF028610875F103FDD0DE1569EE93E819BCD36995A5C1AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216106, "uuid": "d1879216-abff-42a3-a292-51bb7615ae5e", "value": "24576:ozjkE9weKRLyUQtfogqzrZEiKNHExbi8aXArjbNbuaxbCvnT3TMK9K/fJRg1ge1n:O/w3EiKNHgiuRaQbSJ4GkeaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216106, "uuid": "4296eb97-541a-464d-8a75-405653fa809b", "value": 2692464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216106, "uuid": "137b153b-cc39-4f48-b02b-e3cb560005fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216106, "uuid": "3ddc2d8c-eff8-47a2-9b05-431b4f8ad740", "value": "928ccaa963dd1e0fbb7bf6a494bc77f9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a4c0d4e-1d1f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773215699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215699, "uuid": "b9607f18-1c78-454b-bef1-c893cb7ba426", "comment": "Malware payload", "value": "4c5da2eb9c72af19db74fc9bf26897ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215699, "uuid": "2afeaec2-4743-4e78-aeb0-6b4d3f6725c9", "comment": "Malware payload", "value": "aff2d7a372b8fc5e9b40ed6ad0e3b698ee7d57451dc215a8b8db919d4860c22e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215699, "uuid": "336589a3-a40f-4a6c-a443-9ac620e31b0f", "comment": "Malware payload", "value": "57447ea54837f41fe38bd5fcee0338bf954a61fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215699, "uuid": "80cf7c52-4a58-4049-8e26-25e933ad671c", "comment": "Malware payload", "value": "6d3da40cca81dd3ab246fc83518a3d67d8643188de457b401e396e82bc87fac8e97dbe9a7debd738b1e2c0ccb45635e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215699, "uuid": "4dcb11d5-ab82-4418-b6c6-bf19512a8370", "value": "T1FA863300F480D1B1E2EB293075F1FA119B3AB239562ED89767DE09775E01AC85F6A1CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215699, "uuid": "86e00623-4e99-488d-a885-55ed069f4b21", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215699, "uuid": "edc48b49-2985-4090-bdeb-9fc24d8cfc2e", "value": "196608:fP2A7wZNHftcE4V/apGsvmOs2Jy4QoTXEOFOLZys:nJ7wN/qJ/apGwPJWeXEKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773215699, "uuid": "09a0aec1-3dc9-485a-9eb6-494d4697a710", "value": 8577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773215699, "uuid": "6860f214-3c4e-4b47-9c7c-db1b438c6d04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215699, "uuid": "80d49e1d-bf96-453e-871c-b9a64893d088", "value": "sthealthclient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36701f2b-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249891, "uuid": "b70a6d61-9668-4621-bd0c-dc0f3626128c", "comment": "Malware payload (WannaCry)", "value": "93f39d086beb478188bbd19ba1781382", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249891, "uuid": "79cc39ab-621d-47d2-aeed-156a3ce7ba8a", "comment": "Malware payload (WannaCry)", "value": "b226c50d47bd1af95cbf6ba372eb142b5db30d04386e4d500af97024adb48f00", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249891, "uuid": "9ad98025-db19-438e-8912-5dd095ce5279", "comment": "Malware payload (WannaCry)", "value": "ee6409d54c6434c0eeecb526087e24581c0d74d0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249891, "uuid": "793412e1-c9a3-47d3-8ba3-0870503502ce", "comment": "Malware payload (WannaCry)", "value": "57fd125ceb7bd44ab89dd7022d039041aaf0267d5860cee72532c782b5bea3584821ea8435504f84c6ef65d1f09cda8e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249891, "uuid": "20078d16-8b58-4ad0-9653-a90e15b91ce9", "value": "T12F36126634DCC0B1C103627098BB8B62E5BABC292375554FBF904F7A2E237A1E715B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249891, "uuid": "0e20419e-5654-4342-95ea-01d6dcb106f6", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249891, "uuid": "4511ad9d-7a0f-47c5-a6ac-961db0c03114", "value": "24576:RbLguriIfEcQdIVUvxcMNgef0QeQjG/D8kIqRYoAd:RnpEKUvxcBVQej/1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249891, "uuid": "5d0de004-c7c5-4766-a1d3-242fd6db31c5", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249891, "uuid": "243a8646-8831-4dfa-9a3d-549a42b2883f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249891, "uuid": "52a5e09c-e77e-4c3d-bcb3-63c2d7298dde", "value": "b226c50d47bd1af95cbf6ba372eb142b5db30d04386e4d500af97024adb48f00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ec93849-1d21-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773216351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216351, "uuid": "5c960861-94fe-4518-b318-845f7acb8523", "comment": "Malware payload (AsyncRAT)", "value": "28674ff93413cb8a4568c7cb8c4a89e4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216351, "uuid": "141eafe3-9da2-4877-aaef-36644a4802cf", "comment": "Malware payload (AsyncRAT)", "value": "b2bf943f220397f11ded2b2b5992002f93be60605d91b8b8dfae28b4d862540f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216351, "uuid": "a4bdfc4b-a18a-47be-9394-91e8b02f72b5", "comment": "Malware payload (AsyncRAT)", "value": "e02f537951ed04ce1c1a29ff94d10aade69a035f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216351, "uuid": "1466135b-941a-427a-814d-c1d8663742b4", "comment": "Malware payload (AsyncRAT)", "value": "247460d5be350b2489e43ef6e0119d94f2db4751dcc1a70a54793c3a95971ecbbd22c8d94ac83187114ff78099aaaec0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216351, "uuid": "2ed71b3a-b116-413c-b856-c61d9cd33726", "value": "T13E45085544690C323AFE86C9FFE1876D714CC103C0C547F2ACB6A9A3B5B025CE59DBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216351, "uuid": "aab5f6b5-27da-4df4-bbb2-8ea255ee979c", "value": "96:xqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqo:n0D/KSnm/j1v2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216351, "uuid": "3c568841-e581-48ac-99ce-619193eace67", "value": 1231396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216351, "uuid": "87c5cf52-8a4d-4ee3-b1b6-b151c34466b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216351, "uuid": "ad14f9c5-3287-4d42-baeb-f7917e0f5f47", "value": "28674ff93413cb8a4568c7cb8c4a89e4.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7f43ff-1d1f-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1773215486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215486, "uuid": "b7c5f333-8cf4-486c-bb84-0fb9e6b9aec9", "comment": "Malware payload (AsyncRAT)", "value": "38931b2c558bd178c3bd510947e14f28", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215486, "uuid": "0085f17c-6b62-49cc-9343-66800a9d4a22", "comment": "Malware payload (AsyncRAT)", "value": "b2f7cd8a8984266ccf8060b18823cdbe01a88f62b809b083b681028c0c11d793", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215486, "uuid": "235d11f9-b150-4a20-b360-7a23649884fa", "comment": "Malware payload (AsyncRAT)", "value": "8156c1022f7a3f33d2fe0f6926d24c64f2cdc689", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215486, "uuid": "489ea0c1-d1dd-42d8-9d8c-cfae75b10bbe", "comment": "Malware payload (AsyncRAT)", "value": "47ff0c5472f9ea620b2222acba3d58947e90a3c53680f9287aef622bead3ac5a45ca39c25b131bf6f86c6b50856e2ffc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215486, "uuid": "cc5cb4e8-8763-4b4f-8ba2-0f11a7fefedd", "value": "T103261233517F9C644BE68581093479B4D8043673D60DBA6A74882FF7A38981867E2FEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215486, "uuid": "993d9244-8245-4a34-b0a8-6ae49a55eac1", "value": "768:ISZrBo6BBclNFfcLOY1stSSdL/Dhh7To5DlftGj46A1oA1oEj5DlftGj46d2oyxY:a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773215486, "uuid": "af93893c-d4de-4cf5-a839-edb18e47f2b3", "value": 4605954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773215486, "uuid": "a1b0c117-9b17-46a1-b416-7da39c922ef4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215486, "uuid": "23a35ee4-d82f-41e5-b7e3-6d2e8d98d7cf", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e360ab45-1d6e-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249752, "uuid": "1dbf6cb3-d5f2-418d-8b6c-13faded4f590", "comment": "Malware payload (WannaCry)", "value": "6e1dfefa794474d92b9e4412aea69f77", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249752, "uuid": "47507db2-c22e-49fc-8bd4-911a14c53995", "comment": "Malware payload (WannaCry)", "value": "b30a9457d46bbfb8ab98c3108fd804049fd8612cb0e92d2ad6108f3ea5f2ed2d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249752, "uuid": "1c113d20-7150-413f-843a-9019eb0c7078", "comment": "Malware payload (WannaCry)", "value": "26007c3184f5077a420f5c5690f468ff1b3f82b0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249752, "uuid": "58c47ff0-7198-4ecb-9eb9-8fda9cc3d170", "comment": "Malware payload (WannaCry)", "value": "cbc9b6f94e28289b17b39ed4ee58e75a27496c3e7394f23b4220b9ebb1c0f30fb7f75a7571740fdb74e732a5c86c8841", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249752, "uuid": "bd3a6c24-1d70-4a78-8a74-c16adb5a7e91", "value": "T1F336226A766C91FCC11A6234A0634936EAB77C6A22BD970F8B948B520D13750FF74F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249752, "uuid": "6d44d625-7e2d-40ac-8359-e1a6136f3e4f", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249752, "uuid": "27c199bc-58c6-4dd2-8cf6-a14e1f0cdf2a", "value": "12288:ywbLgPluxQhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D:JbLgdeQhfdmMSirYbcMNgef0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249752, "uuid": "ef8b1fbc-e482-4d29-a9f5-d9472c211a6e", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249752, "uuid": "afed8abf-5039-46e1-aaaf-f2206e0464f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249752, "uuid": "dd6c7a89-2a29-421f-88bc-fee057c897c5", "value": "b30a9457d46bbfb8ab98c3108fd804049fd8612cb0e92d2ad6108f3ea5f2ed2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1411b733-1d4c-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1773234801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773234801, "uuid": "4c70078c-eab4-4c9a-a7de-3b92055468bf", "comment": "Malware payload (NetSupport)", "value": "6bd8a043914fb743f3e6521a56aa09bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773234801, "uuid": "524047fa-fd1d-4a5d-b6f8-ec01b0cb4f70", "comment": "Malware payload (NetSupport)", "value": "b30f4605e181fc71c339131d0b8d104d337d23fd9707b6939ef8933e7c434f05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773234801, "uuid": "278f5ae1-4868-432d-99b2-4a24e4592b71", "comment": "Malware payload (NetSupport)", "value": "ca205dbc72acaf1dc1656209163dc12b800a888a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773234801, "uuid": "db28d576-36a6-4b0b-be57-54d59742ece3", "comment": "Malware payload (NetSupport)", "value": "ef65b25a64f1080417ced9fd191e1f012d297e7b313767452eb4aa10c2b3a4cedeadc8ae57f01f00a5b55bc3b435245b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773234801, "uuid": "67949013-32a9-4194-945f-c1c24a068959", "value": "T10108332044E3ABF2D4DF537D2C249E4424B44B06C562B82D05F8F52BBCF5DAA99C9B4E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773234801, "uuid": "65548555-57fa-4c51-85dd-2e07c782a2f5", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773234801, "uuid": "2051da62-3d24-4459-8fc8-afd74a3be35e", "value": "1572864:KwRGdwA0LdNFqW2o89CvanEueumtFL5ujQ3/udTO0o4ScwQrwUAU6atpRzA:K5gvqWvsqOJmPd/3wTVo0rTd6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773234801, "uuid": "f1a3dd7c-54d0-4c19-8943-e0d3c340f45d", "value": 77211880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773234801, "uuid": "31c677b7-c920-408f-9fc5-fe90c49e6167", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773234801, "uuid": "617f0dd5-61af-4ad8-ae5d-a988d6c91cb1", "value": "setup", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4ff352-1d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773256451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256451, "uuid": "b7ce6c80-d5e5-4271-ba43-c6c503da45c8", "comment": "Malware payload (Mirai)", "value": "48e047eed42bdd83ab8bb123753808ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256451, "uuid": "3286e005-a91f-4b4a-8de3-2a902c172821", "comment": "Malware payload (Mirai)", "value": "b395d3403c5a16893367ba8bb132f60bce1c4d13fa3ad093d2fece81973c63ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256451, "uuid": "80297a89-8962-40bc-a9c0-d886fe40bf7a", "comment": "Malware payload (Mirai)", "value": "cc0a68d6a4fe383e61c372efd9a5e1570922ee10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256451, "uuid": "76c5d375-a84a-4538-9835-ddfc304012b5", "comment": "Malware payload (Mirai)", "value": "134edd98918cfe230621487e07f7a2ea3609d22d86867d795ecb682b8da1227b7e4b958d28562aa5a17e54c5b0571735", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256451, "uuid": "717cdeb3-e972-4c4b-af89-02ba68ba0212", "value": "T1A7F2F1FC2B1703D9E6754DB1AEEC43D15CE90FF31982AC42BC22229BEB46D88705B594", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256451, "uuid": "92b97969-a4ad-456d-a212-4317c8b86acf", "value": "768:alWqYyhC5YjwTt97/EFMw7C0A7rluQAJQEhvJgGlzDpbuR1JQQ:Rq+5YcTtdMMg4rEb7VJueQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773256451, "uuid": "58d1f316-d714-41d4-8df6-29e75e53ea41", "value": 36120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773256451, "uuid": "a3e376a2-99e4-4852-a5a2-21ea4b2b598a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256451, "uuid": "74b3c89c-d72e-4302-9302-65c64f0c46ce", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1973a3e4-1d60-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1773243400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243400, "uuid": "4ba50d73-878c-4649-a0a7-ec2edac6b656", "comment": "Malware payload (Joker)", "value": "fd9843fc4bb266cc997ab484b16ec435", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243400, "uuid": "1883368f-ae9c-4e63-a77d-ac8532c1cefb", "comment": "Malware payload (Joker)", "value": "b50540e10b04010acedb62e48694af7fa9079c92b11eb396c2ae92b36ad191b1", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243400, "uuid": "85882752-2e7e-44be-a164-c515553d22dd", "comment": "Malware payload (Joker)", "value": "5a1ee1d969dbc579b20827f7dfe6958fe8442a0d", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243400, "uuid": "6dde4c1e-57f0-4733-9d7b-3abd8e965e33", "comment": "Malware payload (Joker)", "value": "253063d1641c397674cf9b278deb39606e8288ac9ab65a3c154a1e3e36cad5e4807f6ba802e85ea430987c0c30c2c3a8", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243400, "uuid": "6aeff329-12db-4cd5-8eee-960c94653073", "value": "T12057231DE74DE82FDEE6B07D4EA90162225B309A4112D36B6921820DFAC73D44F7EBD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243400, "uuid": "fd0bbd48-8fcc-4995-9bea-602776f6bb40", "value": "786432:+OpSA5GqEWbC7r+JRhvEu6rbIdVjDs3LkIJMC:TGqEyk6vEbbkK7bJMC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243400, "uuid": "7cf7458b-1fe2-4d26-a3f3-790416a24e30", "value": 27100870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243400, "uuid": "af0b7938-28bf-4dc6-a812-b992ee7bb3d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243400, "uuid": "8b0f8798-782b-4c20-9ecd-4a37d0020cb8", "value": "Cute+Emoji+Wallpaper_6.10.55.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75cf282-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217976, "uuid": "3fd02b29-df36-4f4d-beb7-5c8e1d4c8cd7", "comment": "Malware payload", "value": "6a641ef4eb91c26e47857f03abbc191f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217976, "uuid": "3763abbf-3f6f-4925-aea5-f2387dc82e35", "comment": "Malware payload", "value": "b545bb595b332d6d8e13a57d2f968fb35e4b5c39eaef92d57f0881ddd8380dd7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217976, "uuid": "08d82f9d-3975-4032-a1d6-937441e99b95", "comment": "Malware payload", "value": "a73ae927a454902dd5222c5ca6b12f5e588f65f5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217976, "uuid": "b07b2155-9fa6-47cc-b605-9adb9cd6b247", "comment": "Malware payload", "value": "fea8cb64ae1eb7490422e27fb0705475e1ce65e019bb62ada7cc4523c3a447017e7dd586b7b123b148580f7fc551ddec", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217976, "uuid": "89c58525-e7ef-47cd-9fb3-49bbad50f7e8", "value": "T1A83613B72346A9E3C61361931D39E3792B53C1D5249BB348AA535FA34B284CD371A8F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217976, "uuid": "b2757013-2f43-4814-be68-12b9529bbf3f", "value": "384:Op8o778ckGOTuN7TzMWh1Me3Q9XYRAcorHZXYRAc/MYyCjfp8oK+jMY+uYoCkYZQ:w8oQ/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217976, "uuid": "f20724b2-0ca9-4d33-8a53-5ef9a1d0b41e", "value": 5340598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217976, "uuid": "9d52ace1-548c-4c93-89fa-4e0ddbcd0a98", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217976, "uuid": "3b8f15f1-10a8-4a52-9ad0-3ee8ee4384b3", "value": "CopilotDriver.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e39043d-1d43-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773231167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773231167, "uuid": "0fac395e-640e-4fea-8c5f-ca94b92e0b84", "comment": "Malware payload (RemcosRAT)", "value": "4d67a4dcc77d2bde6dde5905962b5230", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773231167, "uuid": "91b5c8d9-5cf2-4fbe-a17c-3820efb55f2a", "comment": "Malware payload (RemcosRAT)", "value": "b61aa2f1079bff7a5a7d3ad6da5c914309319b050b1a88b9a1c702e2d26026c4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773231167, "uuid": "f538104e-4db7-483f-b608-4b5b1e4ba68e", "comment": "Malware payload (RemcosRAT)", "value": "5e3a55eaf03b7be4f2c9127eadbd7fd4a98004af", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773231167, "uuid": "0bf099fa-9b83-44a9-9c1c-d7871721b5ba", "comment": "Malware payload (RemcosRAT)", "value": "30c2291b9a15bba4bff9612e248616073851ae41b3f180700ca6028ead8a84726eef495f6285536a39bc045dc5bcc869", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773231167, "uuid": "81d86149-80bf-4585-8d45-3d6f687ce52c", "value": "T1E915022DECA5FDBAD816153983B590DE8620BC07EA55D3471FDC3F092076AE8A2CC539", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773231167, "uuid": "74bf06b6-2f12-4e01-bcd9-d2a5788534fd", "value": "24576:/oVZw6oh5E2mUPoVZw6oh5E2mUiwmfBy:gPwDh9wPwDh9CfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773231167, "uuid": "c549cb16-977a-4d4b-b459-e92a052763c6", "value": 896000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773231167, "uuid": "57a75253-388c-4a86-8dfd-60df62bab20b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773231167, "uuid": "ca6a7b66-7ab5-4475-979b-7706f38bb723", "value": "PO_2022090164EQUIP.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cfcd1d4-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217770, "uuid": "a559d531-9c34-4f0c-94a4-dd330cf38f86", "comment": "Malware payload", "value": "6daee4145ad261f2ef8f6547cb96f5f9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217770, "uuid": "a0f2fd83-f412-413c-9f4f-acdcd96c421f", "comment": "Malware payload", "value": "b620860342d45ecdae7246a88f0dc6a9df5522b8265b7595a5b9a724e6de3e12", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217770, "uuid": "40e7b4b3-7aca-40b5-9fef-6dc1d95ce050", "comment": "Malware payload", "value": "32d8c95f0cee50ccc5613bf2dc166d7364282e3b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217770, "uuid": "3c09fc9f-eddf-4dad-b63f-872fe98eb902", "comment": "Malware payload", "value": "16b764ef901f0e78539753ed0c3cad98943f473475ed15e75e3f18ba501a826775b536122cc00dc07e2560171b6099ed", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217770, "uuid": "a14314da-2e71-4f97-8329-ea4d7b1e66c9", "value": "T1EE53528A2DDFF218524A353F3DA770E9E26E8C5C642C8498D3DAB8D5F85C30894F7568", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217770, "uuid": "aeab21c7-b290-4657-81b0-42729450b974", "value": "768:Vf86lg7V7zOeLikosGvfZr80v3RX/SdsKwVgNMljSoQjg1mwkGfIiMwaZ+YG+OnT:meAJOcDosQZR4/VfkmwpwibYHOnjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217770, "uuid": "4b9c48eb-c008-48ce-979a-4b3a7f9db29a", "value": 65305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217770, "uuid": "ee005bb3-9278-48ef-8c21-7983d666f4cf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217770, "uuid": "a8c7870c-313e-4539-9368-809a26025338", "value": "6daee4145ad261f2ef8f6547cb96f5f9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce8cee0-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773217153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217153, "uuid": "f19e7443-aff0-49dd-b8f8-2040297af6a0", "comment": "Malware payload (XWorm)", "value": "bc136da985c1402a1181f4dbc30e5fdd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217153, "uuid": "c7f2b1b9-2717-43ae-a1b3-9cc4edd3a927", "comment": "Malware payload (XWorm)", "value": "b65da47cf6dc6bc5ae6db9041f67c97a04f28672cea65e7ad9a0359391cdde48", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217153, "uuid": "04b606fc-40cf-49e0-a81f-2e15f3055c4b", "comment": "Malware payload (XWorm)", "value": "ca7f6535c978c06b0fa8872be67ea8ab8aa97c6a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217153, "uuid": "631e6c62-4688-4388-95cd-4bbb679077d8", "comment": "Malware payload (XWorm)", "value": "557c9d37afc61a4e837b2ca84e317a74097bd2f1243eb18114c94f931924de903e8c51a3476f75a67e4ca478d3c1c0bc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217153, "uuid": "7bfbab10-7a6a-4ca2-9809-5d5935e65f16", "value": "T1664509B2B1B24DC02617EE2CCC9A6605DCC90A2E17BFCF50FED1A6897587C657423E19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217153, "uuid": "895079aa-3108-49e0-8b98-2dad77a5b84b", "value": "24576:2CC+H5LL6yIapIahCRHCyQkJ60uCHQALFL6CutHLtH6R+QHRL6CJLHNMSwetSL60:pBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217153, "uuid": "25774314-c453-4d8c-8ca0-8f0cd09e7602", "value": 1169300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217153, "uuid": "665103bc-10ad-4043-ace3-4a0206cd4585", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217153, "uuid": "dc55a103-2ea6-4ab2-b219-205bea68e597", "value": "bc136da985c1402a1181f4dbc30e5fdd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc50ae18-1d26-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773218789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218789, "uuid": "b153b770-6918-41b1-8607-3b159b16e7d7", "comment": "Malware payload (Mirai)", "value": "16943468e6b7b3e48cfb58599ab7d9e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218789, "uuid": "2999c21b-5a49-4ff5-b600-54b96d25892b", "comment": "Malware payload (Mirai)", "value": "b79102af20e7f88e6fd4b654ca5ee1b4a48bdb75b32b6675468fa492a6fddc12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218789, "uuid": "b14a66c8-ab9e-4381-9622-dc4e44ace34c", "comment": "Malware payload (Mirai)", "value": "ed5164ffc9aa9413dcf266be9d302ca834e1d18e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218789, "uuid": "5ff1af61-95ba-42a1-9638-d17b2753e8e8", "comment": "Malware payload (Mirai)", "value": "1623f2f36af6fc0d8a75679e198897553e9b166058c5836c80fef5dcedd5338afc131c78b63c92118daa003d97c8283e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218789, "uuid": "8989cfc8-da08-4b74-a5e5-7664bd2288bb", "value": "T19FF3F755BC519B16C6C616BBFF4E428D772A17A8E3EE3203DD156F20339B85B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218789, "uuid": "17252c0d-541a-437f-b2d0-7b609732bb89", "value": "3072:HdDPNIdcabSkRwivkxuSjID9qupj4Le+5joka1JLU8r6:HpPNIdcabSkWmkxuSjID9qIj4Le+jo/I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773218789, "uuid": "6e823423-9e6b-40c7-8032-7829be9368fe", "value": 169496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773218789, "uuid": "76b367af-4326-4311-b399-466c89c0be71", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218789, "uuid": "c7c34e8d-469d-4d19-a105-d6eaec436a5a", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0270eda-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773217991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217991, "uuid": "cb54c6de-458c-4d60-b91b-0026e4dc839c", "comment": "Malware payload (PhantomStealer)", "value": "3c7471c143d28034a6d2d4d6151e09aa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217991, "uuid": "4c9417fe-5ffe-4afa-9a3e-1340a1f16bf2", "comment": "Malware payload (PhantomStealer)", "value": "b7ae5bf643afbc6fbb07b0970b9f5b4e58e1974e90e5a41f98ef432e64cb740e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217991, "uuid": "38f6d16b-e047-4c9b-a315-2d4fd56a488c", "comment": "Malware payload (PhantomStealer)", "value": "162a1e3294498fb1e457b777d49783ed812738ae", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217991, "uuid": "6b3b0bee-0ba5-43bb-a1ba-9911d5bd07ed", "comment": "Malware payload (PhantomStealer)", "value": "5f440f0857fbc010c4db7bf1ecdbcacb2e081f2029e1206c32fdd1ff8d49ea72778094411d3056965a81fbf25c53bd0e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217991, "uuid": "12837c52-4642-438e-a1bd-cbdb98dba1be", "value": "T147C2328C2DEFB22C564A70772D6BB09AF13E8D8C746DC058E7A66981F86D318C07B564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217991, "uuid": "1408ff15-8687-47ba-8ad0-1ccd4d3e2c1a", "value": "768:Cb2pdTdSvnAciBkmg1hzlMT3D70/4vCyux:CqdTcvnApk/hhMT3D70as", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217991, "uuid": "a87908b8-afa4-430c-b94e-28fb492499ea", "value": 28132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217991, "uuid": "76477288-7755-4c70-b85d-b3f30522ca66", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217991, "uuid": "28a08eed-6385-48eb-bbbc-776dcf46c2ae", "value": "3c7471c143d28034a6d2d4d6151e09aa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe9f9a39-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773217156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217156, "uuid": "56a9bf77-ad8d-4358-9559-7f283451ea63", "comment": "Malware payload (PhantomStealer)", "value": "ff98d92176e277630ed7d0fc6208618c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217156, "uuid": "58861d90-be91-4519-826c-cb1edf8239ac", "comment": "Malware payload (PhantomStealer)", "value": "b7eae97e9bfe3d7cefe4bd49bc60e5e6bd25c26dacd834ac078126d470a61e69", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217156, "uuid": "3ada82c0-e96d-46d2-9a5f-babdd1c2ac10", "comment": "Malware payload (PhantomStealer)", "value": "e48fe9db0f367e2762759e5d66ef8237234f3050", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217156, "uuid": "7f89731e-e6a1-4264-89ed-df320a90b07f", "comment": "Malware payload (PhantomStealer)", "value": "c992ee4384afe6ce38a18e2203070561ab41c4b58e25b5bb4a62a8276e0ff90d0edaa5a1d9060f2f964ef148ed685815", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217156, "uuid": "5373f74d-3a85-46df-9042-5928bfbbd5aa", "value": "T10A26B01B73986AF0BFBC4D3C60535A1AD550145A60D9CCCEEFBB751AAE46B209C6F0C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217156, "uuid": "6875140f-882e-42ab-b6d2-159521301261", "value": "49152:XkmE9tU9rt7JgXS64dfCEzzN2aaXw+Xu4XfP2DPTzS8jG:q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217156, "uuid": "49dbbfdf-f47d-4e24-9391-1034001e96de", "value": 4640410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217156, "uuid": "4cc0338c-497e-4540-bb36-eb50c1e47ed0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217156, "uuid": "cf7a4501-f997-47d9-8155-707345c6ca9d", "value": "ff98d92176e277630ed7d0fc6208618c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5f5ef6-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249876, "uuid": "c287dca1-00fa-4425-8494-f284897a1096", "comment": "Malware payload (WannaCry)", "value": "0064e2641d419d2c68f9beb18246a297", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249876, "uuid": "d1859bbb-7a77-4794-9375-b4d7f59968fa", "comment": "Malware payload (WannaCry)", "value": "b845d4c43e886c7c65d67d4ce23bd380a52fb3a998355bb1baf7f3780e8bb376", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249876, "uuid": "db20b102-d32a-4989-99d8-e2e980a8d319", "comment": "Malware payload (WannaCry)", "value": "a87301f27ce9701769600b3930745bed5bd67fb5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249876, "uuid": "a1d3f18e-91e3-4231-944f-456c97b50a57", "comment": "Malware payload (WannaCry)", "value": "38d420beeefed78b7e87b9b4f429db55ca2f6ace5b30a2fbb66eac9c1c6c556bf5b09d897fe39d3036ba40437a7d378b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249876, "uuid": "0a36017d-c45b-42e5-9f9c-2d31332641f5", "value": "T13436235E317CD1FCD10A66756467CE67D6F33C5A22B8AA0F8F448AB60C03755AFA4A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249876, "uuid": "276c2e77-ddc7-42b0-b71e-0f4fea0b53ea", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249876, "uuid": "7780998d-91a1-467e-961b-92e4f771f88f", "value": "24576:zbLgddQhfdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626M+vbOSSqT:znAQqMSPbcBVQej/1INRx+TSqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249876, "uuid": "19d8988d-9cad-4e56-aa97-d4bd81974bee", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249876, "uuid": "7040f980-c4cc-4162-9166-2983a714ffe8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249876, "uuid": "4f6390b5-5369-4314-9d36-9a074dc2377e", "value": "b845d4c43e886c7c65d67d4ce23bd380a52fb3a998355bb1baf7f3780e8bb376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f5ba64b-1d8f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773263596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773263596, "uuid": "b01f87a9-bc53-4ed3-8801-cae5fdc6bb66", "comment": "Malware payload (Mirai)", "value": "74d60340b3dc1bf47448e3a6d29f7c04", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773263596, "uuid": "c1f56745-bf9b-4011-8b35-61ac34e56aff", "comment": "Malware payload (Mirai)", "value": "b8868b1d6813449e8f5310c9bb82a361caf624a86285b5cd8507ca20e3a45ee4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773263596, "uuid": "2d599c29-938b-428d-bff9-91ad172f0166", "comment": "Malware payload (Mirai)", "value": "b095628500d3c1e6cb2f7cde1dffe304e94e9e48", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773263596, "uuid": "7766da12-bcf6-4fad-b1ca-947ecf1c86d4", "comment": "Malware payload (Mirai)", "value": "df5d5ca1132f96a6934d1c9324af6d747ae9917e31158fb69ee80b1349c9d27230891b56e3e331e49f50c1ee790a0d1b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773263596, "uuid": "5230614e-dc70-46f7-8ec2-7c1f56b320cf", "value": "T18F5199DB12A1093559627617FFB8CE3CB6C8509738EABF04A4FC34B55A4CDC87848A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773263596, "uuid": "d6bd6c33-8059-47a6-b16e-0c1d3e833d85", "value": "48:io7hmVoNnE7oQCX0oMePgoaZazvZSoafaFvjko9N39z4geDopjc8coASvYojZjzp:iKmV+E7EX0QPg1gzvZS1yFvjkWzz4ZDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773263596, "uuid": "228f8557-5360-4d5e-a188-19cabed23c2f", "value": 3047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773263596, "uuid": "afc56a7d-7b7a-47b6-95f5-99dedc673331", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773263596, "uuid": "9c0bd002-1f7e-4a3b-a0de-e5271d3b5162", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41f2534-1d6e-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249780, "uuid": "692b1dd4-2aa5-400a-a935-03b8911cac72", "comment": "Malware payload (WannaCry)", "value": "57967b6e7787ff7365db472b97691ca1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249780, "uuid": "1960d8be-d7cf-4286-b662-3e2e659fff14", "comment": "Malware payload (WannaCry)", "value": "b90382ed0462a0c27a4edec0bc952549846f0616e2e4c700d9c2da065bb28208", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249780, "uuid": "59e4a9ee-a36a-491e-8355-a90a5a9553f7", "comment": "Malware payload (WannaCry)", "value": "c7c888ac1b1b48275b16dbd34abd23daa8cec8da", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249780, "uuid": "e4ab3172-3156-4394-805a-734d9ca94a3c", "comment": "Malware payload (WannaCry)", "value": "72addec1d8ec2d27aaa85bf5dd1b51dfcfdff3c0b1d26120616dcf328511552e391056dcedc4dc1581659310c89d08f7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249780, "uuid": "0b04d296-061c-48b4-96ca-fcebe9295805", "value": "T10836339A31BC91FCD2051A7494B7CE63B2B27C7A21FE5E0B9B4089752C43B56B790B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249780, "uuid": "ee5f43de-f96f-4a1f-8704-81e78801b822", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249780, "uuid": "e9513fa6-9b78-4921-ac54-085203640f77", "value": "49152:RnnMSPbcBVQej/1INRx+TSqTdXr6SAARdhnv:1nPoBhz1aRxcSUN6SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249780, "uuid": "93685e31-c7bd-488b-bf7c-c13baa41a47c", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249780, "uuid": "55cb4a5e-0caf-4984-9c3f-d865560050c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249780, "uuid": "122d493f-d20a-4a76-9e33-f563d6209275", "value": "b90382ed0462a0c27a4edec0bc952549846f0616e2e4c700d9c2da065bb28208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b57ad9-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773217109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217109, "uuid": "980b7fec-4d82-4853-9b67-fabb7f597d2a", "comment": "Malware payload (XWorm)", "value": "5b011f6f3b66195aac9b3ea31d2e6ef3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217109, "uuid": "bffc247a-c913-42a9-a381-ac4713bd9f62", "comment": "Malware payload (XWorm)", "value": "b972440babc31d8f4fe5b39b8254c9a81b9927bd35377546e01b38496d539c8f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217109, "uuid": "f62b08e4-c9fd-40c4-b63c-db02fdbafb2b", "comment": "Malware payload (XWorm)", "value": "c505736689c5c86b60350b738ea3be460d59542e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217109, "uuid": "d6c6eec8-c633-4291-83ea-384a60a9f08b", "comment": "Malware payload (XWorm)", "value": "33841cf6ee85ff3929b0e891e7a8ccec3a5a5d4463b343eac4ec8e794bbd8ef9008a832c2ee3f1acc40fb709c6077aae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217109, "uuid": "35c83a97-7882-4369-8024-1c1777de7f10", "value": "T12845D09B426111C1E2639623E2782DCCBD39F122F641E6385FD2D8FB46D9AD5360FB24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217109, "uuid": "d5683542-aa16-469e-b8bc-dd4a6527716a", "value": "96:8888888888888888888888888888888888888888888888888888888888888883:Hi1qfP7TB3ot6j/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217109, "uuid": "5ec9a488-62b8-456e-a8ea-038e27f59ca2", "value": 1194953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217109, "uuid": "560bdaab-8629-4c23-8e3e-ae58db0fe78e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217109, "uuid": "aba51a34-2296-4cb8-b37b-b4dd14472bbd", "value": "5b011f6f3b66195aac9b3ea31d2e6ef3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5101351-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1773217059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217059, "uuid": "bbfe0ccf-61b3-450a-8ac9-627138e50762", "comment": "Malware payload (VIPKeylogger)", "value": "07f3a58a3af3a53d17ac97e230dba179", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217059, "uuid": "fa71e2ee-67a6-499c-b27a-b75eff46688a", "comment": "Malware payload (VIPKeylogger)", "value": "b9788f112745b0b3a9bc618a8da26c1b97d969c84fb09f6c6b110f1f91b88ef2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217059, "uuid": "789c2d71-63f9-49a4-96f9-9a66ecd215d8", "comment": "Malware payload (VIPKeylogger)", "value": "d515dbb6b965d17515e95b3725b5d3d1214d9c65", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217059, "uuid": "1c53bcdb-771e-4888-a509-e9462d942ca2", "comment": "Malware payload (VIPKeylogger)", "value": "353184158849d0f16aea3d89f471c6bfb8eac1080086997070cb6b9eab72865153623fd7ac6bc24ce107c1dccf27a504", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217059, "uuid": "ebc59d6d-7a5f-4090-801f-899e5a0e8eac", "value": "T1B1D231CD79C6B16883013033A95FF49BF13F9C816C9CD958D9D5B898A8A4B38D0B587E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217059, "uuid": "511e2584-29f3-4671-abab-cab489b08d50", "value": "768:rYCaKY9UL3nmmFbrfMwFkkIplRDwqbOfihoiL:rYClLmmFtS9/RMqaaho4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217059, "uuid": "244d1472-e951-4518-bb3b-beee47fd2fdd", "value": 28986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217059, "uuid": "4fe8d02b-ae78-4fbf-8a31-b3401664d57b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217059, "uuid": "a61917c3-376d-4bd1-b3bb-74a7d0da0449", "value": "07f3a58a3af3a53d17ac97e230dba179.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7781412a-1d23-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1773217359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217359, "uuid": "726cf3ea-9c18-4748-9170-cf2ffbc20f02", "comment": "Malware payload (MassLogger)", "value": "e1f08a6eb65eafac00251070892cd657", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217359, "uuid": "5586d23c-c3e8-4e96-9797-5e76bffdc9a7", "comment": "Malware payload (MassLogger)", "value": "b991f83d05ee93506c7296862d67ba6c4671cf1c5958aa317198c7fb2933984f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217359, "uuid": "30524dc6-b9f9-45c6-bf50-2f7793f77ee8", "comment": "Malware payload (MassLogger)", "value": "6a23f318b38e1330b603c696b2837823c4503249", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217359, "uuid": "35ebfd28-3ace-4b5b-9adb-3a58f31820d4", "comment": "Malware payload (MassLogger)", "value": "f07df5794e94a86718a2784cd661ced043d0cd8b27890795fd53d6ce3c0c0655f10fa40845f81707182e09b5312c493a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217359, "uuid": "b7432734-897a-45fd-9597-4a67c257bd05", "value": "T12465BF9608CD6E2CDB2A7701D5B2374C43D1BF5BB6B6382505F5A4C21B2F4809E6F68B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217359, "uuid": "9f66502d-2f44-4703-9825-8b310360cfc8", "value": "12288:zjKrfxkboc3dE7sTW6J8+I5yTu6AIWzqs2uukHP4Op:XKrJJtsa6+Z8Tu6AIWzqs2uukHP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217359, "uuid": "c67f7d66-903f-454c-aa08-6b54b17cf86e", "value": 1537175, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217359, "uuid": "dac6a292-af95-40a8-9a39-c3e4f89360f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217359, "uuid": "7ffac420-5481-4ade-9872-e1825a55492a", "value": "SampleOrderPO6947158.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb01a74a-1d19-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1773213204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213204, "uuid": "bdf8b83c-c90e-4756-b680-beacc739b523", "comment": "Malware payload (CryptOne)", "value": "26d1d48fec1c0b7407deac5ac46bee77", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213204, "uuid": "66f36669-2c9f-4eaf-964f-40cfa39456f4", "comment": "Malware payload (CryptOne)", "value": "ba491b6fe34b2ff748e152a6595f08b1c811070c5d95e4116b6774fbd3fa4bf4", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213204, "uuid": "a592772f-2acd-4a60-aa20-53a3940e78e1", "comment": "Malware payload (CryptOne)", "value": "078a8eba645279e8fe2a9a4c8db288284e864b4d", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213204, "uuid": "5f481707-4d31-491e-916f-7dccee1b0367", "comment": "Malware payload (CryptOne)", "value": "c1539e3d0e4ffe755c78399b23b90905483f50b8ea9fd8188baef488328a5cd3862455c0eabc4f15da6226db664a39e3", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213204, "uuid": "e3011993-31ee-4828-8b8c-62b3414a1168", "value": "T17066012E6C70AC7DE4530DB48EA99E8BEA9378003A3D5B59BFD40DF80F26711E59418D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213204, "uuid": "566cc5c5-b22b-430b-a5df-aadc6d3d3e12", "value": "6b1853ab7d00a9b557cec90dd072fdc2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213204, "uuid": "7e3c2518-c122-4e36-8464-9b51d38bddf4", "value": "98304:DsTmUi13wEUGjUpV/eMjOKsi9ycWSGeCzaTY:gT41wEUGjUp06si9bWSBCzaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773213204, "uuid": "f7a1ec1b-afcc-499b-81b3-1a4f52fd315c", "value": 6609920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773213204, "uuid": "130ac9a7-57b5-4b34-95a2-b4a202e43d7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213204, "uuid": "46030778-708a-4f59-8fa1-44eb7987c05d", "value": "26d1d48fec1c0b7407deac5ac46bee77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5287d4ab-1d18-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773212572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212572, "uuid": "fe50c045-094c-4ffa-a43f-b060abaf527f", "comment": "Malware payload (Vidar)", "value": "a4df8b3b3b5305c3b3f5e17929fe6d88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212572, "uuid": "304583ac-209b-4e5f-a261-0f404c4a5afd", "comment": "Malware payload (Vidar)", "value": "bb8eac5e24eb1deebccd34b3b9fccfdefe8a7dc72dd976a848989c384d59538f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212572, "uuid": "9c586851-773f-4abd-9fcc-606b557e7908", "comment": "Malware payload (Vidar)", "value": "c945fbc762d9b6ee5660e79f3bf453a60f8093d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212572, "uuid": "9e34aae6-ae58-4efb-9172-69c14fb5744f", "comment": "Malware payload (Vidar)", "value": "2b83a29ae230a40420684ee9b0a40be43910116b9b3997564cc36b914a92bffc9620a5b6d751f74c0129180a1174b446", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212572, "uuid": "697bfea3-fee8-4659-aca7-079e038d7b02", "value": "T164B57C0BBCA408E6C46E93358DB761923B71FC190B3263D31E51BA792E327E09E79714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212572, "uuid": "b0275aac-428a-4bbb-b3c5-24fa47cd58b2", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212572, "uuid": "b24727c7-c2b3-43ab-b71d-ee846b295cc9", "value": "24576:8cgJJ0pElWsLw+2pHPTNzA3oeIwUll/RWSjmKVehk9ZNoaVMEJYIu1UaWtPpy5JP:8cg70pElWsE+ATRW1KV7NJmEJYCaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773212572, "uuid": "cd6c041b-c043-4753-ba20-3e2674396b98", "value": 2327040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773212572, "uuid": "ea631df1-1916-4f0f-b896-cf42ab4ed6b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212572, "uuid": "288de814-883c-4b76-ab7d-188cf07a7666", "value": "a4df8b3b3b5305c3b3f5e17929fe6d88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4b6625-1d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773255597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255597, "uuid": "a7887400-d989-4ce0-97da-da035d250a90", "comment": "Malware payload (Mirai)", "value": "c71ae7e0dba33330a44eff3610cd5f0d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255597, "uuid": "99713cb9-5895-4daf-8f02-26cbff88f1cb", "comment": "Malware payload (Mirai)", "value": "bbea4558c491383f8092c74fd0cca234014f3b7d49c448534d22e113ad4776fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255597, "uuid": "86816353-c1a6-443a-af31-37475749ff8a", "comment": "Malware payload (Mirai)", "value": "cb2a91cb1911f5c7c58aa4c7d3af109fa484db51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255597, "uuid": "0efec591-dc66-48a9-941d-1bc1e45c41c3", "comment": "Malware payload (Mirai)", "value": "177f5e8b1edf230e6d390396289eaa0ea293ac7132abc0faebce418e0cda1abf5444db74fdc1200e53c38d8564df8388", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255597, "uuid": "d70fa60b-a147-499f-a8bc-dddedee3b2f0", "value": "T1B5E37B87F7064CA2C9920BF94A8B4B8C6F7321815F5BD7D33D1D26381E666CE5D0AB81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255597, "uuid": "02467eb9-a14c-4589-b8dd-7a27fea76151", "value": "3072:YeUSBYwOjst2fmwGA4eegPYqwnrrAmIG99:YZqZSJCqYqwQmIG99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773255597, "uuid": "b79339a2-1dff-44eb-b24d-3746359145b6", "value": 150924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773255597, "uuid": "e55eb22e-bff6-41ed-8df4-246b55b30ee3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255597, "uuid": "d0d0feaf-98a6-41ee-a6b3-983f2dc8c4ef", "value": "xdlol.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935abb6d-1d27-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773219123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773219123, "uuid": "c6a3fb51-0113-4770-86ea-1a4d18425299", "comment": "Malware payload (Mirai)", "value": "671a930cbd211100e1c88d600188b35a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773219123, "uuid": "c6f73786-16f5-41e7-8bcf-463d720d4770", "comment": "Malware payload (Mirai)", "value": "bd6a93a6f1b3c9337dde212fbcce087dd94a8bbf492d232ac00b7abde9f675e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773219123, "uuid": "9449ce18-974d-4978-88c2-7f73c5aba68a", "comment": "Malware payload (Mirai)", "value": "b06d5e1a3c63d13bbc533907fb7573958927802f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773219123, "uuid": "dd9722e7-d16d-4fcf-b015-07efa5cd7a42", "comment": "Malware payload (Mirai)", "value": "f726dfa77728d0ef6e06666b4b65c196dea7c91c541196bb6a52b097daade3cc92a2da61e6b5cdabeaed4e506a3862ca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773219123, "uuid": "5906459a-5add-4455-b3fa-761fb1bd30a7", "value": "T1CB046C17B5C094FDC8D6C2B48FAEF226DA32F55D2138B11F27D46E262E4DE202B6D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773219123, "uuid": "df8531cb-8dce-4111-9189-cd565fa02d3d", "value": "3072:aXmwGNXqjD82DbNXkj2p4mw6HDB9qj6L4Cs2470xxxxxxxxxxxxxxxRxMxxxxxxx:a4Ngfy4BIj6i0xxxxxxxxxxxxxxxRxMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773219123, "uuid": "edfa2d53-899c-4f90-9355-cab7fcefdca1", "value": 178248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773219123, "uuid": "694d55bc-7b8c-4fdb-8a67-6fba6a8d49fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773219123, "uuid": "779d0322-36ee-4aff-a341-1666e4e02da7", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de07861e-1d25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773218390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218390, "uuid": "0f817ad8-7a4f-49bc-9a73-da47430926ce", "comment": "Malware payload", "value": "d41e4c0f4cb742a4addd0156922dbb59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218390, "uuid": "2973d289-4c82-4956-aae6-18beb2f91ff5", "comment": "Malware payload", "value": "be55dcaac8276bf279f81cd3c82d6ca00fb29b7dea08886f55d03280c1dd30c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218390, "uuid": "f95f07c8-6eb8-457a-b66b-ec9726eb6f38", "comment": "Malware payload", "value": "98ada9b915c0773bf70c07bec38fecce7ecd6613", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218390, "uuid": "72de50d1-7206-4ade-9f1d-67cb2b696c0b", "comment": "Malware payload", "value": "5e8dabdb87e97b292a116131af31a4ee126100d3953c72fca1abdd77e2778481ca7ab424636d07fe4da408afd54e097a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218390, "uuid": "498e16bb-71ce-4983-bc3b-eaa202a2ac52", "value": "T1D89533C7B9D3C5ADCA3643345C5BC20B06351DC39A1D0F2A99A9F76ED97221393E601E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218390, "uuid": "5bbf83b4-1aed-4fb9-a342-bc95626298aa", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218390, "uuid": "65a65c63-2bca-420f-8d7b-80972f84a2ed", "value": "49152:R+2WPvA0k30FU1zwnJ945nckymKVR9QAdxfFoeR+0:7WPvW3YUwnv45nckym8AsxtoeR+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773218390, "uuid": "b8ab2ca4-4505-4a49-9bda-82f7c60f6417", "value": 1929384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773218390, "uuid": "374bba02-db68-48c9-ab0b-31e8821e67f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218390, "uuid": "920de0cd-aa4d-425e-a87e-dfd60d3f7f0e", "value": "\u66f4\u65b0\u597d\u7684\u5c0f\u9a6c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799819c0-1d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773256446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256446, "uuid": "1023f42b-5b11-48a5-a4a8-7172d3091af0", "comment": "Malware payload (Mirai)", "value": "ee7cc51dc39d2b9ea48a078d807c0449", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256446, "uuid": "13bc9112-69ca-4134-9a02-515d8cb92649", "comment": "Malware payload (Mirai)", "value": "bebf0f7bd8508919d77b7ba490c6518c5d964b14c81a1895df38beb252f8d59c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256446, "uuid": "bccc8fa8-f782-4c72-8628-affad49b251f", "comment": "Malware payload (Mirai)", "value": "e42894a5250fb4b59d79803511722589841304ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256446, "uuid": "ae7876fd-dad0-417d-8429-ab07215ecda5", "comment": "Malware payload (Mirai)", "value": "0c775ca72f76477c59319fa80d91f8d0d0981cf45e8ba8d6adb51b38ce678d7823cf8c4b2ebafdcc028a2d26e8c3b97c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256446, "uuid": "d9960007-5002-4e18-bb78-9bc45abb1a8a", "value": "T15682CF7125977E21E0B09E35C73DCB9E922F4A76E5FA73621A004731D98018EBAF874D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256446, "uuid": "343c59e9-ba56-468e-8eaf-431ebc23b78a", "value": "384:9k4/Sf0BYVZ/KyXbtHGRRGqbDHG7rxIgHhymdGUop5h4G:9l/epZ/fIzm7rhHs3Uozp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773256446, "uuid": "e95a8961-ec25-46c1-a19e-216ee709d6f9", "value": 18048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773256446, "uuid": "d055e9fb-bdb3-4d14-abbc-42924659bc3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256446, "uuid": "588792c0-5c8f-4c8c-be86-32486bedec7d", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e530be-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217089, "uuid": "13cb864b-074d-41f2-8fde-228e6cd597fd", "comment": "Malware payload", "value": "781d2b4745cf550e9ef4e7f425c5545b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217089, "uuid": "dcd9c02f-160f-4723-89a4-d7924aa3473d", "comment": "Malware payload", "value": "bf05edd1874becbc79b5852ca9511401fe4640973bc86bf50f4a9c658b6f7978", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217089, "uuid": "2c3a44e5-f357-44c4-8682-f43a664f4160", "comment": "Malware payload", "value": "3ead9cd1ab50d2be3480a36828f3f921fe192030", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217089, "uuid": "ae8278d9-273f-4c15-a714-2784e4bbb82a", "comment": "Malware payload", "value": "66bfe3b13623e93e54ea2f90cf693113af8bda1c93b453c3a62ee0daecb68debf83807367632b27f47c0c34ab650016e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217089, "uuid": "c147b128-88b0-4f66-8806-f8196b9b6696", "value": "T16CD241CD79C6B16883013433A95FF49BF13F9C816C9CC958D9D5B898A8A4B38D0B587E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217089, "uuid": "65118b09-cb4d-46f7-acda-c4ede666758b", "value": "768:rYCai0Y9UL3nmmFbrfMwFkkIplRDwqbOfihoiL:rYCOLmmFtS9/RMqaaho4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217089, "uuid": "6a3657ab-f24e-4da4-ad68-6b355c16c4bb", "value": 29130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217089, "uuid": "1419d9cb-87ee-4bfb-9d52-3adeb472a5f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217089, "uuid": "d232efe6-9c2c-48d6-bc83-ec21d3c37e8d", "value": "781d2b4745cf550e9ef4e7f425c5545b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a30c1e6-1d19-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773213068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213068, "uuid": "924d589d-8b55-408e-81c9-018a5ab8a82d", "comment": "Malware payload (Vidar)", "value": "12873325d38dbaa7591f520b63421f40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213068, "uuid": "3c096c09-83c5-494b-a40d-ba2b28894c49", "comment": "Malware payload (Vidar)", "value": "bf4e59777baeab7c668aa1c791f565fda213d1d31c71ba8cf0ee28e937fa6ab4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213068, "uuid": "d7a32224-7d03-43a2-9194-8ddd8830c18e", "comment": "Malware payload (Vidar)", "value": "9cebd5f62a9f6078cef34ce505538baa27338240", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213068, "uuid": "6ab007e4-3330-461d-9b53-d4503b60a65b", "comment": "Malware payload (Vidar)", "value": "16507b3ce6a3dae30e33ce633d0ed5f1de65eea90b27282162be8b430269dad0532867fbb20916671c2102dc0033aa18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213068, "uuid": "d71fb86b-137c-4dc5-8ad2-934ee9deaeef", "value": "T123B6077B326181B8C15E813BC1968F41D6F761B91BF3CAE7429107688A778D5BF3A720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213068, "uuid": "087673bc-ac5f-477f-9a8a-a9ce67591592", "value": "be27ca3e2433d9854a57851ddb822150", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213068, "uuid": "93b9e5d6-c2bc-435e-b1a7-ba350f31e4d3", "value": "49152:v24+J84zmrSOJ30Fz5h/cetKxvqS9TWNKDKv+yUMCUYfwieJ7ivXgGOSs0gKZwg7:vgI2AmsvwPSHgK2xj+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773213068, "uuid": "3ff42486-f734-4cd3-9061-5e3e1e52176f", "value": 10747392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773213068, "uuid": "0f5d218a-72ad-4a71-9aec-0b1f17d8b51b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213068, "uuid": "788cb6d2-9044-4f41-aeae-3ae3994ed008", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c36d6403-1ce6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773191287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191287, "uuid": "5a8e97e5-7e89-41c6-aa6f-ba5fd976470f", "comment": "Malware payload (Mirai)", "value": "73cdb9b0314b3a23d805abe33e690f33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191287, "uuid": "e72313c6-0c02-4c73-9b85-3182bdb8596a", "comment": "Malware payload (Mirai)", "value": "bfd5367b17bfd9ef62f0627526ec992abdd32bd67fc6b6ec1cf6bac534d87e66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191287, "uuid": "5a96908f-1ded-431b-afcf-53300b894237", "comment": "Malware payload (Mirai)", "value": "eb9337586cd4b00d9eeb95180a0df7e5ea68fa10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191287, "uuid": "cbea782d-834c-43f5-82d7-780ef9bd3dac", "comment": "Malware payload (Mirai)", "value": "edff296d872c13caad8d392bd11d75c4a3b94b2774690bce6fc8f3d555185096fa663229a63c5a5af94eede6f7f99ad9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191287, "uuid": "095c3194-1a62-4504-bc69-b36f02f983ab", "value": "T16DF2E160D1C5DDF2E9A96CA8A95AB7D0A3D14BE93320CEC290D7EF02271B71A750FD50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191287, "uuid": "a58455af-a65f-430a-8764-6a2e9b690f15", "value": "768:XtuamiJLv9aBlwtZlzF9XcMKQTvXT+C2I94YdEX94uVcqgw09U:XtuHy0UZlPRKP5YdEX94u+qgw09U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773191287, "uuid": "c69ae467-ff38-4f70-90f4-23bd71a4bc90", "value": 36260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773191287, "uuid": "5c12b08e-5670-407f-a6b3-6d4b07daa2bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191287, "uuid": "18144f0a-bc36-4927-afda-96ee3180d0e0", "value": "pppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68196d38-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773217762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217762, "uuid": "a943674d-0829-48aa-bfe8-1617096a0a2a", "comment": "Malware payload (XWorm)", "value": "384b9ae13397f59aec908190b4b1caf4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217762, "uuid": "c49b20ec-1fdf-47c8-a5ab-3680a3d2ba9c", "comment": "Malware payload (XWorm)", "value": "c0b74422ad8e26aeefbeb4950c14a317266c7691a6a8990df35b37c5fed2b92e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217762, "uuid": "025fee99-8020-4c14-a8e3-7678efd704d6", "comment": "Malware payload (XWorm)", "value": "6b5c06aefe5b83fb75d23baf4ff8c09b2baac35e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217762, "uuid": "23a9657b-0ac6-4ece-8db1-cfc8fcb9ac5c", "comment": "Malware payload (XWorm)", "value": "a0c237eb0de9d31879fab20761fa6ac539f6ff66fca2f24a53bbacefc6edc639f4fddb1453edc9208869adf5c220ea71", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217762, "uuid": "8a6050ef-d2b3-42aa-95fe-664e47ee79de", "value": "T13D95BFB2DF827B58C7417059E4BCB05A3BF42795CD6754ACB7B7A10AAAFF414E302098", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217762, "uuid": "14302189-9a90-4679-96f8-3b6c8621c5d1", "value": "24576:r/JhPy5rG0dB0+NChWMe4qoldikyQBWg1Y7o4Skrj6vGvVCyBRZAqT0vq3pdNsXa:rtQx7gPVr4OjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217762, "uuid": "d39da956-f04a-49d1-bb36-4aeff606e9b4", "value": 1921087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217762, "uuid": "8dd65448-5f03-4e6b-976c-2a16872d69ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217762, "uuid": "85233c3f-7446-4292-bdf7-04932d72da8b", "value": "384b9ae13397f59aec908190b4b1caf4.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e8a754-1d6e-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249776, "uuid": "5c7001ba-6582-440e-8533-6cf169f988dd", "comment": "Malware payload (WannaCry)", "value": "71f288cb3120fdbf96dffc5ad08492df", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249776, "uuid": "8c7e3d63-6159-49c5-98ad-42749313ae77", "comment": "Malware payload (WannaCry)", "value": "c0e0a9df8bc507bf5ac6808299134d4c9c16180a57df9cfc5a4c9794ed7ee3b4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249776, "uuid": "6a0bf902-0aa1-483a-a680-bbd2c0db16bd", "comment": "Malware payload (WannaCry)", "value": "50ce3a668fdf3aca53e2fa70d3450e509d2bc116", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249776, "uuid": "84b43660-9031-4428-aa38-7c767df65402", "comment": "Malware payload (WannaCry)", "value": "2b2f507362f23f0fbed31ce935424a2c68d489b1f5701f04ae585d794ae4da648501da7cc9e447b12a40becd3f9b2980", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249776, "uuid": "645277ea-ca42-459b-ad26-48b52f89c3d8", "value": "T175361214A6E82B64E6F21FF621778710577A3E45896B925E1760A04F0C33F5CDEE2F28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249776, "uuid": "aa7b8af7-212b-4683-924b-a8fc778c1bc0", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249776, "uuid": "0d65f5b1-a0a0-43fe-bd9b-9aedb364464e", "value": "98304:dDqPoBhz1aRxcSUDk36SAoxWa9P593R8yAVp2H:dDqPe1Cxcxk3ZAbadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249776, "uuid": "c588a9f6-984c-4101-a0ff-4aef5ba93554", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249776, "uuid": "fe461a32-2e90-41d0-92d7-6fb56b816752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249776, "uuid": "92e13466-f9c3-48ab-91de-f887ca930555", "value": "c0e0a9df8bc507bf5ac6808299134d4c9c16180a57df9cfc5a4c9794ed7ee3b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd3b9c94-1d23-11f1-a769-42010a9c0008", "comment": "Malware payload (MassLogger)", "timestamp": 1773217476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217476, "uuid": "260935a7-65e6-4026-a9aa-9ec2ca97bec3", "comment": "Malware payload (MassLogger)", "value": "42533b4298cbb8961f90da22d23d3454", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217476, "uuid": "3a3c5731-293a-44b0-a843-e819517c4d2b", "comment": "Malware payload (MassLogger)", "value": "c1e6366eb5b84812b16c75b35416d6e9d376c0c8d65ceacd4bd28a2461c32264", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217476, "uuid": "cc884d3d-4b7d-45e0-8efc-0a712dccb6f7", "comment": "Malware payload (MassLogger)", "value": "775fad824c97973699c6498f0185bdcafc74ae22", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217476, "uuid": "d820bd9f-4c96-4529-9dbc-cbd1899345d5", "comment": "Malware payload (MassLogger)", "value": "0b5462e90d1a3c27d4e3aab62036fe2d8322d63fce79627bc31fa8d98803227487931fbc0abd732ab316510696adf34e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217476, "uuid": "9a340693-8923-46cc-9e76-ab890ca91e5c", "value": "T150658D48CE883FEEB68D4A16137F1EC9F3F14FAE5B9272857B52C9462632940578CD81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217476, "uuid": "5082fcdf-5cc3-455c-ab2a-aad08b357df7", "value": "24576:AD6eijsLCw5cPSI8LwMnmXqOJW8d1CB6PwXpHRGNh:oe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217476, "uuid": "f1b94110-d491-4af5-9002-8274bf1b7c8a", "value": 1534731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217476, "uuid": "1f980884-ef77-4973-adb8-f314533683ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217476, "uuid": "a99f2b2a-c058-40f8-a818-a717ed330c64", "value": "42533b4298cbb8961f90da22d23d3454.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59670bb4-1d61-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773243937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243937, "uuid": "8276cf11-e1d3-4b91-bcf1-84961e55b36a", "comment": "Malware payload", "value": "1d02de3fe05e73e5e19abeae26ded004", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243937, "uuid": "35f9e17f-bb87-44e5-a4fb-76d0e7c92d3f", "comment": "Malware payload", "value": "c2aa2243e658fd79de9edfe878ad564709a64601bb59cb2e7b78f32ace44d4a0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243937, "uuid": "f30d5cf4-198c-49a9-9943-7ccdf25f0e12", "comment": "Malware payload", "value": "7001b0f0ddf7dddb6365cf813eee538bfe6d977c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243937, "uuid": "6b001004-04c7-4206-8894-f83ee276f108", "comment": "Malware payload", "value": "673b2c50a7743e67ab919eb433555052e309216ffa070a0ee31d4f1569f710e6dffe785877bac27d5281825dadc49991", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243937, "uuid": "cede6d47-7e74-4888-968a-0e5807168c3f", "value": "T1BE91B5B9C4A29A658B0F1EECB73402AD4155C344A366BE601B5F8D27DFC0278CD7E162", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243937, "uuid": "b8f99b54-5043-4498-b1ee-f079eccd11f1", "value": "96:OeatbDcdJhWgYBpK6Qy+nlhpM7ISS/ibew3f2e7HJCPC414Zn:OeatXOJcgopKJlkU5g3+e7gV4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243937, "uuid": "113263cd-ed04-46b4-8585-ccd14aabfca2", "value": 4505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243937, "uuid": "39635a1a-fe0a-4d05-ad2d-b711754aef69", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243937, "uuid": "bee44dd7-27a4-4844-8c59-e90fe00e7b39", "value": "1d02de3fe05e73e5e19abeae26ded004.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e171649-1d56-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773239328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773239328, "uuid": "20ad8384-bbd4-45cd-ab9c-9705a3196dee", "comment": "Malware payload (ACRStealer)", "value": "7a0b0438b0218a09946bccfd9e3a50db", "object_relation": "md5", "Tag": [ { "name": "141-98-234-8", "colour": "#7F1625", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773239328, "uuid": "9d970b00-d388-416b-9291-1d8278e0f35a", "comment": "Malware payload (ACRStealer)", "value": "c3f2712e88d71df34b828c75259c0564df07995ddad4fad60098a0c9388da6fd", "object_relation": "sha256", "Tag": [ { "name": "141-98-234-8", "colour": "#7F1625", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773239328, "uuid": "99557eea-25a2-4be8-a722-e072cfc92636", "comment": "Malware payload (ACRStealer)", "value": "0725bc8185c4b85b521ebb5d8ab5647a21dac9fa", "object_relation": "sha1", "Tag": [ { "name": "141-98-234-8", "colour": "#7F1625", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773239328, "uuid": "d4331548-a4fb-4225-9c04-c943041236ce", "comment": "Malware payload (ACRStealer)", "value": "0c31bb98fd787e4dcf03ebdf2bb9e8b9320667fd3f88b62f7c34631162466543052c1d91791ca01392bc5b50f99cfd3d", "object_relation": "sha3-384", "Tag": [ { "name": "141-98-234-8", "colour": "#7F1625", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773239328, "uuid": "048dc364-d627-4e16-8b2f-e7f85842b6fc", "value": "T15D969E20B2E58929E9FE00B1907755736BBDAD047721C5D7A040BDDC1CB22E29AF63B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773239328, "uuid": "bbb0e041-df85-40a5-ba35-e7a0f901236a", "value": "bf3ffd977d02b78c1688e06aef113cc6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773239328, "uuid": "90ad0d45-8bd4-4778-8971-061d9522e489", "value": "98304:ugMaHwnTAQsSbh0+fSJcUEri5HdjL0V0HZMaJV9zUABiJOytPH5L+:ChTAQJCnyam+qHF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773239328, "uuid": "61cbcfe1-66be-4266-ab78-8c9658742aa9", "value": 9308160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773239328, "uuid": "8590177a-f628-4f92-bc16-93bcdfdeb8d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773239328, "uuid": "6b8352f9-abe2-4382-92f2-711b7e3d2ed2", "value": "python315.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c20f60-1d76-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773253108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773253108, "uuid": "b1511e87-cc53-449b-891e-dac9ef13c13a", "comment": "Malware payload", "value": "b7f191b9e68032ac116c430e2863ae0d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773253108, "uuid": "c96da4a9-0d91-46fa-a26d-cef5e2b5fa4c", "comment": "Malware payload", "value": "c5c0e490ed9730b15902b887d0d16b2dd8138f4bfb31b32ee27c35c1137ea850", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773253108, "uuid": "61de2aad-329b-49e6-a878-aa47d94e59ca", "comment": "Malware payload", "value": "e97bcbfeb7a74ab9c8cae95c6ee6830ece84c943", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773253108, "uuid": "4364a25a-3041-453a-82e2-cd18c99a86be", "comment": "Malware payload", "value": "b56553651b04813baf88c6f0b7e86dc6a38a070cb70475177a2941acae3ee52f93314f2ba72dec924618b9b137d35a39", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773253108, "uuid": "00dab3a8-d3cc-4ec0-a25c-620cf27e53ae", "value": "T1DBE48C1DE7A491FDC1BBD075CD13452BE7B2B85B4732669B03E14A492F2B6A0AE3D700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773253108, "uuid": "fd486548-72bf-4827-98dc-e3d3d95f790f", "value": "5d6824afbb659d9efb6f257c566d0d4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773253108, "uuid": "a0fc2452-1bad-4d69-992f-3baae5febe1f", "value": "12288:B0mfrontOU0uykGx6fy3iqpu2Uayp65TcxL5Ha:umDoAUPyyfySQd5Tr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773253108, "uuid": "a78715df-444b-4e4c-99f7-4721715de7d1", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773253108, "uuid": "e69a017f-12f4-4f4c-a916-dd392c528aad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773253108, "uuid": "d184ece1-915d-4e53-879e-ecd26a7ca38c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98bcc7ce-1d20-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773216126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216126, "uuid": "4c2e39c4-dd95-4341-bffc-324eb06485ed", "comment": "Malware payload", "value": "95e890baaae238f1f516bc85d1a5d67b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216126, "uuid": "42acff0b-c55c-48e1-b4b0-fdf501187bd5", "comment": "Malware payload", "value": "c62a9df821108cbea00280c292a7787350715f1252d4e0a3371f039783145486", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216126, "uuid": "d2c6e18d-4767-48df-9dc0-c8ec66f724fa", "comment": "Malware payload", "value": "1266393151bffb9cb722b4eaa3c8ce20fdab5932", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216126, "uuid": "958d1f9e-9286-4994-ba0a-a401f2c91646", "comment": "Malware payload", "value": "5e549b0258167e83748d741f6f39ce448e895ba9b8961915e68e66665aa4a7bae0dc9216770243aeac3b78ba86c47417", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216126, "uuid": "2b7911f1-ce43-496d-a07a-ccc396e18ac7", "value": "T1CA31A0111BF20364EAFB8F396CBA63215671B906DF61DF9F129081A85574620E878F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216126, "uuid": "49fb3859-d7d8-41c2-a93a-284371e84dc9", "value": "24:8VnVdmGjMDvSwjKUaWU3AcPWkp+/CWql9CeUMkWx343RnAH4I0WK6c/6Cab7Oa7m:85nmeKpUQCl8eHJ3enIA6q6Cax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216126, "uuid": "77803a67-b3d1-4596-98d2-c315d6fb0c54", "value": 1549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216126, "uuid": "abc38049-ca87-4cb4-9ad8-c5f22f871f9f", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216126, "uuid": "a259105b-488e-4040-9b77-78adef4f394a", "value": "IMG-456377701.png.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "328455cc-1d3d-11f1-a769-42010a9c0008", "comment": "Malware payload (DarkCloud)", "timestamp": 1773228410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773228410, "uuid": "494a479a-cf8d-4141-aa56-0fec4dfa4b8e", "comment": "Malware payload (DarkCloud)", "value": "3683f7ba6e9939168e60e37e73a59bcc", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773228410, "uuid": "3151c1af-51c3-4fe3-bed4-52f979046750", "comment": "Malware payload (DarkCloud)", "value": "c63d675d88282db91149a1057b122a11a1bae3f17361941005aca4e14307f9b7", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773228410, "uuid": "12a84ce8-e1be-422f-a628-9c747dcfef3a", "comment": "Malware payload (DarkCloud)", "value": "b7ca8625a4afc27e87a59880009db694be6ae9e5", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773228410, "uuid": "12cb3d2b-1005-4657-93fc-b812a804ae0d", "comment": "Malware payload (DarkCloud)", "value": "b50dcdeee53bc6fa027cfa66109299e6acfff3d96efdab5376a4143a790671085b3d94e01e483efaad1245946a252bd0", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773228410, "uuid": "1d7c2e1d-628c-4243-8f0c-621e19adcfb1", "value": "T19E651218175AEE46D4EA5AB04870D37827F99D898421D303CFFAFDEBB97D64A3840291", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773228410, "uuid": "ef48536e-984f-4453-8a07-69084f0d906b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773228410, "uuid": "1255560a-4f04-49cd-81cf-01b2e53f6f49", "value": "24576:3EciazRQ97xRdXVsp6Sd5Ky7occkOqofdQzwKS6PlH1jL3jFIg5o:UcM93dXind5P+kbwFMxR3jFIgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773228410, "uuid": "56265b79-ab10-4999-b9a3-ed00d96c86ec", "value": 1436672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773228410, "uuid": "f31d896b-214f-4734-8d90-87c60a94a476", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773228410, "uuid": "8048ea07-6e75-4d13-88cf-0da1e3a05bff", "value": "AWB#5305323204643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9bc685e-1d6e-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249789, "uuid": "f18564e0-c5aa-44b1-aa2e-0b53992b0768", "comment": "Malware payload (WannaCry)", "value": "34cbb454635438aafa1c32117aa449e9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249789, "uuid": "4dd2ab36-6b19-4804-860a-dd866cafb84f", "comment": "Malware payload (WannaCry)", "value": "c691262ed27e50d98f0ed4224365cbb38115392765b7232f430f60de1b5c575c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249789, "uuid": "b0667be5-23d7-44ab-8046-549ae24715e9", "comment": "Malware payload (WannaCry)", "value": "1aa13689be3fa137b0ef8be3534a21f984d7de69", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249789, "uuid": "c95e450a-b9cf-48d8-ac5c-1a5a71e662f3", "comment": "Malware payload (WannaCry)", "value": "ce21a598ce0e8f1cc02d0b3e127db69f1a48c83340f6b765b7084217b7256301d3c42272a2a8e93f801bab53536ad831", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249789, "uuid": "8ec0a3b6-20e2-417d-8bd7-0a6b1238e443", "value": "T1E936230A3168D1B8C0052575CC67CAFEA2B27C59EEB9690B7BC07F5F3D33755AA50A02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249789, "uuid": "0bee7417-036f-4479-8baa-74a3e051179f", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249789, "uuid": "1c69c943-b9ed-4cc1-9836-b9a0a3a1f596", "value": "49152:RnaQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAR:1lqPoBhz1aRxcSUDk36SAE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249789, "uuid": "2430e00a-60f8-4c51-9bbe-6ba63d014333", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249789, "uuid": "07548e4e-f5f5-48c8-a471-170108547667", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249789, "uuid": "0351dea1-9095-46fe-97a0-d81e522e14ac", "value": "c691262ed27e50d98f0ed4224365cbb38115392765b7232f430f60de1b5c575c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bb1edf-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217832, "uuid": "86ee515c-8e74-40f2-920c-5ba5559343b6", "comment": "Malware payload (Mirai)", "value": "dccb99bf3ae5a16647cbda7531caa32f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217832, "uuid": "4a93fb3f-faaa-4aef-881c-adb37f80ca09", "comment": "Malware payload (Mirai)", "value": "c6a4bebad227b86e836ae56f68ce7072293c4153f44429999d208eaa00f74a4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217832, "uuid": "04516e7e-f592-4a9f-811b-391d0620f75a", "comment": "Malware payload (Mirai)", "value": "5369539a98c207ffb2be24d3049f0b5e51622f0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217832, "uuid": "62a04cc5-5cff-443a-89bb-13c24f17762b", "comment": "Malware payload (Mirai)", "value": "3d540445c0a5b83d804a66076723b22ae0d746820f208214c397f6f8440e456adc9fd1bb5e0819bf4d9b77c0e8ae258f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217832, "uuid": "1f15a151-33cb-4d09-8305-54552759b9b3", "value": "T158867C85FC1D7862D6C979342FA25298723DBC098F41C3272614B77DEAF63688F63660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217832, "uuid": "74e5e5f5-2e89-4c1d-8807-e802051db0f9", "value": "49152:xvbNHmtmhCJB/DUPhpaGzXzcE9/60kVtQQhs09k8C0bLLuCO8HJd5EY:xTNHmtBvDUPhpaGzXQE9S1VtptiwEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217832, "uuid": "69a0751c-678b-4f1b-bbc8-7a6cca056988", "value": 7995540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217832, "uuid": "14333d9c-fd45-4c0f-8432-b9064a511c85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217832, "uuid": "0040cfb1-c563-4820-8d81-39fcbc6e5433", "value": "ip6addrd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7bf302-1d45-11f1-a769-42010a9c0008", "comment": "Malware payload (FleetDeck)", "timestamp": 1773232055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773232055, "uuid": "cb43630c-3acc-419e-bf50-2caafd1fe097", "comment": "Malware payload (FleetDeck)", "value": "acd7752ac5dad10973b0e42aedd8f1b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773232055, "uuid": "87ad71d3-1d95-4829-95db-cf85d4a451fe", "comment": "Malware payload (FleetDeck)", "value": "c6e86a71235ed080566858735638e61e2f607ea5a7a5bce6ce6442aeb6ee2259", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773232055, "uuid": "b31c73da-e4bb-401b-8e7d-bf73126b9384", "comment": "Malware payload (FleetDeck)", "value": "f6bbb79b659b395f3a2a6c7d4eb29055786c9374", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773232055, "uuid": "8642a651-64e5-4b5c-83bf-65294d298707", "comment": "Malware payload (FleetDeck)", "value": "43773adcdedef818023301cc342e63010737d8add8b7e241a78a788aaf7f63d05fe45e5c3687935a2d21fcf5e824a74d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773232055, "uuid": "8263dfd6-6807-460e-80d6-916a0e0fb70b", "value": "T1C816CE50FCDB14B5E603193158AB62BF2735AD094F35CAC7D6407BAEEC73AE10936229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773232055, "uuid": "034fbdc8-e886-4752-81ef-637b6b39fe33", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773232055, "uuid": "0e5ec578-1059-4e18-bba9-cf99194d5972", "value": "49152:7P0dfmVfyr+CU8D1cuwaH6ylh1XzKxGD2sC/d3aUVJiuX7c+PzbMDpIJLKo7snUa:7PtZAl3XzKnaIcDgRjOlV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773232055, "uuid": "e995a0f7-87ff-4492-adc9-0b1a4aa4b52a", "value": 4398512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773232055, "uuid": "646c0aa4-c080-4a3e-a9a3-b637340cc6b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773232055, "uuid": "64a62ebc-deb1-4d59-be30-6db23b836760", "value": "acd7752ac5dad10973b0e42aedd8f1b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d48794-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217819, "uuid": "c29a528d-c1ad-4e04-b140-e8ea72ff319f", "comment": "Malware payload", "value": "045eea9162a773a8766e798d61cc51a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217819, "uuid": "fd37dec4-b7cc-4223-b4af-bf1bc7f86228", "comment": "Malware payload", "value": "c6fa82515a4ffe45a7965d88b70e3975ec5aaee467177f4d3bba99da7df76f81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217819, "uuid": "ee57df4e-6e4d-49db-9d21-40a7e56f92d7", "comment": "Malware payload", "value": "8b33683d717f62e65e39070a0a207d9121b56a2a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217819, "uuid": "1ab72dd7-8d16-4f79-9558-9ce6229be893", "comment": "Malware payload", "value": "4525b245b6084f7cbf5fddd9e1636a3b46b6b988792357cb52bff562065808926315b1768fd30b2e2b7473e463e719bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217819, "uuid": "53f21dc6-dea5-4626-ab1d-72896ee829c8", "value": "T182865A07EC9516E9C4ADD6308966D252BAB17C495B3023D33FA0F7293F72BD06A7A350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217819, "uuid": "9b33d5e4-0ca9-4188-86fb-5eff206abcf2", "value": "49152:XRET7S+5xBkN9A9/8Pkcqur4hMT9xHW2L+vU5kblXy2g+dp8/EiJ1QQM3eNEFMrp:X6TdOrVB5lL+Wqlxn+a39tZXLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217819, "uuid": "b8b67dd4-d393-4e08-b5f1-e5785fdd56d2", "value": 8397152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217819, "uuid": "9381787f-58f1-40ce-8021-1e232a2460b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217819, "uuid": "b5f62a77-e859-461f-b4f1-37d61ae7e10b", "value": "ethd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f91abe9-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249880, "uuid": "06f06b42-bfd2-4055-8a8c-b9b7795abf8b", "comment": "Malware payload (WannaCry)", "value": "1650636d5f3c7b17645501495ca899f5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249880, "uuid": "29c598c8-d173-4354-b7ad-441c056cffa2", "comment": "Malware payload (WannaCry)", "value": "c75adf0e9e021ba0f7a6c72e17dff4307e4161c07f07c326a0f3de612a5400a5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249880, "uuid": "91b59e3f-deea-4296-9456-d6095bf16534", "comment": "Malware payload (WannaCry)", "value": "9d81fe5aec00432cb1f3b029d885fe78af590a84", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249880, "uuid": "9ae8d8d2-b8a8-4c48-92e2-dc36eb023ed7", "comment": "Malware payload (WannaCry)", "value": "ed3bb5f61d7ca638c7575b3873c5177c21010a8eea2920fb2d88d5b348c05f92ec1581c4e94fa6a881c5d4d63794cfcd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249880, "uuid": "26f3074d-53ca-465d-8331-8f6cf2f6a54b", "value": "T14036E0976F0414B6C6972DB19F76C706A7B5D8DE4EEB57032B6CC21E0C86940AC7BE02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249880, "uuid": "f14166d3-6095-4e1d-8a57-163e6789b2a1", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249880, "uuid": "abc2e167-918d-4e4b-b6df-1182cda78072", "value": "49152:JnjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnvW6hhlAH:d8qPoBhz1aRxcSUDk36SAEdhvW22H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249880, "uuid": "a01d582d-3474-4cb9-bb5a-0a69f8abd2a9", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249880, "uuid": "c6cdf3d4-47fc-46c6-9e69-7e2de1db0ef1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249880, "uuid": "9f9ced35-63fe-4795-8281-0cdd06ba5c63", "value": "c75adf0e9e021ba0f7a6c72e17dff4307e4161c07f07c326a0f3de612a5400a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2173c0fa-1d54-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1773238260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238260, "uuid": "5f2d2cff-ec90-45b8-a7ee-c44be20a52df", "comment": "Malware payload (CoinMiner)", "value": "69315b7a1c4bf5ee56cba1de29d1761e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238260, "uuid": "4b33204a-320f-4b6e-9ade-6b3c33c34d23", "comment": "Malware payload (CoinMiner)", "value": "c7b93b6facfc23f49e35e81dc9c30cc69401b8245eeb7c032fc13656cd7e101f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238260, "uuid": "6cd3dde0-2218-42fb-8ae4-9ee971a0d91e", "comment": "Malware payload (CoinMiner)", "value": "0d2bb0876cc58d8b9c91686c019c131584f1b970", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238260, "uuid": "fb7868f7-5f94-4210-81fc-8ee3f645b7c3", "comment": "Malware payload (CoinMiner)", "value": "ae6a6e967e1f5fe4d56c5d955745647809f2397964b197884da74c250b8a1f05bad9927d4d6d446ba1237e49f9d4f4c2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773238260, "uuid": "e98728e3-2dd9-42cf-92c6-6c09b22ed47c", "value": "T1F156CE27AD455453E41DC4BAE396562553B0EF3F2581CAE62040B7B178E23E0FAADFC8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773238260, "uuid": "0c609ec2-9b2a-4f12-8276-62bb2b2e4b9b", "value": "6834e58c8df7ae9d4ea75458e147efc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773238260, "uuid": "f0a8b06d-b045-4ad4-99c4-008ea244b3aa", "value": "98304:7QiFytO1s/YLceSxJAyJh3ETWvR/2uWujfoTcBqNUK:7zFytO1s/ihSxJAyJh3E5uBO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773238260, "uuid": "9ec0123e-4af8-4f39-b947-e1521aff675a", "value": 6264832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773238260, "uuid": "9d3b0751-523b-422c-b463-7bd604483064", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773238260, "uuid": "2e841d7b-b388-4702-a72d-d1af5205f521", "value": "e330f1633a2798f49675bad30f6fecf4d4126cc57286c92b2ddae737ec97718c_svchost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83fb1f30-1cfa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773199770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199770, "uuid": "8e5a19eb-3bbf-4b0f-a449-a6c5e785a4a0", "comment": "Malware payload", "value": "e14a492f1a203cabd81dec39cc3187ff", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199770, "uuid": "4a6c0f36-017e-4633-8848-258a8a1343aa", "comment": "Malware payload", "value": "c7e755b42cb6a24b928fb49c52b9c74d146d588fe406afaaa7f44c13c4b9f418", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199770, "uuid": "fc473705-9df5-4663-8c9d-afedfcf642b4", "comment": "Malware payload", "value": "c5195779f2ce06c136dfef7889331fe8eba12ccf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199770, "uuid": "8b24e6b7-5f07-432e-b366-4f15fb5c47a5", "comment": "Malware payload", "value": "e41c46649b80d031b615a018a85cbfc3e99fe070e234bc36a4a5c786c35d5c2a2758fa5eb00412221def411832872a29", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773199770, "uuid": "928d6217-3b70-42ef-96e4-7c2c5be659e4", "value": "T1C621A7E560F267F2578EE8000A415AC5C30965125DDB18DCB060FE7E7AFAC68F8E4E67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773199770, "uuid": "415b2add-ab1a-4488-8e73-ba9847ecae83", "value": "24:5rwD3NHG5uS72txSMKbGFQ9iGyuOGWQisLQDl0MFqSBvLrvOPp4/aQ:5rwDdHGgS72fSMKbGq9inuOUbQDqOqS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773199770, "uuid": "bc0050ce-43a1-42ef-bf0f-a1bf53fa0e3a", "value": 1163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773199770, "uuid": "016d5a3b-a5fa-495a-8985-84e8779c1b73", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773199770, "uuid": "a0043778-7e7f-4a76-b7cf-2b1a5c22dca0", "value": "x", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f11d95-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217705, "uuid": "2f43bde4-13e9-47ed-9b22-5f6fdfe74aa7", "comment": "Malware payload (Mirai)", "value": "c7d5edea088796736d44da9a6da5bc08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217705, "uuid": "f714a9a6-e657-4f98-acc7-7d61335f79f5", "comment": "Malware payload (Mirai)", "value": "c8700401beaa57f15edb232f767eb20788721da2a0f58d5403662fa99cc7d4a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217705, "uuid": "bebb28a8-63ff-4a93-a11e-750b4f878077", "comment": "Malware payload (Mirai)", "value": "9ffc8836feb214662a9840f42222f15f7f350cab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217705, "uuid": "726c0c4d-727f-456c-af3a-0447f550acec", "comment": "Malware payload (Mirai)", "value": "f467f7534b1aab83edef61e9c20366e46a24a9ff5a824e1dae35a9f5e553f7336ac310f48bf1434c275b7b055621b519", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217705, "uuid": "5517c7a5-f8d6-4f83-8591-a753b74164b7", "value": "T1389608C1E891D28AC63D6D31EFD9EFE8E26B2E315D88594AD9C8F33E58B314480F5560", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217705, "uuid": "b52d276e-a05e-43da-8670-b59237981739", "value": "98304:DhC6Ww0AqWJITfzqYMKI6Z29dqHmx9GoSRgjEn:8Z2HUZRrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217705, "uuid": "b7df9ac2-9a89-472c-b73c-9b27d75c8d3c", "value": 8781972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217705, "uuid": "047c7529-7948-47f1-9258-464e7805a974", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217705, "uuid": "bb3f8fc2-3a3b-4782-887e-5f9d5f4259ba", "value": "vredisd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07c6629a-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249813, "uuid": "c50b6f94-639f-49da-aad3-ca4c76eb0489", "comment": "Malware payload (WannaCry)", "value": "3350010d85599ee4890b794f2311d93c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249813, "uuid": "c792cdab-49c3-4725-81e2-146256429178", "comment": "Malware payload (WannaCry)", "value": "c879c086f40e43216b90e3b23dd909de7095958f0b8010454060f6d3f0d0b8fb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249813, "uuid": "4a69adc4-a036-4bec-93df-024226cb660c", "comment": "Malware payload (WannaCry)", "value": "72218e34eeac7511e24d0895095214013f5f5583", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249813, "uuid": "33d5e75e-7bfe-4376-88c2-7a4d2538ec92", "comment": "Malware payload (WannaCry)", "value": "8989f6c05721a1c91cf778d2394cb3bb9b7693491e80604e1e981f118deb79f851564430f3013c38fbd344159973f1a6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249813, "uuid": "9ad08fdd-0c05-424f-9c99-ba6b3a3600e3", "value": "T10E363360A72CA1BCF0950AB44063453DB7B73C69A7BB8B1FC7C087560D53B92EAE4B45", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249813, "uuid": "3d4195bb-e20b-4440-be28-3243e0e66674", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249813, "uuid": "5b1030ff-7271-4635-a7fb-a3164222522b", "value": "98304:+DqPoBzk36SAEdhvxWa9P593R8yAVp2H:+DqP6k3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249813, "uuid": "e59fff5f-7a06-4bcb-b0a0-7b5f818b4515", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249813, "uuid": "1f87caba-4208-402a-89f0-561e01b38ec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249813, "uuid": "93d61074-7a26-4242-b571-71712e3598f9", "value": "c879c086f40e43216b90e3b23dd909de7095958f0b8010454060f6d3f0d0b8fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2d5c29-1d4a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773234041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773234041, "uuid": "25607e0b-0993-4a96-b757-75176d1f0849", "comment": "Malware payload", "value": "7b1eb362f4718559c2189ddab031ac12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773234041, "uuid": "901a50a7-6964-43d0-9334-a63bf0a787c7", "comment": "Malware payload", "value": "c8c0c26750bed2a75671e19bdb101afd785880584b73bd2140bcd88df5dbf75c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773234041, "uuid": "592ece8a-eaf0-490f-9300-478f7d21c96d", "comment": "Malware payload", "value": "f2653e95b629c9e10c8aad228dd20499fd444530", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773234041, "uuid": "670dd259-42cb-4813-9b22-1742f5a41168", "comment": "Malware payload", "value": "843cdd60ae76b696bc383a19ce8c1610bc5fe631f1db72efb0515c8fda6da7c70a27a759d68921f9c38f7b7372000491", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773234041, "uuid": "856a7be5-4702-4f7f-8260-e8a487f7fcc1", "value": "T1BB35D6E07702748A9E226406C0827215BE7B9E853B99CC6CD59F76DBB50521B23FBC3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773234041, "uuid": "d92e9686-4c36-4def-b06e-ff9903481484", "value": "768:4mrOpb+7CeH19V31VeKF05yea5AS1keYfBB/MpME8kBdSh25K5nU1qMsQx6MHB2M:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773234041, "uuid": "8cf267ae-4ef9-48e1-ad5d-827fc09f7496", "value": 1148251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773234041, "uuid": "0fbb829c-a72b-4456-a3b4-a37898ae3af4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773234041, "uuid": "cc64dfed-ea94-472c-9470-4d217e60aa89", "value": "OrderList.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a9f185-1d61-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773243902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243902, "uuid": "0f26faf2-0114-4819-9063-6b66415f452b", "comment": "Malware payload (AgentTesla)", "value": "795aac0994f84c5505923b6db1d9eb8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243902, "uuid": "ce818e4a-2f05-437a-8264-d266bbb129aa", "comment": "Malware payload (AgentTesla)", "value": "c8fbd186e0f1e426e1c9b1082e93a00054e9298010b7dc777a9b82c3c122542b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243902, "uuid": "27222ec9-cd70-4a03-92f9-e8274d03f0ec", "comment": "Malware payload (AgentTesla)", "value": "d77b8632216e7f120f911129f3da120db51225c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243902, "uuid": "cae3ec2c-a9c4-453f-b8c6-d5db32e23f97", "comment": "Malware payload (AgentTesla)", "value": "5e0b754e69e256e0ded3502b016726275919615c6d88a8c4ea9d07b3193def28cc3e16af06e8f8d614a6b72cd529d7c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243902, "uuid": "a47a6320-9fdb-4ac0-bb62-27e25ce5892c", "value": "T13B55AFDD39A30FB60BE574424812B6943BB240E6879743B847B7FDA4C8E3A9C7046F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243902, "uuid": "2d67927f-604c-4b0a-af73-10cf91d708f9", "value": "12288:ggT4JGa9L5OWKhZBlM0TP5s93Q1ibNFeyJDi8FcldBCv4ph5rBea4neiHKsq+rZ/:7vapkfL8Yklq+x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243902, "uuid": "290dd43c-1467-4c86-be90-6b12cd4a6642", "value": 1339712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243902, "uuid": "dcb6ec67-8855-4673-b54c-45ad5bcf5418", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243902, "uuid": "6b536cf8-41f3-4db3-8707-417284db31c2", "value": "BONIFICO.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb40ef3-1ce6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773191198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191198, "uuid": "d41b6a42-0ee5-4bc7-a930-1f9af1ed810f", "comment": "Malware payload (Mirai)", "value": "c37990b3e78a8e8cc52105de5458619a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191198, "uuid": "06f0749f-6ae1-4475-a9e0-af1f693e89cd", "comment": "Malware payload (Mirai)", "value": "c8fd4bfc20af78f548302c064270bd845617516981a9e992604f0bee83643f61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191198, "uuid": "056858a0-7131-43f1-8408-c486fdc7091a", "comment": "Malware payload (Mirai)", "value": "2ce0b781dbf3fd0d0ac8be7cf40296b11c47a369", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191198, "uuid": "f8385da3-69da-4624-9f7c-89bcf829d732", "comment": "Malware payload (Mirai)", "value": "bd077f3f9491f931e0c21131da7864d17790ca9ccf391c0b396035fcfea5398523e8018931a6398908e81d4662321903", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191198, "uuid": "e06dfa34-d3cd-48d7-9259-15c9dcb4c058", "value": "T12703F10D83147ED5C32884BA15BD03922D724FF66E8BAC9AE169AFD35D514A074CECF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191198, "uuid": "635c6712-a559-462c-a9b0-46f845c1a1a3", "value": "768:Qgi231FZvxdHNiA+Vlw3JhK+AygVbSMTukpeP78iGzybDJgGlzDpbuR1Jr:QKhx9+SJs+rKOH7pGmb5VJu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773191198, "uuid": "d1cd7420-e6e9-45f3-b18c-306cc67713a9", "value": 38948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773191198, "uuid": "62e5b7f6-9a14-4aaf-a08f-6389f2ca27e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191198, "uuid": "62db7f8a-ccf4-4de4-b151-c91339c0ef6c", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4684f8b-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773217971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217971, "uuid": "7a67f265-aff6-49c4-964b-3e38ff351b93", "comment": "Malware payload (PhantomStealer)", "value": "29be747712b138cf833736c465c94868", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217971, "uuid": "11cc89cf-422f-4d8c-9289-d6ada25f1fbb", "comment": "Malware payload (PhantomStealer)", "value": "c93d235a2d052577f5cacc69669d3ad18bf201763d3a610790ee1083ae5941c8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217971, "uuid": "92f1de1e-92a6-46b0-86b5-19d08db1c9b5", "comment": "Malware payload (PhantomStealer)", "value": "66172382094c938b99c3f64659d475df34f96cb3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217971, "uuid": "d9010c0c-acb0-4c99-9c30-03d8dc4d7c2c", "comment": "Malware payload (PhantomStealer)", "value": "fcbc0e51fb846588a78fcd8b311ee2efef890cabac2ac9375a4d534e89f35151038184d52c4198fa2f084eb3d8cb7e12", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217971, "uuid": "755f4a1f-2811-4aeb-8ed0-80e49e0bd9e1", "value": "T118B2664C3EC6BDE4139234276937B16F993ECD483ACC9298C9566064FC68F28D77A894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217971, "uuid": "06da38fd-8330-4306-a729-fcf31484bc2d", "value": "384:BkeQIWeiEslfREx1svao1WIeUA2bYuhcPM1/lHd4KkbJ7It9NFDl:BtQIDiEsl6x1svaoLdA2RDWK4189Npl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217971, "uuid": "2c4aa73b-53dc-40e0-b357-fe1a2a11e6ae", "value": 24511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217971, "uuid": "2b7cd630-df54-47b3-aa88-628f73a92c9a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217971, "uuid": "33ac1736-e442-4353-bf85-3755d7ed41e3", "value": "29be747712b138cf833736c465c94868.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4088cd9a-1d14-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773210824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773210824, "uuid": "7a3428e1-13fb-4d4e-8b54-13eee42dd121", "comment": "Malware payload", "value": "8c55324d04f73b2fe2fce70ae33119f8", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773210824, "uuid": "0917d42f-484f-40d6-93ee-bca1c51906f2", "comment": "Malware payload", "value": "c981083adeffc84014fa8abf05234c8c179d30fd3582c316fc2631ce11189c01", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773210824, "uuid": "75e5de2a-56b3-4fdd-99d6-7b70cbe59514", "comment": "Malware payload", "value": "772af7765d7ef6e8c949d4f42b110296c9d91f39", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773210824, "uuid": "ea53de0e-9c3d-440e-ad12-9d30dc0bbbb1", "comment": "Malware payload", "value": "f0b4fc3b15b8ec167a3a268bd3cefbbb4c7f111dde6bdfd1fdce8a644c3e70a6cc3c43509316603546198fbcaa2a4fd2", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773210824, "uuid": "6e36b801-037c-492e-99b2-0e324f30753a", "value": "T1FB052324E8F2995BDA7B343405D3C1A84229FD99B51DE3833BC53BEE323A7E87191215", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773210824, "uuid": "13f78fa2-fb54-42b8-92c8-0b36e7ec9ffc", "value": "24576:StQbmuS+xN7mCA2LavQhFIBD2sNjr6o+KvkSS:S6S352LafB6sND+gkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773210824, "uuid": "92b515d8-4fbb-4777-8b59-3ea28995b633", "value": 864768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773210824, "uuid": "ed38a18f-80b9-44da-ae59-5ef2c40e2de3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773210824, "uuid": "0a794b38-e140-466a-9a4e-c21c32c6674c", "value": "SN212110200003\u3000\u51fa\u53e3\u3000C9\u63d0\u55ae1Z82342X0428805006(82342XCDX7K).xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204cb4f1-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217642, "uuid": "e3e1b201-94a3-40f8-8add-325f78652e41", "comment": "Malware payload (Mirai)", "value": "7473d73c8b3b8b7b7e6dd0631cc70fd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217642, "uuid": "c2b2047e-017f-4f1b-bb81-d6acb3930e3e", "comment": "Malware payload (Mirai)", "value": "ca1f5015c6f1b10528f314bad498b39e84026a9683ee9ce7ba1e84750a24e2e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217642, "uuid": "12bdb9c7-3c13-45b4-a9aa-db0acefa648e", "comment": "Malware payload (Mirai)", "value": "d888053ef80507c2af325ed88677db4fe76b1aca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217642, "uuid": "eeeed2e0-2a7b-4f2b-b899-0eda70413111", "comment": "Malware payload (Mirai)", "value": "adbf964d1f552dd3dc2ffe23e57072d152e01c7a29a76f885c47c9b372affb2810b6dd855cd42b2b5a92873398441d67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217642, "uuid": "8c388d66-baa2-46bd-bab5-4c48126853d8", "value": "T1DA95339F362CA487FE5B1936B49993F36D56E9A5BF139C53700422C2FC90098FB442E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217642, "uuid": "cc3c72d8-ac21-4e78-a97e-f65cb408b04a", "value": "49152:9YkZDYQzA03iKwYDJbFj0tLaebMcgWi1fHhUVUn3bFXf0Dnl:9LDYQzD3iKto1KyohH3bFX8Dl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217642, "uuid": "f70c4a02-9256-481b-b96e-6a788ec4fe65", "value": 2059692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217642, "uuid": "15b47d3a-a8d2-4d5e-b276-7bcc4d66b707", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217642, "uuid": "dbe3e5eb-9a49-4ca0-84f5-2ede1382ca08", "value": "deferwqd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cc85aea-1d60-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773243459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243459, "uuid": "0d6cc93c-902b-4777-8e44-84f1507ce007", "comment": "Malware payload (Vidar)", "value": "0b15c594b2160f45c9c405c5a49e3037", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243459, "uuid": "210c8e47-025e-4185-9a71-39a626210bde", "comment": "Malware payload (Vidar)", "value": "cad8a46a2c71f96d8636423a1e39b554ae24a7e7bbfd6eeadb39f98f3fb79ed5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243459, "uuid": "97f2be65-faf2-4ba8-aa31-d7f1c2ead664", "comment": "Malware payload (Vidar)", "value": "aa1e886f0d38ac7cebef89aa7bb0ab18ca51ddff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243459, "uuid": "fefc0fb3-6e8b-49ba-a97f-245c40079f89", "comment": "Malware payload (Vidar)", "value": "c7d02fa67fbb6dfb1e1dca67460ffc9427f73b524727d43ed2716681a53b857675c89ca2e1e1212e335909f2fba778f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243459, "uuid": "faa46c55-c3ab-4230-ba78-f95dd9a171d5", "value": "T151B6E62B72A0C6ACC25D813EC2928FC0D9F361B51B33CBE7429D47695A479D4DE3A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243459, "uuid": "81c2bb52-6322-45c7-b427-2e402ab96e2c", "value": "be27ca3e2433d9854a57851ddb822150", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243459, "uuid": "019390a9-2c56-4c50-9b7c-67c75912f7ff", "value": "49152:t24+J84zmrSOJ30Fz5h/cetKxvqS9TWNKDKv+yUMCUYfwieJ7ivXDGOSsclx+I7V:tgI2AmsvTPSblvQ+9lodqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243459, "uuid": "a0be9fc4-58c1-4930-915e-686a35c8f2a7", "value": 10517504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243459, "uuid": "585267b1-f188-4f23-8087-caca9076b4bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243459, "uuid": "e6b65da9-a9ae-4516-889d-f292889feff7", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b0d5d93-1d74-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773252100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252100, "uuid": "84c0d15f-c976-4d89-9e1f-2a1894785e42", "comment": "Malware payload (WannaCry)", "value": "c0d149a7828c3ad6046da2d897bcff0c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252100, "uuid": "757559c9-58d6-431e-a150-77238202c1b5", "comment": "Malware payload (WannaCry)", "value": "cafb7841867fc7b1dd7bcb1c1da6f81f63750dd16831423ac54e2fcc9d22874a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252100, "uuid": "62263d61-3c9e-4dcc-a40a-21281f88c349", "comment": "Malware payload (WannaCry)", "value": "82d8d681d93dee030b6796d4889bb74644ba06f6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252100, "uuid": "13efad12-ea82-4f5a-ae50-6ef3f75adc33", "comment": "Malware payload (WannaCry)", "value": "3ccef0d84e3dfa554b37772b2879ff1ee8b7cff977142683249df53540401011b347d3edf889ef1a284e330c01bf7b6d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252100, "uuid": "95ad3f76-578b-4d51-9c18-33ed0c403d7b", "value": "T15C362319ED18D729D17A0A7000B34B2AB3A138DDC7AB695F879C5DE50D873673BC2A0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252100, "uuid": "783f1d0a-aca8-4f3a-86f2-a56b2bdb6773", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252100, "uuid": "f1f022b3-ded3-4ab9-88d6-314b68bc3b73", "value": "98304:+DqPoO1aRxcSUDk36SAEdhvxWa9P593R:+DqPj1Cxcxk3ZAEUadzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773252100, "uuid": "5dff7ae8-a6c6-42de-a50d-8b305cdc2e87", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773252100, "uuid": "ed9d203a-5b45-45eb-b090-8477e11c35f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252100, "uuid": "38ea50d2-61e8-4cb9-9571-c7b7d167e487", "value": "cafb7841867fc7b1dd7bcb1c1da6f81f63750dd16831423ac54e2fcc9d22874a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbd00233-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773217956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217956, "uuid": "a59cc03d-8af3-4a58-a91d-6bf65ba867cf", "comment": "Malware payload (GuLoader)", "value": "1db7bef0d45a90cdadde311f37ec6571", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217956, "uuid": "63f441d1-6ce4-4f4f-821c-9e3577196b47", "comment": "Malware payload (GuLoader)", "value": "cc02401bd56274d211d97e7f234df09b28142189e3cb91df798cb929a0ecca4d", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217956, "uuid": "31f9b025-6e76-4fc3-81db-2201a066e48a", "comment": "Malware payload (GuLoader)", "value": "0822ebeff0e767cb2ff369c12e081267ba055aa4", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217956, "uuid": "983ef94a-578a-4138-ac83-8e5dd146b93d", "comment": "Malware payload (GuLoader)", "value": "23e737473c794e5a56e03f38f191b7b7726f121f0702a4df81fedbb5bfaac35a980c3b6b4000628376761bde60699fb9", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217956, "uuid": "ac6dbba5-adbc-4fc0-ac0c-42b45ba40220", "value": "T1A9834AB0CA2219734F47BB88BCE44661C67C8314962615F1F6CE8B0D900DAECE77D26B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217956, "uuid": "4cb6264c-efae-4e7c-809c-5de39fe15b8a", "value": "1536:HiiNLTJgdzMny8CSElB2wqDWhu5yDXmZndMtmkYaERKe4:7JVntCSElc/6YyjmRat1Yau4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217956, "uuid": "ac8e4900-cc9b-473e-922c-2e074208c368", "value": 85313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217956, "uuid": "09e7c156-40fc-4c41-918d-6bc59bba8220", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217956, "uuid": "2631d6c8-b1de-4f8d-85de-194ffaa5e196", "value": "1db7bef0d45a90cdadde311f37ec6571.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef751f7b-1d3e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773229156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773229156, "uuid": "3c7be6dc-266e-4c39-a066-4f45802227ef", "comment": "Malware payload", "value": "9115df1d2f2913ebf21788f6f9469251", "object_relation": "md5", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773229156, "uuid": "2a741cb9-5d95-4127-a4f4-5560c708e744", "comment": "Malware payload", "value": "ce10df51bf1eda48756df2c7c1962d2486d2e25e23695a6f98a82e32281df347", "object_relation": "sha256", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773229156, "uuid": "2a44617c-6cfd-444f-a238-226dc3d43fe1", "comment": "Malware payload", "value": "883045677e16e46f53929b9b062d2e47b80fbe56", "object_relation": "sha1", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773229156, "uuid": "3ba0ba66-08d5-45f7-bbde-82f6ce0ce35e", "comment": "Malware payload", "value": "64fed302711e92a1c315ec999f47c2d49bc4155eef3a5b2ecdcf67bd1cfdc9e1e80bfd19859cbc22fd4d356bac0ee403", "object_relation": "sha3-384", "Tag": [ { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773229156, "uuid": "2856060b-b68a-477f-bd5b-091f21d7e2ad", "value": "T139E323F477DFECE1B7569DB29F226D084480915C91FBB1682C4BCE738613AAC9A4D218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773229156, "uuid": "80780a09-ba8f-4699-a7c8-bd5ae1073a3c", "value": "3072:TLheEPPX8GjGPTSu/YKv7VMqoTMvY5LvhHq/r91HiXU0wE1Q:TFPPNgTS7KD6PM6Kp1/01a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773229156, "uuid": "5a258eaa-4b67-42e7-a360-c8d0c8a97edc", "value": 146418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773229156, "uuid": "03306770-2f8c-4e48-83fb-ea7f143cdb64", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773229156, "uuid": "428087af-a999-47eb-ba6d-4e3a3f56b7f2", "value": "\u0415\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u0430_\u0444\u043e\u0440\u043c\u0430_\u0411\u044e\u0440\u043e_\u0435\u043a\u043e\u043d\u043e\u043c\u0456\u0447\u043d\u043e\u0457_\u0431\u0435\u0437\u043f\u0435\u043a\u0438_\u0423\u043a\u0440\u0430\u0457\u043d\u0438_\u0432\u0456\u0434_11.03.2026_\u0432\u0445\u0456\u0434_1921755727.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4291d74-1d27-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773219232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773219232, "uuid": "90050f3d-f13c-4c91-a473-0319a20a0b4d", "comment": "Malware payload (PhantomStealer)", "value": "b9945d2b89309cccb353330ebe8cb0ad", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773219232, "uuid": "06f77bfe-88f8-4dde-8cbb-adb7fb7b6a14", "comment": "Malware payload (PhantomStealer)", "value": "ce5189c38491ce5f84fe1c50722759b38832e1bfdec65ccacb598f06bf5b1811", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773219232, "uuid": "67abb7a1-cc02-453e-af89-ea2b134fa3a9", "comment": "Malware payload (PhantomStealer)", "value": "356d86190ea0bb0241b1f3abd444b2a621a0d3f6", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773219232, "uuid": "7743c76c-50d0-4fc4-b9b2-72ab3a22f87b", "comment": "Malware payload (PhantomStealer)", "value": "34c0e6926c94c47849b279018e1894eff935ec9ee53aa9459156e81782650e7c09a2886301d25f2776bf1ec3c1b2009e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773219232, "uuid": "5958b329-0ccb-4766-b310-ac4ca1e01cad", "value": "T1943502158DC46FB5CFAC6A1880FE1A1E63A04B9E402B798DEB33BD46AFF7544410B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773219232, "uuid": "613e484e-1855-4d3e-a0a9-8120daa088cf", "value": "12288:h5Ut5OddiwQj5TuhYtTfDdsRNYknvvRLHoHelmfoX2afCLLVrICBCa1ti5vXLAGO:h5C+dRQjZ+YZDORNBJIH5oXiLLn/tGil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773219232, "uuid": "fc0b9fda-4082-4ad1-9095-51233604c49a", "value": 1111612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773219232, "uuid": "1cd73843-534f-4186-a8b9-c5a18e8a86c1", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773219232, "uuid": "78a570a4-c68c-49db-af27-b77d060bc659", "value": "RFQ-SABIC FACTORY-MEDUYW342685-20250528170802-Specification.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99fc78f7-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217846, "uuid": "34c2c9a0-2b8b-462f-b310-4bed4780e4a2", "comment": "Malware payload (Mirai)", "value": "fbc8d30ceb2bf68a2f027c7996ca9b2e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217846, "uuid": "770b8015-323b-4ffa-a8aa-e9411937c3fb", "comment": "Malware payload (Mirai)", "value": "ce576556204a6d2e305c289682cfb832c0536f0403dade3f38b379eb317a4099", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217846, "uuid": "0e3f6cbf-1364-4423-ace2-42aab063ad14", "comment": "Malware payload (Mirai)", "value": "d988ddbbd7de83c060ca9a996a9da7145ad3453d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217846, "uuid": "b96fae40-fcb7-4b83-a13e-fdc953329f0b", "comment": "Malware payload (Mirai)", "value": "69773b9cfdc580d69c662eca172aea08978e28cc2d7877f27da9b813f2c6dd3111365313c42ec98fc0b4ac8c4bae51d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217846, "uuid": "ed50db9f-0c7a-4dd8-bc68-711c2511f34f", "value": "T115861887B9C24942C5E43A37B8BE80C433635EBA8B9752566D05FE3C3ABE5D90E34354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217846, "uuid": "bb8dcf90-4814-4b2d-9c8b-f9b679443105", "value": "49152:eep3DG2WKVFjUgZ0IdM3++mDudBgM+L1RQ/+HX2OFy/G5EW:bZYgZ0IqiVX2OFjEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217846, "uuid": "a49c3f64-f454-467f-859b-c4a7e2b21912", "value": 8061076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217846, "uuid": "f195abf3-e39f-44ac-b390-9062b6484151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217846, "uuid": "2fe699f5-0d89-4265-9daf-9e72147250e6", "value": "ksnapd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdd6d72f-1d6e-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249796, "uuid": "77d4e723-62b6-4f58-84a3-c257940bb1f2", "comment": "Malware payload (WannaCry)", "value": "8f6a66a53beb129cd07a8520e1326041", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249796, "uuid": "481fa078-d92a-46e2-b846-cb1b3663af7d", "comment": "Malware payload (WannaCry)", "value": "cee5c8ec09f078bf499198d64d50b622ac8ac961b71af1c21b5a6e6885847c80", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249796, "uuid": "1be22b08-94d3-415c-ae9b-7ed5144cde57", "comment": "Malware payload (WannaCry)", "value": "eb44f7dc0f40df4f20054fa12361e42ae6f84f58", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249796, "uuid": "b5393c9f-8555-4555-a00c-8ea032c6c3c9", "comment": "Malware payload (WannaCry)", "value": "3bc3bc1708e94f575d927582b1714d803ad5b103315a34d9e5af4bf4b3c12e87fe094657dd0419cfbfd86d07f213ca33", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249796, "uuid": "06d65eec-9f0f-46ec-86c8-6b7c6b516528", "value": "T1B5360204EBD4C9B5C56615304EB783206F7AF854A6A5CB0BD3F4A97D2C277889F60E83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249796, "uuid": "b2935b9b-7903-4868-93fe-c08768a1555f", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249796, "uuid": "ee959a87-a291-432d-8cde-255eb625b2ce", "value": "49152:JnjQqMSPbcBBQej/1INRx+TSqTdX1HkQo6SAARdhNREroVeiC9avc:d8qPoB1z1aRxcSUDk36SAEdhFeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249796, "uuid": "fca5707d-fe8b-4d33-adad-c46fbc1be3e4", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249796, "uuid": "f554e688-6c77-4d3a-99fa-c43dcb976217", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249796, "uuid": "8729b829-60c4-40a1-9806-a165713ae263", "value": "cee5c8ec09f078bf499198d64d50b622ac8ac961b71af1c21b5a6e6885847c80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec687741-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773217984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217984, "uuid": "eee85169-cfa4-49bd-bfe6-c021e9c4b9f5", "comment": "Malware payload (PhantomStealer)", "value": "a09ac4c457f7ed0aa4c8d47d14d10881", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217984, "uuid": "b5fe5869-e8a1-462a-b051-ba7c5b6fc73c", "comment": "Malware payload (PhantomStealer)", "value": "cf14e2a943f417a9a02a79ad52dbd5d753ee2a0e72398a624eeec485f119c8df", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217984, "uuid": "b115a83e-88c5-4c21-bfc0-409499ff4de3", "comment": "Malware payload (PhantomStealer)", "value": "408b5aebdd44c189a3af8d53681d24bf1dbb8acc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217984, "uuid": "51d4d48b-3e57-4293-afd2-03e72273acc0", "comment": "Malware payload (PhantomStealer)", "value": "2b7a16afe897f5d6dfef5376aca2463dcc9cbeed4aeed7d26b171798b4c99e65c4d04c54aa8bcd4e0ab297831b319f67", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217984, "uuid": "9efca762-1dd8-4aaa-9fd6-1a4aecaa3a17", "value": "T19FC2768C3DCAB568931564FB282FB09BEAFF0CC8B85D4184CB1919C5F879708D47AB16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217984, "uuid": "c1aa6bd7-3325-4beb-90ea-98665e23c185", "value": "384:brZUkZOSl8wN/wz6hwWSCt5i1IgtfqV7LBhs0nrCk8ByRHrbU:brZUUFwz6hwW7iLk7Vhs7Bu/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217984, "uuid": "cf622a05-8d0e-40ad-9d8a-4ecfab1e1cc5", "value": 27720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217984, "uuid": "d453646d-55cb-49c2-b066-131dd7a02789", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217984, "uuid": "4b53669a-ccb8-4970-afd8-772c01fab52f", "value": "Sales Contract_MIQOSZX040441.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dd72646-1d61-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773243918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243918, "uuid": "b4621aa8-d8a2-4e9e-98b6-90f87f6b5dfd", "comment": "Malware payload (Formbook)", "value": "fcae87087ca2056ce1ad3ccaf87979b0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243918, "uuid": "e13d9cb0-2007-48e7-aafd-6a6f7b3079d3", "comment": "Malware payload (Formbook)", "value": "d08410a7c99152b4b46a8f6e686353d0a0a0be18eff6358322b72c28e43bda53", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243918, "uuid": "4f21852e-ffb0-4a86-a5d7-1527a2de5ea3", "comment": "Malware payload (Formbook)", "value": "4b32307906306685245e8a5b26317db510c67ae0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243918, "uuid": "f412ac09-72f5-4714-876e-22d501c700cd", "comment": "Malware payload (Formbook)", "value": "5a061c14a3760bdc761818b5e300939403c79deec70a29466a56d214c2acb37cf0b7827f6b465ca82b1c197abbf7ce47", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243918, "uuid": "491aae4d-42ea-4925-b29e-2c637e34ce4c", "value": "T11A45D86151A7B78F1681C2093DF93E02FC3019C6B4B35026B373CAED6E9615E663D9B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243918, "uuid": "fd6983da-0e8f-4653-b203-aeca09c6817e", "value": "48:XzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzR:TyXu5gUYdObKn1HTZNMI4MM9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243918, "uuid": "3e7f6ed6-f3cd-4155-b358-af8acd5c3c03", "value": 1189631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243918, "uuid": "63260549-e58a-4e58-a772-f4e1d550cf94", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243918, "uuid": "77e357fd-67af-4f7e-9eb0-dfc47a53895d", "value": "fcae87087ca2056ce1ad3ccaf87979b0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf304ce0-1d23-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1773217506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217506, "uuid": "8d9cfc0b-ce15-4db4-a600-2b83fc970649", "comment": "Malware payload (CountLoader)", "value": "a2e326796fd9ad113b396df1f9d98d5c", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217506, "uuid": "a787c771-6e4e-4a15-a5c8-662fe1bef6e2", "comment": "Malware payload (CountLoader)", "value": "d0ebabd416f5311be2e7310fc9bcc68f34d5a9ce5d0c504bb3ca1256dbb3ea6c", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217506, "uuid": "0435b3ae-2d34-4c2b-a148-f0a9e881a1fd", "comment": "Malware payload (CountLoader)", "value": "eb64de85870923389df7ad8288d44e2f215548bc", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217506, "uuid": "69fa4c08-04db-409d-9494-63a89f597430", "comment": "Malware payload (CountLoader)", "value": "dd2bc87a587f1955bc1ee6a398430dec6e08e02834bef3763a140db91c8b5cbe4d5e1c790e0b095f1329a79c643266c2", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217506, "uuid": "c552b9eb-6ef7-4340-9c8d-4086e55b6cf8", "value": "T152C3230E14EFC05957336B29861B8441CEA2A72F1909C6707A3DCF345F1CE95DAECAA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217506, "uuid": "2cea2b07-f42c-4768-8a6f-2c5466051550", "value": "768:R7IpXWcdRQp0T2sciwSG7HbSnc9GLjfA2gcGLj4PGQL+skkTAShJ/TnTFKaPdejC:Dd2gDJskO/TnORCH+PxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217506, "uuid": "bcd0eab2-0980-4164-a2af-29332e70e8a5", "value": 125445, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217506, "uuid": "00783c7b-7fdc-4cd3-9715-a040bb51dc78", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217506, "uuid": "8a4972d8-228d-4c04-a9a8-a6fe42228411", "value": "Quantum_Session_Winter_9936.pptx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3b81af2-1d5b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773241538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773241538, "uuid": "5720f7f6-f19a-46bd-a549-33673fe57ccd", "comment": "Malware payload", "value": "6f474817d4718d769142b02d4f953bc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jumper", "colour": "#A51D4C", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773241538, "uuid": "9dcdead4-7a18-450c-a521-394838a415a0", "comment": "Malware payload", "value": "d113825735628db095c67f2287de4831dfa4a22e270cb21af1d1b802a62235aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jumper", "colour": "#A51D4C", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773241538, "uuid": "441e31c2-6e55-4b24-aefe-83b844215c5e", "comment": "Malware payload", "value": "c3d221e335db381d71af83483658604595d66415", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jumper", "colour": "#A51D4C", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773241538, "uuid": "152182c3-db3b-401d-8dc6-8d6dbb60dbc4", "comment": "Malware payload", "value": "740fd375b99c495360bbf7176bd734cc1e0ab2518c5413cf2bd9225f797093dad56c76df2910aaadc34ee225b39fe651", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Jumper", "colour": "#A51D4C", "exportable": true, "hide_tag": false }, { "name": "proxy", "colour": "#334A78", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tool", "colour": "#139C8E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773241538, "uuid": "04faf331-22be-4b1c-a49f-323adf24afe4", "value": "T1B674AE1276C1D033D9B201725E69EA21967EFD301F2569EF93D12A2EDF306C19A31B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773241538, "uuid": "f6363503-9097-4ecb-ab95-8f740c9095ee", "value": "c651dc1e604239d60cc2bc6e6bc51119", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773241538, "uuid": "763e38ca-34e8-49b7-9340-fb98b2381b49", "value": "6144:Lmyya01zRX5Ua8Bx6hvJWXGwpU+fI1IgR9QMRuvuRRt9hAOGqOv9LmOwY:LmyyaqlX5Ua836hvJiZpU+Aq/uRRluvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773241538, "uuid": "f29798b5-1a67-4827-89c4-acecee68e540", "value": 346360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773241538, "uuid": "316303eb-92ea-4ce1-979a-60487ff67c5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773241538, "uuid": "f629fbe5-49e8-4dfc-9177-82f891e2e038", "value": "wire.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140a54a5-1d23-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773217192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217192, "uuid": "b4377407-d859-46d4-990b-caebb6167336", "comment": "Malware payload (Formbook)", "value": "4e764b9371f244add8e34779730d2deb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217192, "uuid": "a26206f0-7fdd-4441-ae4a-ba66b177064d", "comment": "Malware payload (Formbook)", "value": "d1b2c9383940c8efebcf61cb3ad20bd1e0926d7a6d927b90ca7f31bf23756df3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217192, "uuid": "8bf495b5-35e0-4faa-b8c3-ba6d9776b02c", "comment": "Malware payload (Formbook)", "value": "0144959f0f6449a0362f38cd340f248db47002a4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217192, "uuid": "42f21f98-eacc-46c1-a5e6-b50e30ca260a", "comment": "Malware payload (Formbook)", "value": "660e3fee1b6d7c5ab1fb0142ee937a097eac7e1764ddbfd205c03611cd4351e76eab820b69b67ecff396a220b9fa8e26", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217192, "uuid": "06821328-5fa0-46f2-a8e0-1437c2d8217c", "value": "T16A95B0621B819B789AEC113F45BF11CDA393534DBA5BD58CDB83FC707F8800AA5AB164", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217192, "uuid": "9323ce26-aa90-4e66-91b7-58deec5ec68c", "value": "24576:VJHjIorJpZWO6JZnf+mvRfFKUpNpnjUvO:bmZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217192, "uuid": "ef1fb41a-2b2e-4a2e-a387-e1beae9eb215", "value": 2003574, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217192, "uuid": "9f5452ce-0270-4c92-8d84-dcaa3ba24042", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217192, "uuid": "958ca27f-c8fe-4eab-8f6b-7f72f2ebbc1d", "value": "Approved LPO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131cd270-1cf3-11f1-a769-42010a9c0008", "comment": "Malware payload (Joker)", "timestamp": 1773196574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773196574, "uuid": "b187715d-01e1-43fd-832d-9cd9344f6bbe", "comment": "Malware payload (Joker)", "value": "dead690d8879eda15a9103f399c66f78", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773196574, "uuid": "e9c4a42b-fb74-4143-8924-3b1785573a21", "comment": "Malware payload (Joker)", "value": "d3413c5e2b9532228753af9b3c9049d89d4442c03055c152cc8c8e9826336f01", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773196574, "uuid": "f8a018d6-d76d-4e02-9a09-1bd7664973a7", "comment": "Malware payload (Joker)", "value": "a412846ae3db64dd16065d0c8111b732b25abff6", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773196574, "uuid": "90331661-fc33-4255-ba8b-3c5017d2cae8", "comment": "Malware payload (Joker)", "value": "749cd795c7be6117701d40157a589457961ca44042f812114f0f96862fc1b31b0d6ad7ba4e848b1264f0981d2c59ba85", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773196574, "uuid": "71f98f3f-0a3b-438c-a354-a1000f3dcd4b", "value": "T1FFC7F24AC51C8532D5DFF07CAF7E0B66B23A247840A9C55BAC2D9148FBCB2F055B2B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773196574, "uuid": "f2fe8907-48fe-4e98-be6c-62119c51ca74", "value": "786432:u5svK92LUTHvINR/yYIe9DSAXMfDSoeWpn1d/b1dBHelHVvVlTx/uuLZYbeJ:u5s6YUcf6YnDI7SoeW11d/Ref9l8uNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773196574, "uuid": "c0103a0f-d53b-4580-9303-cd85fd956f65", "value": 55273903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773196574, "uuid": "3ec36387-0493-46c7-99df-4dffb8679078", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773196574, "uuid": "3cffe439-3f33-4893-bddd-da238aac4c6d", "value": "com.infect.spectrum.tvshort_1.12.0.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c75b0e2-1cf3-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1773196563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773196563, "uuid": "498ba9d7-179a-4ee8-87e1-57c3b3c251cb", "comment": "Malware payload (GuLoader)", "value": "f0595b951fb590e44924172d0ef90457", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773196563, "uuid": "0f6554f0-fc89-4d0d-b9d6-c96d2de6c4b0", "comment": "Malware payload (GuLoader)", "value": "d3e7a3c65f422312b5abba4d182521d886ccf29cfb93ab3b88650206364c685a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773196563, "uuid": "749687fc-7ec8-49b8-a0d4-4e9a6be53166", "comment": "Malware payload (GuLoader)", "value": "827cad7b71f30360bdfbad7713affe55c1b9e81a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773196563, "uuid": "1ad45ef8-6c57-40f6-ad3b-bba709022ec1", "comment": "Malware payload (GuLoader)", "value": "beb1eeaf03e785d6faa2cbe1fc5ee70b20835c31e506202e0e812fe5732c3a486dfe4fc417953f7c8b0a8415a1953d77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773196563, "uuid": "5de54ba4-f184-4247-81d9-8d6be8fa5db5", "value": "T1B615128362F0CAB5CB08D5F0A5E655738FA96D7F2EA462336140BDA740F781C980E5DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773196563, "uuid": "37fac30f-96af-4249-9826-15719690de06", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773196563, "uuid": "d6f548bf-80de-4934-b826-1ac8c5ff0dcc", "value": "24576:k+O9z040zR+WSsGUK2ns3dDJtBo2PqNXiu9:7QkAWIgSdDJjoA8y8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773196563, "uuid": "23722b34-ca83-4650-9e38-41854a76d30d", "value": 931672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773196563, "uuid": "3804cc69-9f1e-4c3c-91aa-87a82fdbfaf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773196563, "uuid": "9a3dc29a-8618-490f-af79-9ec67f024a33", "value": "10032026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e81c9f9a-1d53-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773238163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238163, "uuid": "cc06112c-4f15-4e28-8292-d63d796f2c5e", "comment": "Malware payload", "value": "0880820975f0f201596e8677c73d9e0c", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238163, "uuid": "64c2bff7-b640-46f6-9c3f-07251dcfcd16", "comment": "Malware payload", "value": "d493fdd20fef55c0327e4ad85c1f6f96deb255ef949fbde6fb9cb33406656e4a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238163, "uuid": "1fb56db7-dd27-4225-9874-c70e1f4dc19d", "comment": "Malware payload", "value": "057c6127add95da3483bb783c52c5a9088f4a760", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773238163, "uuid": "d18206ef-ec14-4009-b0a6-00ed36cebce2", "comment": "Malware payload", "value": "8dcb96250c2cd0e6a812716e8643f1b17ed5e5d455733a78eb60411320706c12206832a63c1b3c17cbd90905f6a0b85b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773238163, "uuid": "c00cde48-1a06-4bc0-b759-3030955d3777", "value": "T122B3769D088A84E48F5F24698B4F1E27EB6C5187025EC290FAFDDF967F1186431B67E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773238163, "uuid": "2124b280-3f55-420a-8399-4fe929037133", "value": "768:HkCIO4hKpPaJJwOZMgYMNDqV+p777Em++0judG3PRes7PIIRkGyEy9U06PYvDabf:HM6EJwy777EnjvReqAIiGyEyC06PJq+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773238163, "uuid": "457c46b1-6bf4-4a79-a7d8-c295d0204de6", "value": 116841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773238163, "uuid": "a89cf253-a694-4e34-8a3e-d2a52929c823", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773238163, "uuid": "0a40a5ee-d699-4ff9-a60d-c8b9472dda9a", "value": "Germany_Images_Clean_119.cfg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "362310bf-1d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773255474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255474, "uuid": "8f0df8d8-accf-4ab2-a0df-389dff0ea8f3", "comment": "Malware payload (Mirai)", "value": "5655d62aba797d64ebd6962897df2d9d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255474, "uuid": "814d788b-c9a1-4190-a9bb-53ab980d1746", "comment": "Malware payload (Mirai)", "value": "d501faeb74777316a7793e946b65bb42192929dee76c9305ddb2617ccc8f5aae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255474, "uuid": "6a6a37bc-cd5a-43e3-bddd-ac47cab73f65", "comment": "Malware payload (Mirai)", "value": "7953b1fd3774feba26243cc61b848b2cda3cfd64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255474, "uuid": "78e9d7b3-edf5-4645-b1cc-976a8d0837a4", "comment": "Malware payload (Mirai)", "value": "6009f9bdc718a6af978e264e20bd0bf50eab00541caddaeebc02a7311497708a0c657cffe2fb7ae0c84e36e51cb2afb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255474, "uuid": "a4d6ae2b-90c7-460e-819a-28e0a398e4a6", "value": "T1D8831B41B8818F23C1D117B9BAAF459C373177E893DB33069E246FB42F8259F1D26A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255474, "uuid": "42431a2a-011e-4c6e-8fd8-54510c998bd2", "value": "1536:FFpJnFc/zQXZ4C/OyEtDuU55g23yXTkvpUSRFyes6tXX3F7FH8TPPrHZ:FFpJDZ2ijkmMFyescXXbEjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773255474, "uuid": "f81efed4-40e6-4dd2-9333-fd5f786cf173", "value": 88039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773255474, "uuid": "9d59a644-e4f0-44b9-8378-30a3616aea60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255474, "uuid": "ae262e04-5650-498c-b63c-c88437aba903", "value": "xdlol.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882043d5-1d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773256471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256471, "uuid": "a16340ce-b551-4566-bda2-7ca62aaf77af", "comment": "Malware payload (Mirai)", "value": "543579ecb96f4b8ce2b5faa332173c1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256471, "uuid": "5231c35b-61cb-40bf-a432-2e421d7684da", "comment": "Malware payload (Mirai)", "value": "d54a27cca173561f10424e6d35595a5cdd42a139e21a66f9d86b743fe587f80c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256471, "uuid": "a41c0d0e-a381-4876-9cfe-cca75450d20a", "comment": "Malware payload (Mirai)", "value": "8b4b103d3d331921367810022dc63dff8ff658a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256471, "uuid": "28e2cff8-32fc-4cac-b47e-7d08a9336442", "comment": "Malware payload (Mirai)", "value": "d297bf382078de12c35add1a57a139487ed072ea125d6a4069b6c492a32894393fe83443a837d38cbb011e6c1fa5a14b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256471, "uuid": "e51d33fd-085f-44a8-92bf-810d65cae387", "value": "T108730995B8818B22C9D512BAFE1E118E3313177CE3DE73129D206F24778796B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256471, "uuid": "770d3f7f-dc63-426d-b4a4-9c21d7059f3d", "value": "1536:TAnIeDGCSP24CvKo+tYaX9uDjQkMOi4dC/10k7Yv5GYMd:iKC9Pz+tYaXadC/10k0vMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773256471, "uuid": "3dc3722e-1623-40d4-9a48-7ba3be9fb89f", "value": 79324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773256471, "uuid": "e3057a92-6079-4151-a011-c041a45b5e4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256471, "uuid": "87c7698c-fdb8-459e-8a92-4a83f328a9f8", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17d99b5-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773217107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217107, "uuid": "d0bddc81-aad8-4c34-839a-9423b0b537d4", "comment": "Malware payload (AgentTesla)", "value": "adc604330987c7beb8c35bf19da19e64", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217107, "uuid": "ab0c7fd2-2e77-45c3-af4d-39f50e0f928b", "comment": "Malware payload (AgentTesla)", "value": "d624c46b004afd08ee014f0603785eb5cc3b28d162c97e8fc02f6cf492d9fbd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217107, "uuid": "8832813c-f7a7-40ef-aebb-f5f6388874d5", "comment": "Malware payload (AgentTesla)", "value": "aec1f970247bdabf401062cd87c8c85f2d5830be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217107, "uuid": "ec30f3e0-b661-42a9-9866-56c15155311c", "comment": "Malware payload (AgentTesla)", "value": "024f2e76382c9d99b494c4c3ec423dd1e0840028421901a5a4c028247c72cc395ed2c843f339fcab4792a198726e2b64", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217107, "uuid": "8f58373a-9d10-46ea-b428-9d360a0d0efe", "value": "T12F55BE0BD8D19D0605CC132E00FA3448C4A6BADAADCEDE59B626CDDCD7FB4D8589C8C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217107, "uuid": "7fc653e7-4409-4f12-9455-dc9b0d7e6602", "value": "12288:2+3qt2d9nrDw47Tls3TK1PJxMgdDKnF8mJrgEVOkrZFbVDiRA6Jg0FPu:2Ad91sG4X9rjh96Ju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217107, "uuid": "6a6e44a8-1d0d-4672-89df-fa361bdaf899", "value": 1346203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217107, "uuid": "9037b4cd-8b7f-4a17-bfe8-e8c2c3cefa57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217107, "uuid": "97756de1-f9a3-47e9-85e5-5c30d20a7a8b", "value": "adc604330987c7beb8c35bf19da19e64.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1375404b-1d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773255416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255416, "uuid": "39fb8203-a59a-4c92-8dd8-35d6f7395407", "comment": "Malware payload (Mirai)", "value": "32ce3f32cc2bec1899104ce6ff3f868f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255416, "uuid": "686430d0-9064-43a4-bc3e-d6a0191d4e6d", "comment": "Malware payload (Mirai)", "value": "d63aa2bc51f1750aca9daee281834e10780246fbf3a4ff54497ba59345fde531", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255416, "uuid": "ebe6d732-578a-4fea-854c-060eb58150fd", "comment": "Malware payload (Mirai)", "value": "30216ddbd93f382de11b2a07ce5f0c87b75f217e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255416, "uuid": "f70b9739-0988-48c7-8f25-ee73e92f06dd", "comment": "Malware payload (Mirai)", "value": "3c33378f549317241c42379669ed39cd0bc976c5936c50c93446f19eed0cf531be0cc1c9ca86b77276874a84a4026bc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255416, "uuid": "39e5b974-1f66-44ae-8f97-f8e9c6f0cf79", "value": "T120A32C0178428E23C1C1177ABAAF455D3722B7F493CB7312DA246FB42F8369F0E6A955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255416, "uuid": "72d6cb34-1969-4665-a081-acc4f430db46", "value": "3072:ti6kpBAOZJXS8M5ecdCqnuGU7lWynxMzLroJ8C:ti6kpBAOZJ9Ce4CqnU7S8J8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773255416, "uuid": "eef3b712-153e-40fc-ba98-7559676eab0b", "value": 101950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773255416, "uuid": "7c3c92aa-1708-42a9-8809-54508b653241", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255416, "uuid": "b89ca982-bcb2-4658-a20f-a4d24075275e", "value": "xdlol.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba8ff63-1d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773256450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256450, "uuid": "c3c555cd-ee38-4a39-990b-92547a3fa036", "comment": "Malware payload (Mirai)", "value": "4a63fa19be33b2bf7c856ea298c1e99c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256450, "uuid": "d53cda30-6fd6-401a-83d7-f8c092f90f77", "comment": "Malware payload (Mirai)", "value": "d7092342d45918a975d1a1b1cdc6142eb4084591f2e796c327214ecfb34566fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256450, "uuid": "b170b952-3ba5-4976-9162-3354d9e0c6e4", "comment": "Malware payload (Mirai)", "value": "ab5f43500384b2dfbfc6f341b6c728704c7143f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256450, "uuid": "3d1ff051-3c4a-4374-b7cb-f5fed40a9fdb", "comment": "Malware payload (Mirai)", "value": "8488911c1cc8170245923647fec206237a274a6c9a6c9d6791c9cb818caee46323fb1f86bd59dcc0445b07313c9413d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256450, "uuid": "1a3a54cc-3bb1-44ed-bfcc-1c30245f4cd9", "value": "T13553AE77C8396E64D25581B0B8748E792B53F88482571FFE1A99C27A8047EECF6483F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256450, "uuid": "ebc642cc-f7e4-4740-8a0e-bec5892fe50a", "value": "1536:caCwtuAPFqcgdEcM5KU3AwHup+CSXHld5Zo:c58PMcgaNAUHup+5FPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773256450, "uuid": "2e5904a8-4404-465b-8c1a-a4faa4b1bd31", "value": 62948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773256450, "uuid": "f7aee0b4-0ca1-479b-9f6c-13df7ae58b78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256450, "uuid": "a60f4642-5e50-42ed-beda-93d43566dd82", "value": "psh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978c756f-1d08-11f1-a769-42010a9c0008", "comment": "Malware payload (Meterpreter)", "timestamp": 1773205816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773205816, "uuid": "a6af59dd-255e-4acf-8012-cdaef37265ae", "comment": "Malware payload (Meterpreter)", "value": "7bf8e8121ef3b27ea26493352255e30c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773205816, "uuid": "2e7ff421-f552-46d4-b116-e4be94da82b3", "comment": "Malware payload (Meterpreter)", "value": "d72a640ef68a2bc03bf33359816b445ac8354907a1fb3375d94a675f3f6fd259", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773205816, "uuid": "0bd797f0-8cf9-4cdc-840c-37663bf442bd", "comment": "Malware payload (Meterpreter)", "value": "acf71dc4724086d889497d91bed1381281c58e5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773205816, "uuid": "1b4cee3a-195c-441c-9a01-847662093d35", "comment": "Malware payload (Meterpreter)", "value": "7f8d46682df6cb3e997f1c1d4aebd13960173517ec138ebb4ad871312e32c1bea4d55d7638d55a45e566910cd23c0051", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773205816, "uuid": "fc2d84ee-033d-40de-9ba4-25bc7ef3d9dc", "value": "T19F936D41F3E202F7EAF1053100A6726F973663389764A8EBC74C2D529913AD5A63D3F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773205816, "uuid": "13518588-3f78-458c-ba95-c9abd8f6296b", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773205816, "uuid": "8e943bcb-c9fb-4972-8c0d-10aa75f714ab", "value": "1536:D7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfwwtQeOU:f7DhdC6kzWypvaQ0FxyNTBfwS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773205816, "uuid": "a9adf291-ce85-4714-bab3-8bddbe168d82", "value": 92160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773205816, "uuid": "aca63a7e-ec2e-49e9-8d11-d15746d22d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773205816, "uuid": "37db9648-fe17-4ca0-af3e-841acd869522", "value": "7BF8E8121EF3B27EA26493352255E30C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6c992d-1d23-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1773217447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217447, "uuid": "697e0d2d-0d38-4dc8-acc9-5ca9687bbca3", "comment": "Malware payload (STRRAT)", "value": "eeb48f694c8cf72e69c8c4b70d37094b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217447, "uuid": "68a4eea6-e730-43ab-8310-73a9d5187a31", "comment": "Malware payload (STRRAT)", "value": "d90a3fc8b960283aa5dc841f27c543ff44bd17a91ea4cb7fecfbee179a58d842", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217447, "uuid": "730f2ef7-3823-4ca4-b06b-e34caf1c4dea", "comment": "Malware payload (STRRAT)", "value": "e527f83e76e1df4c5f8353ca96f1a7ed97b0c7a3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217447, "uuid": "74d0d63a-ff99-440a-9c38-77e3e5f8f342", "comment": "Malware payload (STRRAT)", "value": "a94bfd4e8b8ac545385b911931359bc53ecb0093e95263eb73f1157a686c90886cd0a20a187305c6bdeecc75578ef75a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217447, "uuid": "545092e9-ff42-4088-91f6-8ca3bbf7c4e5", "value": "T191F1C224A6C521F94634B7CF8FEB8BAFB045F8D111D78D46A64A39C7691AD0FFA0C424", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217447, "uuid": "2a812ae0-7f5b-4830-9c24-a56df2d5b6c4", "value": "48:ZH9C1ahCVFAaCnHFrQ9CAJiqO++oXv92J0A4Z69CMwGlhiDWEs3HXM+GPD9CTJ/4:HvYslrilPSnl5iPhJEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217447, "uuid": "55694a21-56ca-42f4-83f7-9f99eda2faaa", "value": 7935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217447, "uuid": "009a20fd-d5ea-4d47-90a8-e7b654fb3f95", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217447, "uuid": "1fcc05f1-8f80-4f21-b6c8-66740eaed5cd", "value": "eeb48f694c8cf72e69c8c4b70d37094b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daf222e2-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773217096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217096, "uuid": "8b2cb254-2f91-4d3f-b27f-9882344f0d5c", "comment": "Malware payload (PhantomStealer)", "value": "ac2136f227485e814cd3d416ccb81215", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217096, "uuid": "39fddd1e-e81a-48a8-804f-76ca6bb1b4e8", "comment": "Malware payload (PhantomStealer)", "value": "d936fa6740237c512ac6d6d7605a7ee3c3684a37a229cc24272383634c2c27b1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217096, "uuid": "faeb1468-6f3c-4de8-9fe1-26fce12cafda", "comment": "Malware payload (PhantomStealer)", "value": "c47f8b11616dabe18998bc498ecf54fcaf52da1d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217096, "uuid": "6d6b6b81-650b-49ac-bee4-61bc6a3e89bc", "comment": "Malware payload (PhantomStealer)", "value": "1bf4a0c7c550dc5aa387b5eddae8c587b235296f1f1926f90085e03abf26eca28b9f03b6be6ea0c8080b024a6a1b46e1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217096, "uuid": "926afd29-3f11-4ecf-b483-c789f021ea0b", "value": "T19A26B00BEEE05398CFB0C94EE9FCA0D92660681F446E65F4EC4F7D417797046E6821BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217096, "uuid": "31d0dc40-900f-41d6-b4f4-e6b67b92be22", "value": "49152:X6DVLbGOnMja11KV2QI7TIOEcObr1rrN1+S0paULbiO+zu8QivbJt6nxEb+0f3Dy:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217096, "uuid": "acc08522-ea2b-40d9-a312-46482c0265ad", "value": 4604351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217096, "uuid": "d4d9809d-7876-4363-b4a1-f1e15f15a915", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217096, "uuid": "58642bc6-a6d3-4e93-99a9-e04e27acf3b4", "value": "ac2136f227485e814cd3d416ccb81215.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2085fc-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773217076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217076, "uuid": "990a41fe-dd22-4664-8fd1-a46d18878f6f", "comment": "Malware payload (PhantomStealer)", "value": "1972c019c768e1c091cc09a1475903d0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217076, "uuid": "9c1a85e5-8542-485c-b724-fd56714032dc", "comment": "Malware payload (PhantomStealer)", "value": "d94f30d25920b349acf4785a89be54449d03857409898b3e86a29d381258a971", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217076, "uuid": "7a2bd74a-aa3e-4b45-94f8-8d63af882c5b", "comment": "Malware payload (PhantomStealer)", "value": "3e2ba0dc793c0d48ab63816d7a5706aa075e3832", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217076, "uuid": "5f365ea4-9ce5-4efe-9a4c-8d71118fef0e", "comment": "Malware payload (PhantomStealer)", "value": "3c0e20e19df8a598543449de518d967cdc87962601dd807f017a8cb6113746e72a6c91779737b18169355a9a8257ead0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217076, "uuid": "84692479-cfd9-4a7d-bb9b-431da94e5a9a", "value": "T1A553E0110298093CF4945A0868F40961A7DECAD97F1CB37AFDD1E4BDE1C95AF4FA8B18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217076, "uuid": "537f1fb2-2afd-4ce9-9bcc-3e1d0cc83e2f", "value": "384:9PUl+zXVor0H4U8qQm3hU906tYSV4/N917h9rCGCav7siksoqMf15YXrXD3Ff1U9:f4DSmD8lh9vAfE76rBNNAy0RG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217076, "uuid": "c6d9b2f0-d443-49b8-bbd2-60a14ba1d421", "value": 62296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217076, "uuid": "199a610e-49b0-4917-a5d3-2987400abf87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217076, "uuid": "17a3f90d-e527-4451-92b1-8fbf4c1eb665", "value": "Order_Specifications.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2afbb5-1ce6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773191196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191196, "uuid": "7c7ada2f-9747-478e-b2d9-4bb006cc01c1", "comment": "Malware payload (Mirai)", "value": "3c6f060a3704d43c31f61bcfee0dcdd5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191196, "uuid": "2b03d589-3d20-4650-a05c-274f6bb3ddb6", "comment": "Malware payload (Mirai)", "value": "d95cca527e3456768495a4cb89661b01910cff465e520b9ed73143dd8068db6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191196, "uuid": "27036471-f1cb-41e2-8f12-29d08a2b0204", "comment": "Malware payload (Mirai)", "value": "992b59f2ba9b4fe225002ac20e725164b3c0d611", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191196, "uuid": "3ecde95d-ea28-4b0a-af47-b35d995b37f6", "comment": "Malware payload (Mirai)", "value": "c0b791245421ec158b1f7388c7d4b90c6ad515c436be05df9ddfbe8224a6aaadae711c5d75dc5b3c8ca29632242718ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191196, "uuid": "36d448d2-5127-40db-9071-4f9a1b51b2b6", "value": "T1EE03E0C2D1B19FF2C2760C75FDDC0D852B4A27A552FB211AB69D2750F986C82ABF050A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191196, "uuid": "995b92d8-9ab3-407f-9f27-e179f4698622", "value": "768:/04CCQup1y2UqSWLrjTf2fG2iKvmtlZ8hku9q3UELon:/0TupMVLWLDf2fbiKvmnZ8h6LM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773191196, "uuid": "18833763-15cf-41e2-ae1a-de439f43c2f0", "value": 40032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773191196, "uuid": "0eca9fd4-d897-4678-b18f-391167e639ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191196, "uuid": "1692ed5a-ef30-4f00-9294-8b3f9a2cb577", "value": "parm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80574dad-1d99-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773268054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773268054, "uuid": "2d2c2edf-982c-4977-8ebb-1d0f8072ba8a", "comment": "Malware payload", "value": "9bec9a8c43bddd94323b84186de8d862", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773268054, "uuid": "d3c9e269-3c14-44f8-9c33-da15ac883ad8", "comment": "Malware payload", "value": "da01456eb3ffa855bab7434fce530053756387cd795f586f115eda486f659c16", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773268054, "uuid": "c91f682f-b8bd-4151-9612-5ee5bc954001", "comment": "Malware payload", "value": "4dd177fede480ee8f28b104e41b958e5e93dcf1f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773268054, "uuid": "7e64b2e8-1100-416b-94fb-17d56bfd495f", "comment": "Malware payload", "value": "e2cf4d19c6b3a2075a45c8f620260f770f94177763a97018fa12a57b4f3c9d723f44e3e7a5ca150570c80f0444bacfdb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773268054, "uuid": "12287e08-5287-4a3b-a9f2-e26769adff56", "value": "T17B96658FB674861348E263B5B2063973BE2BD43547998336BCEDE435319F07E4A628D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773268054, "uuid": "949ffd46-72e8-4eb5-ab1f-e6974cd9e36d", "value": "49152:5EwGibmhI80RLUhK/l9wdad04YJFH1O8eQby7r7efqm45NrSCcV5pVkUCxGF53/O:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773268054, "uuid": "8df7f266-cbd4-4a26-a5c9-17455c0b8c3f", "value": 9393152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773268054, "uuid": "b36f2a8f-3ff4-4b62-9cce-6065dc7a3b8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773268054, "uuid": "856c232f-0c05-4e6d-85c3-16c7ff03184c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bbae653-1d49-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773233740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773233740, "uuid": "79188f4d-3801-4fb2-bdf9-319e160797df", "comment": "Malware payload (PhantomStealer)", "value": "dd4405dc8a0b2bc877bdb607f4b56e99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773233740, "uuid": "05444aa8-4ae3-466a-95ba-a1bc6657cf5a", "comment": "Malware payload (PhantomStealer)", "value": "db2b80cd7be5c7548932ce10c0ee09907d9fbbfeb8c17e213d3178492fc4c955", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773233740, "uuid": "294f7bb3-e8d6-4bed-b631-2f095c4d99db", "comment": "Malware payload (PhantomStealer)", "value": "e3ceab0ba91597b962f54ba85fb42338dd7a7ca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773233740, "uuid": "6ef67aa8-8b38-4c68-9742-02c141da303b", "comment": "Malware payload (PhantomStealer)", "value": "91bb75cf93d90451e0417e50793b8e423054cd4f89ffdb16bee3003eee698826d75df28c0b73d7bf971b2bdd683e3296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773233740, "uuid": "1349d964-79d4-4bdb-b3de-68046ca8a6db", "value": "T1DA26B042B5847FFD0D701019E0CB2625BBA12CBFC863BA87750B251CBD7E6DCA26649D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773233740, "uuid": "789d1980-7255-4c27-995f-bcc173aa3f1f", "value": "49152:zk7952dNw5DgHmFqm+X4gd8AGmIGG4EaegS7JdyQPbOY32ZZjd:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773233740, "uuid": "dbe52212-2841-47c7-b45b-76e4872d1a44", "value": 4603896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773233740, "uuid": "96531f70-b5b5-4c36-a878-827f7e54d69a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773233740, "uuid": "24cbfaee-dd9f-4cd6-8da3-b52b2a0925ae", "value": "6108674530.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f546c7f-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217774, "uuid": "1b1f9520-0fe2-4d19-b677-84532b05d856", "comment": "Malware payload", "value": "5279e3bba3b73cda81c87499a2b31597", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217774, "uuid": "6e15fc9e-2b3a-45a4-9a2e-b40945616e8f", "comment": "Malware payload", "value": "dba2b7d0fddcb3ddceffbee9a8096774e7637489b15e50dd877f06546e3691df", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217774, "uuid": "11a549c0-39ef-4af2-9eac-9baf7f93920a", "comment": "Malware payload", "value": "d77988d4ffb90e18949728219cabd56fb86bf44a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217774, "uuid": "b647eb9c-d85a-4319-9eca-353e655deee7", "comment": "Malware payload", "value": "5677d6b296659516121eb9b654dbf247f457cfbf3a3dde9796a62797cb2b63892bd15dc1336f31341fe68fc742178049", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217774, "uuid": "5ed5b3df-f664-4dcd-b587-b5d422750ffd", "value": "T1D235E7BEAE169191450B4E63CD4D744CBE8612850E47BC9C8147039FBAA025FFFCA79B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217774, "uuid": "493df486-e423-4784-a69b-a6caed69aa6f", "value": "96:JmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmR:JFOlb4Rsnts3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217774, "uuid": "8f3673b4-8953-405f-a800-964220ba395b", "value": 1159727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217774, "uuid": "aae81630-bd95-40e3-8acf-3c82947315f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217774, "uuid": "3f0f013a-d186-4964-a191-26664a2a5eca", "value": "5279e3bba3b73cda81c87499a2b31597.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719acbec-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1773217778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217778, "uuid": "276c4e4d-c558-4ddc-8810-46aa2c9a7b92", "comment": "Malware payload (Formbook)", "value": "92da00abdb4ea97e890e2ea9d688b41e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217778, "uuid": "822a9076-9288-4095-9b27-33a2e70be202", "comment": "Malware payload (Formbook)", "value": "dc266cd65df56ade7508b58528c42fde8f42f203c03fa28eecdcd4893a2f4448", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217778, "uuid": "aa4b5acd-9ae4-4f51-a2a0-f25c70f4b972", "comment": "Malware payload (Formbook)", "value": "132526bfc3b69116ca2731229fa89c6e6b835ab1", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217778, "uuid": "40a8dafa-f922-4f0b-a770-1cebe759c0ac", "comment": "Malware payload (Formbook)", "value": "9e0b9ec134cffa8709b6b8976798cf02519951365c23abc7ba5d64df58e9a41aeb1aee73bdf6ddf3fe56adf2eb458676", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217778, "uuid": "800f712a-8533-4cca-bec0-8c8bdf51016d", "value": "T15E53063C3A2EE86ACDD215EC7884A864DE55B1900278C67D67E064ED85DFDCC8342B7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217778, "uuid": "896eae62-aab0-4e9f-b653-5257ccf8e18f", "value": "384:XVrLHqXeeK+1LPWCu6TZ7DLkLiIOE4CE/2r2s8V8tW01iiWuJtMwr0aa+2INW5VY:XknZO1iBoJDyFvcl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217778, "uuid": "3b5a910b-f204-4d97-8df4-2d368cd941ed", "value": 60776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217778, "uuid": "62822bd5-820a-421c-89a6-8b4e130d302e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217778, "uuid": "ea8f293f-57d8-46b3-9a91-fbd616b74808", "value": "92da00abdb4ea97e890e2ea9d688b41e.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f978ffe9-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773218006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218006, "uuid": "e3468860-b2a0-4a47-9229-c9580ea3efaf", "comment": "Malware payload (AgentTesla)", "value": "628d4ed3d7493d551b220d176c0721fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218006, "uuid": "95e44bdf-c3d1-4388-b211-7095af608909", "comment": "Malware payload (AgentTesla)", "value": "dcbfc012488a3f217631099c9caa07af55f30e225b4521cf2b231c3dde6f0a64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218006, "uuid": "dbf3f5ac-0221-4ad2-8c70-e2467cef7260", "comment": "Malware payload (AgentTesla)", "value": "4d4f3e3eba700d5a4b3e831a7f9e42fa730138e8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218006, "uuid": "da315929-d21b-437e-8a31-a2175a994861", "comment": "Malware payload (AgentTesla)", "value": "b6397b3e625cebe6ab5d921df7e01f5f94a8b14924ac45c163d230b0f894f7a445a26e01c10dcfd6ebcc89bedac98b0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218006, "uuid": "928f64df-881c-43f0-9383-350d0b9636e2", "value": "T1DA0523413E5CF487DD2029725551CAC51A623E3A2BD0032F2711BBAEA9B32D3574EBF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218006, "uuid": "631d415d-0b86-4da6-a461-e320079c7609", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218006, "uuid": "be295c30-96e1-40ce-aa98-d73c0797e01e", "value": "24576:fMwsY6HUi2l+Mvl7cNSOhofPwixb+NxiH:fMws5Kvl7ihoAixgxiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773218006, "uuid": "06a15f93-fb18-4fa5-b09e-5fa490264dd2", "value": 818808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773218006, "uuid": "221098ec-ea1a-4a46-a8ae-a51316533069", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218006, "uuid": "d6d5b717-9b26-423e-96a2-857aace953c8", "value": "Nuovo ordine n 1557.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6222ed3e-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773216893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216893, "uuid": "40cc73a3-9d0c-4c36-a846-fe167f5cd018", "comment": "Malware payload (AgentTesla)", "value": "4fd1a656691ae0b6459ed8f099d51f53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216893, "uuid": "0edf93d7-fa20-4c0e-9c2b-cb9ba52473ed", "comment": "Malware payload (AgentTesla)", "value": "dd0783ddce22bfd85c7fb95a0f69732f2631699dd1f39b14b8b34e994cac7f94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216893, "uuid": "3589cf71-3b28-41ec-ad75-54a61dbb7df9", "comment": "Malware payload (AgentTesla)", "value": "d99f5868d6239c85bd259a230512bdd0a41df50b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216893, "uuid": "ff9830de-2fef-4453-80bc-5c500ae851f6", "comment": "Malware payload (AgentTesla)", "value": "d13c20b559f44316a11df9ccbdf85a95393a01e9d43918be79cd8adc54036679326e59b371b4d4e53f3e0e32a13cc298", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216893, "uuid": "a1d697fd-826a-4ca2-b8b3-a450538edcb2", "value": "T134162AA8B18846C43D5BED31B770B0E29687F5C77D43F502E01F7BB1BAAB1D1A521226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216893, "uuid": "bccc8aa4-16a5-4455-b56c-f1c66afaf77c", "value": "98304:Ytf65UQ71cvkMxpGU1rLrQmgLK/hSTCWcin/EKvb/jvhsiF5l0fCETCtxW77YG2M:x5U6qtNZLUmgu/hSWWcin/vb/dsC5y5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216893, "uuid": "4731964d-a6ba-4540-a335-a40807260358", "value": 4171421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216893, "uuid": "c13a05f7-ba80-4760-a478-565bad7473c7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216893, "uuid": "75ab23e6-2cdf-4a4f-b442-4503771730bd", "value": "TT.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d07e52f1-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217078, "uuid": "16262405-d91a-496c-a305-044aeea61d8f", "comment": "Malware payload", "value": "97fd28f4ccdc5b483ab0ef924ca910db", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217078, "uuid": "dd6a5c27-6b12-48d2-a454-a1e41e4f85a9", "comment": "Malware payload", "value": "df0af664112ee958dd7c98801f6a2e1acd550d9cefc27af10f0e15f010e31f05", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217078, "uuid": "47d938d6-6c67-46aa-984c-d2fdc3a665b9", "comment": "Malware payload", "value": "7f5ae62828b81ddb805b5dd915f22db69f64b94f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217078, "uuid": "1155ea63-cc23-4bb1-9566-bb757ced9f8c", "comment": "Malware payload", "value": "cfee37941c0af0f6b611e1d6a3c7869d8b19434bf9aa834ffa3303bcc1077a02007229d737b5777c01312c68854ad0e4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217078, "uuid": "b4423e79-315b-43cd-a917-31893117895a", "value": "T187F39711A3FD5109F6F73F84ADB462685E36BCA6AD79D2AC1261004E4AB2F40CDB1737", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217078, "uuid": "1373c5b6-a5d8-4b79-b38b-4808f0dfe218", "value": "1536:NxP1FxPc2Y12FcI9xotLcVJNOp+Y9n4SH2FcI9xotLcVJC:NxPXxPc2Y107ohQNOsI4SH07ohQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217078, "uuid": "55b15b88-b8f6-40c0-9dce-eb0c931e0a3f", "value": 161690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217078, "uuid": "3f4e12ba-ea90-4a48-9a93-bc8467dd6d70", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217078, "uuid": "43e857b3-a39d-4d50-b968-2e107b5e9bb6", "value": "Carfax.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ce294c-1d59-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773240409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240409, "uuid": "4bbd046a-4cfa-450d-8b10-949757095917", "comment": "Malware payload", "value": "1a5ca53a1abbf680bd5c0f51618a4709", "object_relation": "md5", "Tag": [ { "name": "194-102-104-222", "colour": "#D2890A", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240409, "uuid": "4cc1b335-2bc0-4b45-966b-1efe0e5f6f89", "comment": "Malware payload", "value": "df825349958dd1963991dacb73f344fe4b0c2c2f8c6e56cd43f85ccbc8dcc74f", "object_relation": "sha256", "Tag": [ { "name": "194-102-104-222", "colour": "#D2890A", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240409, "uuid": "700b06d6-a04e-40fe-9340-b9f843100e5b", "comment": "Malware payload", "value": "f6417d460f36767b1a6d49a8477dbcb7aa5bbc5b", "object_relation": "sha1", "Tag": [ { "name": "194-102-104-222", "colour": "#D2890A", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240409, "uuid": "eeb3112e-2ec2-4b3d-a650-fa2a9f60b1fb", "comment": "Malware payload", "value": "80283b7f69b1f3deedfc414adae852898516960ac9b7948b05f2802a5c737d70ffba4cb00fcd1af3fb0049b091c09909", "object_relation": "sha3-384", "Tag": [ { "name": "194-102-104-222", "colour": "#D2890A", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240409, "uuid": "c048eaad-c072-47ba-947e-03e1bca00d2b", "value": "T155F52247A3E176E2D0B56332FDE732531731B4DC9B6A0F0F1688A078198F1C95AB179A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240409, "uuid": "729fd638-e2a6-44ac-bba3-fc03fa526987", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240409, "uuid": "fbe4daec-1da0-4a66-80fe-8b346fbf811d", "value": "49152:gJQRJQki6GqsCdtYHfmW3pLYD9WFib7nMaNsDrJzTAf2u2wn:g2R2ki6GqsCAHfmwUD9WFsQaNsDrin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773240409, "uuid": "5759287b-c435-4995-8a33-e1f0176bc4c3", "value": 3595774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773240409, "uuid": "7fa2644c-9ee2-42ae-bcb3-2a0da7714301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240409, "uuid": "90574ba7-7ff0-4caf-a009-0c9d29b6d960", "value": "Setup_Installer_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4147aa18-1d1f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773215550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215550, "uuid": "4a7f3bfc-64a2-4a97-bbd9-da6a8899e89c", "comment": "Malware payload", "value": "fc9f569e35d88a670303b74a8c8e2d14", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215550, "uuid": "f74792ad-6dd2-4678-b3c7-2f74c3358bd5", "comment": "Malware payload", "value": "dfa60becadac44be08d830eaf41e247ea1c58746a21fdd3c176cb99d7b919591", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215550, "uuid": "db941672-48e4-4f87-b9f2-4968b78cc8cb", "comment": "Malware payload", "value": "4705c2337e122514366a21ab138c6078886fd69b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773215550, "uuid": "f7bcca42-8c8a-4d52-81c7-82e45155a0de", "comment": "Malware payload", "value": "b7502007c74b1dbd757e481c86d78476cf11c5c4b78f91cfd1b7e9b6b22c7be446af71ee5843a9a2e273c3141dd74491", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215550, "uuid": "33af3277-2c24-4aa8-ac9d-1da215aca290", "value": "T107C580710E56E5E8D5289F0FDEB057221368216FE845CE6A33408F8DDB609D91E3BEE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215550, "uuid": "446154aa-394d-43dd-9ce9-12cc7e83a58a", "value": "3072:Hy1eLobbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbP:Hy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773215550, "uuid": "b32403f7-bff5-45fc-8a77-17ec3f6329aa", "value": 2585838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773215550, "uuid": "c66d083d-17d5-46a9-b468-30f0282162f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773215550, "uuid": "e427553b-a406-49ad-855a-61c2f8357a6f", "value": "Activity_List.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c3ad42-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1773217141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217141, "uuid": "c61df3d6-b35e-45f4-8a69-f80a78b47266", "comment": "Malware payload (PhantomStealer)", "value": "eef38cea7bcc276d5c182520097ec6a7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217141, "uuid": "838be200-a45e-4b07-9ab6-fc793c68223a", "comment": "Malware payload (PhantomStealer)", "value": "dfa691e5dc2f578881a1c9f1179a72db9fded86efa179fb9834d0695cfd60b5f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217141, "uuid": "47661c4c-8e31-4e7f-aa1c-0d6b223f8452", "comment": "Malware payload (PhantomStealer)", "value": "630050e2c2f7ab5c7de0ca5d3763c9a61f1bbcb3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217141, "uuid": "8fa0b192-9e63-4fa0-bcb5-54ca56a18cf1", "comment": "Malware payload (PhantomStealer)", "value": "21d67c24821965bd33ac748c0cd9aeb86553a7b30fbf4d32c62eacbc87b638a0928729806c4428f4fa4648d03486e472", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217141, "uuid": "cc5d8216-f1c6-42af-8a74-d76bfb2f47f5", "value": "T14626BF0E94C4275959645B09A1FAD3521A503B0B8D3820FEEF2E7E8CBF76540FF5B18A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217141, "uuid": "962e4f87-e651-4b9a-86a3-c1535a77da26", "value": "49152:2O89Y8/ysQRmFXXbFGckjZuufjpPPeb4Sqqrj6wuCaTayoHRR+WFdB/P5iKRa+b+:F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217141, "uuid": "5d95b65f-58c0-46aa-85a6-3ab0cf8a1704", "value": 4612567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217141, "uuid": "533ea3da-39ff-45bb-a24e-9980777ef26b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217141, "uuid": "92b68b8d-ef03-4e5d-9200-91f3487dbfa1", "value": "eef38cea7bcc276d5c182520097ec6a7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa2c055-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249898, "uuid": "3bdf59a1-26f9-4f02-b7a2-3b8f9a974b51", "comment": "Malware payload (WannaCry)", "value": "0e3f9aa490adba6cbe5f6b5a5035cfd3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249898, "uuid": "6027dcdd-7e25-4321-9e6c-53c7443e5e6c", "comment": "Malware payload (WannaCry)", "value": "dfb799b73e1489d6954bfc69424f6b8f5301b3c24a97f1192d6867d4911dc3f0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249898, "uuid": "110973ab-e66e-4dc5-905c-fceb69ffe661", "comment": "Malware payload (WannaCry)", "value": "c03af6b0071b8af4663900fd37fa4c3bdadcf700", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249898, "uuid": "95aa22be-be33-4546-a648-f4fe8f46dbcb", "comment": "Malware payload (WannaCry)", "value": "d8e5c182ef8d1cb77d8fe6be03944b8d049a2c66e73c9aff09bafc9b23f4bfafa4c584900d5a3499fe3f595ae95964d8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249898, "uuid": "daa42754-5437-4f26-98c2-acddc290adbb", "value": "T1C7363359713CD6FCD10619B404A7CA63A7F33C5A16FE6A0F8F4089A61D43B59FBA0A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249898, "uuid": "f55985eb-84e3-4de4-bd6a-cf462cb616fb", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249898, "uuid": "ac6beead-0fa1-49d0-a199-aa9a40bafe52", "value": "49152:snjQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhn:M8qPoBhz1aRxcSUDk36SAEdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249898, "uuid": "af29ce36-a65b-4c5d-bbc9-7a52ef346258", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249898, "uuid": "078c452f-81aa-444f-be43-80e2315cbf1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249898, "uuid": "a88a8e72-e4e8-4254-be5c-85f691786457", "value": "dfb799b73e1489d6954bfc69424f6b8f5301b3c24a97f1192d6867d4911dc3f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b5274a1-1d4d-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773235243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773235243, "uuid": "e910d3c4-d9c2-4ac3-8ba1-bf2223167978", "comment": "Malware payload (ConnectWise)", "value": "fdb1ee16fb669677092981543febbe1e", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773235243, "uuid": "039d3bf2-373f-4623-84a1-602f4b5d07b0", "comment": "Malware payload (ConnectWise)", "value": "dfd0bf6331e7c57ae85798c0b48c35e19bd699163ffbc0dbeafc9607ed413063", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773235243, "uuid": "c966d62d-ca08-4bd9-8dd1-856173257280", "comment": "Malware payload (ConnectWise)", "value": "11f9c64ea04ffc2beb2206ae21b7eeba9d92bfd9", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773235243, "uuid": "f32b00cc-2d9f-40ee-accf-e5d177a581fd", "comment": "Malware payload (ConnectWise)", "value": "d3f329c8a4533885a5660747fa9a6c56731b9d7662e872e0712f61c0081399b9927bf80fc3776eefaf1b835bf4ad728b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773235243, "uuid": "6cf19ecd-ff61-412d-9038-47c30b553e15", "value": "T192A623116BF8D278F1F22A39D876A0B1A5367D519E23D12E2324791E2C71EC0CA63777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773235243, "uuid": "b00cdc78-7d4b-42ef-a52b-c1765d2f4005", "value": "196608:IHxcp9ym3XltDUJVjHxcp9ym3BHxcp9ym3OHxcp9ym3+Hxcp9ym3:WGpVpsGpzGpcGpMGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773235243, "uuid": "081490c1-b160-49bc-a4b3-ea2511534dc0", "value": 9961472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773235243, "uuid": "2da53e2f-3528-4cc5-be07-6ea5212c97fa", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773235243, "uuid": "be506da8-329f-4d1c-b026-16800fc1daa9", "value": "_1_d_f_dfd0bf6331e7c57ae85798c0b48c35e19bd699163ffbc0dbeafc9607ed413063.file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad9ac02-1d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773255536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255536, "uuid": "7e6f84e1-1355-4ba1-b03c-81165a94b4d2", "comment": "Malware payload (Mirai)", "value": "6d3d7134a9501fd1db083c80e359aab3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255536, "uuid": "49b549b6-5b74-4638-8fe5-818431ed7e2f", "comment": "Malware payload (Mirai)", "value": "e03b5c0d2ad0dcaa3696ec9dcd407297be2ddf8345115a06ca66beefaa8c29da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255536, "uuid": "633cd982-5665-40ca-89c0-63343a137a82", "comment": "Malware payload (Mirai)", "value": "6429dda92304ce7116ca660e9b9b4a5556648f69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255536, "uuid": "e7f69862-1fa7-453a-8b96-a60cea69ef93", "comment": "Malware payload (Mirai)", "value": "1fa738933454f4c4acfafc20e0511734f347a9905486e9b9d739e003bcb377611e3d9370c283cc25ede7d15f05ac073c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255536, "uuid": "85b4c6ea-7fdd-4bff-8001-c3af6a007af0", "value": "T12B831B01B9828F23C1D1177AB6AF459D373077E893DB3302AE246FB46F8659E1D27A50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255536, "uuid": "33efb1c1-3cde-4a4d-bf1c-83bc68d9fed5", "value": "1536:5l+on75djsQ+xoUQlLjJFZbOTF8eTkvo+XPOAhA7Ob6tXAx9IoKD7YFbrHZ:5l+iLtXOp8YkPXGAh6ObkXAfI4jZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773255536, "uuid": "ac3f50c2-2043-4a22-b099-552a5bfb7773", "value": 87911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773255536, "uuid": "78c7140f-9b41-44f0-8b6b-8a9b1c72f779", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255536, "uuid": "a79c4ea4-990e-4f87-be3d-65682f6ace53", "value": "xdlol.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c5ce58-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1773217968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217968, "uuid": "9c5fac62-1735-4300-8b17-45456dc5bfdc", "comment": "Malware payload (a310Logger)", "value": "8c48d89a6b5de520e4256e2a3ee4007d", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217968, "uuid": "90a9bdc9-f94a-4639-9bfe-d9bcd9380762", "comment": "Malware payload (a310Logger)", "value": "e128bc040b035c39a880503f39d17a9a51f73b1ad33daf7e004b37181a332943", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217968, "uuid": "5a3a77e9-cef4-48dc-96b3-dc8919f153e0", "comment": "Malware payload (a310Logger)", "value": "5aa058e0a79239274aaecef4874fb703fba721b5", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217968, "uuid": "55659c10-4870-490f-a143-91150924752f", "comment": "Malware payload (a310Logger)", "value": "be7aed816396bfcc2b170265f6f95fc450f5eac9ca9ca31288d044e88c1523403e7a580ba7a347406d560abfe9577b82", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217968, "uuid": "c5cb8ac0-d386-4066-a4a4-2784bc46ee9f", "value": "T1C8D5D02E6EA58B78EE2C750A20F61E0DF448C759E8C7A0CF970659E34FE7216054729F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217968, "uuid": "bfa009b2-8cff-42f1-bdf7-328f04af4177", "value": "24576:gq/SoqB7fxrM4AXk/SxIPrMdQmdi07Y4pnla:y5kK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217968, "uuid": "b948487f-a010-447e-8c19-eba530a7c5e0", "value": 2819071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217968, "uuid": "a04e3fd2-b4e1-4feb-9034-b07cd36bdd8b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217968, "uuid": "0458e692-3987-458f-b36f-9b0afa3f971c", "value": "8c48d89a6b5de520e4256e2a3ee4007d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89f373d2-1d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773256474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256474, "uuid": "eab0d935-a400-4050-9cbc-a9a08b21b1a1", "comment": "Malware payload (Mirai)", "value": "26039b019ff39e5fe8e27874f7eca85d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256474, "uuid": "275e680a-bca6-4215-ac37-07a8c347f280", "comment": "Malware payload (Mirai)", "value": "e1d882296b1b877033774ad5fc9d7646c4cb075e796e6d719b56daf62ce98d77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256474, "uuid": "dd491e36-b041-4e96-adb2-3c2d6969e43a", "comment": "Malware payload (Mirai)", "value": "98a403dff561e5ed886b0a307134dea3f0521598", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256474, "uuid": "d9a480e5-1b5f-4486-b83b-d78d2806dacc", "comment": "Malware payload (Mirai)", "value": "ab28d67f74c725b724a9870f609aa907e4b3e15f6de23de641a7b23902fa3582c3b0366078dbc3649c006dafbc71b1cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256474, "uuid": "89b3fc35-2a40-48e0-b66c-f75d870b0a7c", "value": "T18493D506BB650FFBD86FCD3746A9071239CC550A22E93B3A3674C91CB51B64B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256474, "uuid": "91278d32-2680-47ed-a6ea-0ffe3c140b62", "value": "1536:lX1tMe0R/thi6DZEvPgaLiVw0FmWnM9kyXZLHLQq7V861yMRVz8Z:lltMe0R//FEp5Wn2XvJVVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773256474, "uuid": "8f0b9871-612b-4032-bbd3-3475e47d69e0", "value": 93464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773256474, "uuid": "e5b99751-bbff-4742-af31-d38146f878ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256474, "uuid": "ee9b7eee-6d84-4a77-a178-f89c8b74a08e", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9108f1-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217961, "uuid": "0cac502f-9ae8-4d15-bfea-4c381c48ca3e", "comment": "Malware payload", "value": "7a47b7c55f98dea99e3f6ee2a0bb12e6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217961, "uuid": "051c9902-3387-4170-98bc-54e5e5974785", "comment": "Malware payload", "value": "e2112a9c2118d28e65d8ca0f4c3ec8cd3922ebd3f7ce5b47f6ddf5cf3b128541", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217961, "uuid": "bed33021-a3de-4454-85d6-c373a903f028", "comment": "Malware payload", "value": "02babda5a264e1e69326ef3579543cb06d57a19b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217961, "uuid": "58606b94-1deb-49b0-9bf0-686be8d99a17", "comment": "Malware payload", "value": "a760561735e3c7ecc666070eb9865999061eb25bb2fe3a73d5c68e9d5a16d4fc2c9735c9ea5ab9cb727498d136b4bc73", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217961, "uuid": "5682fa80-ca14-4106-b96e-fb06e1d1253d", "value": "T1B435E0B9B429EACBA9D6C3B00D2937E57F530445ED57401866794BFEC2C3803BA98E71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217961, "uuid": "22802b0e-2d20-4d20-9c96-2fa51328ab88", "value": "96:tufbkg3jlPMkrLGPCMmjQEPxQE9S2fQza5eIudy8PVeArzLySIFo55TX6ut8jarB:tKTBh9z/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217961, "uuid": "3e3eab23-f98d-4bd9-9fa9-9bf6d5b8e0a5", "value": 1150196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217961, "uuid": "e59e2584-d8d7-430b-a5c3-24044fdbf29b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217961, "uuid": "a392d0e4-f8af-4f20-9cb8-d192af1eebe9", "value": "7a47b7c55f98dea99e3f6ee2a0bb12e6.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74d0088e-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773217784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217784, "uuid": "bf2d5c06-2d97-4276-877a-6d64783ace77", "comment": "Malware payload (AgentTesla)", "value": "8b177c15d1eaccf968fc5851489f7f9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217784, "uuid": "3e8bb93c-5c62-490c-97ee-3b02b32c60c4", "comment": "Malware payload (AgentTesla)", "value": "e25ef4745b81a06cbb940654a6295ce1d2d51d7c073be604129bd4700d504512", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217784, "uuid": "a8d24bd4-8734-4369-8a11-6266c0ba1ec6", "comment": "Malware payload (AgentTesla)", "value": "d6e6534664f32c4352b76b4f2ab450fce2bfd0ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217784, "uuid": "990c4948-6b8f-485e-b437-868ff886d5b9", "comment": "Malware payload (AgentTesla)", "value": "8683a89b7c41ede34b652cff3a81bb54d8a288c13ae08b070a43b1bafb8337ef48818580f79eebf9dcbde2f2a83b9869", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217784, "uuid": "437309a0-62b3-43f5-9582-2d9d83a1771c", "value": "T109D2218D6EDFB528425A347B2D6BB09AF52E8C4C705C805CEAE71CC2F89E709C47B564", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217784, "uuid": "07b2e775-0149-483e-a675-87032215912e", "value": "384:TQA3dcP+qBoaMModBG8REafOHlmm9O5vPsKbJhCKjtWVyUPMf/1M:TQEd0ZBXMMolCSOHF9wbJhh8yAUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217784, "uuid": "b61ce5c4-2262-4072-818e-5b46deb56579", "value": 29892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217784, "uuid": "29bcaf30-cfe1-4a73-b38a-72d15466ee0a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217784, "uuid": "f84ad28e-2ccd-4a6b-a607-d2ce55cc6cd6", "value": "8b177c15d1eaccf968fc5851489f7f9d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d9bda2-1ce6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773191289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191289, "uuid": "416a1e8d-0dbe-4819-adb8-e174522f6ba1", "comment": "Malware payload (Mirai)", "value": "d2a04f909d0628bde3b606b643975820", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191289, "uuid": "76bae222-c6f6-4418-9fee-6bddf6135d28", "comment": "Malware payload (Mirai)", "value": "e263164bda5eabffd2b58639673308262ddb75acd83b70dd873774922fbf3fa0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191289, "uuid": "ae48c816-2c4b-407d-b65d-d80d969f6643", "comment": "Malware payload (Mirai)", "value": "3c50bc05b730449992718b61b4cf875eda035337", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773191289, "uuid": "bbf9f70b-8200-4210-ab0a-ed87b58a0b72", "comment": "Malware payload (Mirai)", "value": "1b661a4d84e09041eef5fd5e65859efd4244d4234fc41c2e0323724c22003eee39961fa62c58afcb7d6cbee56de5f391", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191289, "uuid": "0a893485-57ea-4c3a-b8ae-12c7b7466379", "value": "T1DCF2F19A88D45980C16E1739203FFD0A3680FCAFE195CD9ADE98313E80C478961E80FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191289, "uuid": "8fba00c2-57df-4e15-b98c-b8ff08d89946", "value": "768:/T7+FNO23h/S0ZK/B8viBryvvyIB39I1lyqwlW0RnbcuyD7UtQRjU:/TAIokaA+p3Clyi0Rnouy8tyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773191289, "uuid": "9268cb2c-2ce7-493a-a742-c5d1b7c00556", "value": 35256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773191289, "uuid": "8ce9c9db-37ed-455a-ac99-15596113410d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773191289, "uuid": "1309b1ae-559f-4e00-91f9-3d18a33b152e", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a62c7006-1d8e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773263393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773263393, "uuid": "b44f34ea-d94d-4592-a451-f4de4225d076", "comment": "Malware payload", "value": "97d7e925fa706e94e74986ca116baa53", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773263393, "uuid": "812fb3a8-e8e3-408f-8936-5b814e63ea3c", "comment": "Malware payload", "value": "e27ff6646a2f98b81ea5da4d0d93127f0f3e68a5e6728f404724e388376ede84", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773263393, "uuid": "3b820d27-d15e-4d45-a64b-c839473bb48b", "comment": "Malware payload", "value": "864c8e5c8b35259b3c1bba92b3cd082c53179105", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773263393, "uuid": "a40fb57a-baf2-4cbc-87fe-8f7f7d236984", "comment": "Malware payload", "value": "359f46788eaa73ff59845ebbd3598e3b01e4ef2d9327488a8e8ebc9c067dd4d6ef9eabe22bb9670d4a1934b16f18dee8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773263393, "uuid": "cdff6b68-b1b3-44ff-a483-051340e9c681", "value": "T1E3B3019D098E8CE9CB1F2028551F5D0B998EA3130B1DC9907BDFBE553F22CB571AA9D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773263393, "uuid": "60dc8c72-62f3-4b37-ab0c-4b67f2172a5e", "value": "1536:iAAx4vi7h/VNAOAV1uhy8iSPJ8rfznbj79ubTF3F:+DU1u2znbjxubTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773263393, "uuid": "3bc48f79-bb0b-40ed-b36e-dfd6506bfb90", "value": 114641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773263393, "uuid": "f3935657-96f3-4fb0-abdd-55551f9d3043", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773263393, "uuid": "e434601b-57e2-46ee-aaa3-2a45816a74ed", "value": "Summer_Data_Primary_44.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15108cbc-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249835, "uuid": "e23fab2b-ae79-4701-a916-6467916c3bfd", "comment": "Malware payload (WannaCry)", "value": "b4a17510a25f8861b47b8c7787d87d37", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249835, "uuid": "c447280d-203e-4c7a-ba90-c7cefdaaacbb", "comment": "Malware payload (WannaCry)", "value": "e28f18e279740ed19bfd607afb1750ce1158579ca6e20d2ea5133f06036e92ec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249835, "uuid": "30449e37-e5bb-462d-936a-76c2912b2f33", "comment": "Malware payload (WannaCry)", "value": "10404f4cba79ddb2a923142b5775112fcee90a80", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249835, "uuid": "a4df793f-f30a-4e44-bd85-7d4efffcd615", "comment": "Malware payload (WannaCry)", "value": "f9bc60f1cd888d8d9465ad6735d3e1fd82371e8459a1929ce3bfafa410b1fffd1dcdfdef6861a9fdb349a48199ad8124", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249835, "uuid": "cd0386c2-3405-4f6a-baa9-3a327b96bb00", "value": "T18436239A75AC90F8D10A77B4A4778B26A2B77C6D21BD9B0F9B808B210C03751FB54F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249835, "uuid": "4ff7766a-11d5-4d6b-8f94-233554059000", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249835, "uuid": "f9d36ba6-81fe-4705-8b76-530e7a974389", "value": "24576:RbLgurgDdmMSirYbcMNgef0QeQjG/D8k:RnsEMSPbcBVQej/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249835, "uuid": "e576d6e9-9446-4d10-9d74-57f2fcde6714", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249835, "uuid": "795efc98-4f50-4a24-bef5-5aa7f83011fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249835, "uuid": "cc24c265-1ef4-4312-a0a1-26116fc99de2", "value": "e28f18e279740ed19bfd607afb1750ce1158579ca6e20d2ea5133f06036e92ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67c9c66f-1cfa-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773199723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199723, "uuid": "ae860888-8345-4e47-bfce-3dd4791bfdc8", "comment": "Malware payload (AgentTesla)", "value": "5550531b551ca7a6d8f0266b630667c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199723, "uuid": "fa2b187b-06ae-4f25-ab8f-e78fd38d5ee5", "comment": "Malware payload (AgentTesla)", "value": "e597c66d16e8a630ddd7736d61d45c53d38e5696c3c3ebf82ca2ca9e6b20bd38", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199723, "uuid": "1b60b5a4-998b-43ad-8819-5950d4c4bff0", "comment": "Malware payload (AgentTesla)", "value": "076a2be516fb164413bb8a98ee7eebc3f23eb60d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773199723, "uuid": "60311a68-8520-4c46-8ea9-ac923c18fa88", "comment": "Malware payload (AgentTesla)", "value": "55d802e0f13eaeb7e6200de66b65bb81c0a2b129f1a0721e8f27a30a3ac9f3a63a7e16fcab1978323d4086cc93be5301", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773199723, "uuid": "6d2912d5-c07b-4fda-bfef-cc01bd4f39e3", "value": "T10055BFC6E9813FFFAF2B6605507D77DAC398FBD9CDD2487EE4119982A7B690086460C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773199723, "uuid": "5f7c8e35-ddc4-4a68-a95e-800cf55cab4e", "value": "24576:2vICW0N3G51rBUBW7tP+QJPU0has/6vFlRjwMrSUz:2vIWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773199723, "uuid": "b516ab96-d77b-4376-835a-3b79bdb37b83", "value": 1344243, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773199723, "uuid": "480e743f-693d-4555-a7a7-2bdadaf8a6cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773199723, "uuid": "6f8db2ef-abd6-4be9-b05f-0efa8c512d2d", "value": "Document.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25018bee-1d74-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773252009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252009, "uuid": "8380e094-a362-4d49-b033-178e08a59f6a", "comment": "Malware payload", "value": "8d6f7839ce7455f317375c7be1039a1e", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252009, "uuid": "100b2c9a-0f42-4265-9864-5f81fe66feda", "comment": "Malware payload", "value": "e5be1dbd0f0e5a03012c204aad6e2adea2097b8d3697a56fa6bb13455fd329c7", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252009, "uuid": "b3dd7e79-25bc-4094-b3e1-163f269a2ef2", "comment": "Malware payload", "value": "aa7e919a915acd171926509afb7de2f4ae225f25", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252009, "uuid": "317e5807-02d3-4274-a8db-9f4695239aec", "comment": "Malware payload", "value": "a7f18f1bf75f705e1c89608f16691702d4f13280bb6a427309719bdda7ce240681955b51914b319249fb67011cd673f3", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252009, "uuid": "c78c0763-97c7-4ede-b370-fa927c780c53", "value": "T1E7462AC4A54C8A9CFC176D757FE0B4E046C912DBFCC5E012E59F66B1BBA22D1D836222", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252009, "uuid": "e8c783d3-8b79-44b1-9b1b-545eeff31dab", "value": "98304:Guo2FoBr62+RZfrO8LoMs2UMBuNH2FTnsrlQUIx25B4fisZF76parTe3pwcsCepj:Guo2FoBHaTO8LVs2HeH2FzslQUF51s3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773252009, "uuid": "ce137ff3-a13b-4105-b9bd-1280473fc73a", "value": 5865472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773252009, "uuid": "ea4900b5-b3e0-4d0a-b878-a1ddb2ef53ac", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252009, "uuid": "94f0c6ee-c6c7-4a28-871a-be1dbfa04972", "value": "nTHISTLE_SCIENTIFIC_LTD_-_Purchase_Order_PO025976_pdf______________________.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fe54218-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249827, "uuid": "c3ece709-64f3-43dc-9dfa-b33d669aabd4", "comment": "Malware payload (WannaCry)", "value": "83e967e52508f5e1b5cfb279d86ef3c6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249827, "uuid": "55700a99-3069-4316-b918-a82de748f6d4", "comment": "Malware payload (WannaCry)", "value": "e6179acea8f5a1b82d143ada41e08eb94225df8f7dba52a29082357d7c6532ab", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249827, "uuid": "2f9bfb6f-3905-45bc-ba61-cc8ebe7192be", "comment": "Malware payload (WannaCry)", "value": "ad03e572ad83667265f5b2571b6ae691c24c2290", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249827, "uuid": "832c5803-4dd7-4b02-a3c0-506893299537", "comment": "Malware payload (WannaCry)", "value": "14afd6ba41109daa283eb8f6d381176b57e08db09a16d50f2c5330d4d064ad16c781090399fd42a6ac66c8e613152bbd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249827, "uuid": "0616c683-0ff0-454c-91ad-edd1137f087d", "value": "T19236239935AC90FCC50A66B4A4774A25B6B33CAD31BD970FEB908B610C03790BB64F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249827, "uuid": "b04dacaf-d493-4bee-98ba-6a460f75e95f", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249827, "uuid": "a0ec77f7-fbcf-4c70-bae3-65d9f15f61ab", "value": "12288:T1bLgmluCti6HhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+DHeQYSUj+:RbLgurishfdmMSirYbcMNgef0QeQjG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249827, "uuid": "fe313ee3-6ce6-49a0-af3d-b35dad84b2a1", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249827, "uuid": "412386b2-d073-4a7a-b8b1-809e631afc4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249827, "uuid": "9d9736ce-2522-4445-8cb3-ee430eeccd64", "value": "e6179acea8f5a1b82d143ada41e08eb94225df8f7dba52a29082357d7c6532ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be15fcc-1d18-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773212695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212695, "uuid": "4655eb19-2c2a-48f5-b4a0-23f4caa5c9b1", "comment": "Malware payload (ACRStealer)", "value": "0052f4f8ce7c45cfd10165ffd8fd044f", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212695, "uuid": "b0352830-7e7b-4e3b-bd11-793f9f6f7177", "comment": "Malware payload (ACRStealer)", "value": "e691dcafd1d329091197791751faf5a54ea531b2314ce60ed962bf82839d3426", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212695, "uuid": "1110dc86-9da4-4ecd-91b1-b8ed4583aad9", "comment": "Malware payload (ACRStealer)", "value": "f87080e76461d1a6d144ae205f08dc0ad891e0f1", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212695, "uuid": "1e5a2b7f-dec6-41b4-867e-85221dd5e2cf", "comment": "Malware payload (ACRStealer)", "value": "70d819fd61409ad322f87e7a81773b4221f67d95f0f3afbe177d27572732fc3c881b4699255649bf57ecbfc59a44add2", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212695, "uuid": "b09dc013-d2c7-46d0-a4e6-0b5d11c982c4", "value": "T1C9451210465A531EDB6AC77A15072FB4576CEC1AEF8783EF9AC9EC203D0A6E00535EE1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212695, "uuid": "23ea8b32-9cd9-42e7-aee9-7cd681cc220d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212695, "uuid": "43430fb0-6c8f-46f3-ba6e-9a18fd480ca9", "value": "6144:YQyIx9N6lkOx58ck4LH2f813D5t24jSm9IP9BeVyA/WA5QaUned2woS:YdIx9N6f2E13toxFBeVyA/W4oeE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773212695, "uuid": "70fb6af4-2b6a-452b-877f-7f8627e07df4", "value": 1250816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773212695, "uuid": "5fe5b6f7-e1d1-4f24-88d3-d8c31322dfe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212695, "uuid": "0c826784-dc5a-484e-9537-fd29eb805228", "value": "e691dcafd1d329091197791751faf5a54ea531b2314ce60ed962bf82839d3426.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60be2703-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1773216891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216891, "uuid": "da4a92f3-b873-4169-aae7-f028c74c8ed0", "comment": "Malware payload (AgentTesla)", "value": "efb7cf645c42a084bdec091eecef0604", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216891, "uuid": "ce55bd69-c77f-4f7c-8c2a-f5695ce021b1", "comment": "Malware payload (AgentTesla)", "value": "e7549e1c7f917f70f5d6c06e798c00eab54ee1066d15c5817a29b92189678eee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216891, "uuid": "20b9c5a6-3815-4069-ad09-a79e3927fb3d", "comment": "Malware payload (AgentTesla)", "value": "d3849cb85adad7cc79e7113eff0d770e29ec4897", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216891, "uuid": "6ee00710-db8b-40fa-bafa-6cb1b2f89a90", "comment": "Malware payload (AgentTesla)", "value": "b703a049c05b82c2726629229d91a6f83c6bbe9d5dc5197a33874c854f24a9a7a21354a04f9aac97547d82f738377d3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216891, "uuid": "36567788-6bd3-4834-80d0-6427c19a6133", "value": "T10AC57EA7FE67135C4BCB2807E4E6D197B9A094BA95BF10A7B2787D21E8410CDF045BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216891, "uuid": "262a3688-6414-4a45-87e2-c38bb741e019", "value": "24576:IS2QJq9OZto492FNuNMS2QJq9OZto492FNuNL:pxkaxkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216891, "uuid": "c09da4f5-e961-44dc-ba34-a4936ced9ce9", "value": 2670410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216891, "uuid": "a5bea434-1a02-4d6c-8d08-43739284b1f0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216891, "uuid": "cf79bb14-af31-4ce1-b5be-f46e88fe177d", "value": "efb7cf645c42a084bdec091eecef0604.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f84f470-1d20-11f1-a769-42010a9c0008", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1773216110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216110, "uuid": "3f383913-6865-4c21-8311-0e75399556ee", "comment": "Malware payload (SnakeKeylogger)", "value": "3d028ee5e2b0eedf00417d0ec78e9352", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216110, "uuid": "f50a4531-88f0-44df-b2d6-591e6590a3dc", "comment": "Malware payload (SnakeKeylogger)", "value": "e83039c747aa9f67494b6685cf5b53ce9afd955d6f4b0355c85a224c5c2e3ce8", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216110, "uuid": "a389de90-cc72-439b-aab7-34088e9bd8f5", "comment": "Malware payload (SnakeKeylogger)", "value": "da8e2236648126d571cd0ef5ae807dc97a65b740", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216110, "uuid": "92bc9597-a4fd-40ee-8628-d9cbd0e886e3", "comment": "Malware payload (SnakeKeylogger)", "value": "179fbbffd596a50a759f2ada277749799a94e8e54250e84fa0f24bfd15e02d57f45c2d4ddc0793f3f8482571b448b45c", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216110, "uuid": "185d46b8-a838-43f7-ba0e-5148aa2b26db", "value": "T10145D6724A0C4C3ADA7C28CFB20145155E7D56C374B99EC58F7CA8DDDCB2293EA1AA13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216110, "uuid": "2f9b6001-7dfe-4b8e-bd04-c66b6be21636", "value": "768:bo/XPb/PL0o9G/odpop7oYDo62oAYod4Q09cY0Qi27Qo2ZgXKoBYrOOloXYrEgfj:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216110, "uuid": "aef57290-098b-40e8-bcf9-8cfc086b8459", "value": 1232827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216110, "uuid": "d2a7e2cb-ca8a-4d44-a4a8-1454ea31a3e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216110, "uuid": "3e5bcf19-6310-4c14-a711-2db0091d37f9", "value": "3d028ee5e2b0eedf00417d0ec78e9352.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d301a16c-1d19-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773213217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213217, "uuid": "cde21c99-6285-4587-a0ed-42840be5727f", "comment": "Malware payload", "value": "3ce159ca4d57e62e17af95afe6b37274", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213217, "uuid": "d968a108-75b1-44a0-bedd-10115091f04b", "comment": "Malware payload", "value": "e89907c7c2b255b97ddb1a19bd7f8ade171d4be2554eabe7f0cc767884f598d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213217, "uuid": "c875587d-e8a9-4af1-8153-6f192f591667", "comment": "Malware payload", "value": "10cced8f0c580cb8d8ff6460ed69741efcc5fd68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213217, "uuid": "675c05fa-e82d-46a1-8bf3-bdc68694fa53", "comment": "Malware payload", "value": "7dd45d26ba4f2947edda94f24b3b506496983a0544c8c40d82d94672432950974a902c804a28532522c5b3433572a689", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213217, "uuid": "9089adb4-a499-403f-9a80-92155a7eb9e6", "value": "T1FE04D763BA8049BBD92C523E80E1CD04B43FB279072395D72D82165AC65DFD12D3BA6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213217, "uuid": "79310172-7ecd-4d61-8986-d603da419793", "value": "1536:xG1OAMqG1PgigcbCWULEpBNETI+BSPAqDgVRD09KV4awiMYE54wRpPVyh8vweDnA:x9PPUnSKaaNUpP143vNjy/mxRL8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773213217, "uuid": "243faf88-486e-4629-b336-e028b97eec77", "value": 178534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773213217, "uuid": "a19b5cee-bfe6-4390-8d65-b411a2e5678b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213217, "uuid": "ab426f30-ef38-4e3b-995d-ac99f3f7d732", "value": "3ce159ca4d57e62e17af95afe6b37274.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0539156c-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249809, "uuid": "13fdfce3-3d13-4cdc-9df1-ded31d82fe34", "comment": "Malware payload (WannaCry)", "value": "78ffe2876dc2300812287c7165111b74", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249809, "uuid": "e60bc84f-5d9f-40ff-8ca4-4a9aa43df5f5", "comment": "Malware payload (WannaCry)", "value": "e8d57e94ed6321c0144baa3edc7ae0fcff5cc9b08206082d59b0f1d0ec4f5e05", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249809, "uuid": "5588ac26-7b3d-43df-a24d-9c144809dd59", "comment": "Malware payload (WannaCry)", "value": "54967ff4fc8201fee8f174351eebc09bfe7bbcda", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249809, "uuid": "d6163f64-b15f-4985-a9ab-3810d36f7217", "comment": "Malware payload (WannaCry)", "value": "fac0751523fa6052f33e8109723022cd12adc12b8e9e82e64b0f57d81748b5a59a70cfe413aad0827fdac1cc6bc133ca", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249809, "uuid": "d7197983-9e32-461f-ac40-37b4c53b9d9d", "value": "T1B5363354622CB2FCF0450EB44463896BB7B33C6967FA5E1F8BC086660D53B5BAFD0A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249809, "uuid": "7d6b3423-16ba-420c-b694-52a6ac4b253f", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249809, "uuid": "70f22116-91f7-4da5-9a90-9b77963a0975", "value": "98304:TDqPoBI1aRxcSUDk36SAEdhvxWa9P593R8yAVp2H:TDqPn1Cxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249809, "uuid": "d2c52cbd-2dc5-43f4-ad6d-ceeefc920180", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249809, "uuid": "701e5618-c060-426b-8bdb-ef002938069d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249809, "uuid": "680e0a85-1eff-466d-a964-b2004524d879", "value": "e8d57e94ed6321c0144baa3edc7ae0fcff5cc9b08206082d59b0f1d0ec4f5e05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16556c9-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217993, "uuid": "f09275f3-ef05-47e2-b4bd-1d0090e234ef", "comment": "Malware payload", "value": "02ec22eb6c261196774b28730e3ed39a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217993, "uuid": "ca683267-005b-4d25-94ce-98a14e249d0d", "comment": "Malware payload", "value": "e90efd197ace2771c7093d638a805cb303ba79537ecff3d0b52b83c3dbf8dc64", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217993, "uuid": "04404927-bb64-4a26-a4a1-79fc88fcf29a", "comment": "Malware payload", "value": "ac7bc96e18511b573cd800c057d911a1e3561a1a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217993, "uuid": "171fc1f8-9746-4f16-84e0-44a9d74d5ea8", "comment": "Malware payload", "value": "576667f7c7d042c54aba726aa2d874938c377cb5a3498d11c3ff843c2d3a40c8407d73562348fed57d1d7b53bffdfc21", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217993, "uuid": "bed86409-c7c4-4b2f-8122-9268472e0a71", "value": "T1EF536757C54A2DFD2B469A1293C6ED5588291A323C8B8F3DA7F37CF98314594BE4E302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217993, "uuid": "520bf81e-ad3d-4d48-b305-ceadd906baa5", "value": "768:ec+ZNYBBezsFfwDg4vT1D+G9wrR5w/Wm3Qkv0:A4xwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217993, "uuid": "72937482-5769-46b0-85dd-587ca779d98d", "value": 62177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217993, "uuid": "4ad324b2-dfc1-4a32-a0a6-da5c874afb57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217993, "uuid": "c4cce942-eca1-4b51-80ad-516b54f28e34", "value": "Order_Specifications.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96c14e29-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773216982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216982, "uuid": "80ce3602-04c2-41b0-9fd4-a6684059057c", "comment": "Malware payload (RemcosRAT)", "value": "ba804e9e3b3af8e013df91ba4ed971d0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216982, "uuid": "c1668e69-4573-4aa4-88a7-0fb75e29749c", "comment": "Malware payload (RemcosRAT)", "value": "e932edb8c52434afb27ace5b4f7bc2ad3a336157cf2f3cbe81db8afa3ec35cdd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216982, "uuid": "3081928f-c570-4d17-a50e-754ba01bc6f8", "comment": "Malware payload (RemcosRAT)", "value": "dda8c1e66d018bd6d21b75fe840cc5e3921126f6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216982, "uuid": "1cf8c351-d6f7-4d4e-b23b-ab092b4a98f5", "comment": "Malware payload (RemcosRAT)", "value": "22cd8f8b828cda5f9624bfe8b458f39d3df817953c8ab3d487e6a2a924e7eb77b432f6d1f3f38e3714eec6cb99fd1881", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216982, "uuid": "e9a9d52a-3b7a-4477-8d1a-8db04bd23ca7", "value": "T1AFD241CD79C6B16883013033A95FF49BF13F9C816C9CD958D9D5B898A8A4B38D0B587E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216982, "uuid": "4ab6efd5-07a2-45ba-a536-015950e1ddba", "value": "768:rYCaidY9UL3nmmFbrfMwFkkIplRDwqbOfihoiL:rYCvLmmFtS9/RMqaaho4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216982, "uuid": "db4d808d-ce21-415d-b097-e93dad9ea877", "value": 29130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216982, "uuid": "889eeed7-817b-45df-831a-b50503a03ac8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216982, "uuid": "d0a75150-b003-42b2-bf26-a7134e74ba36", "value": "ba804e9e3b3af8e013df91ba4ed971d0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aef9e731-1d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773256536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256536, "uuid": "f6b7d89e-d845-4dc6-9efb-3c49258d85df", "comment": "Malware payload (Mirai)", "value": "77deb35d23ad7982204675d68b1ebb7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256536, "uuid": "51e08fde-da2f-43da-a98b-9b0300774349", "comment": "Malware payload (Mirai)", "value": "e965f80d8e7e41432b4de49b941cb73fc4df1b1f5ef2b640930f5d065e337ef8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256536, "uuid": "3fabc0ab-b1d0-4aa6-bd90-d2cb6241b89a", "comment": "Malware payload (Mirai)", "value": "51ccbe6be9a4974c12ac222b23da03a130e55050", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256536, "uuid": "9aab2dc9-9def-49dd-9bd3-e830b2660f44", "comment": "Malware payload (Mirai)", "value": "1f63466f97d51a4d15ccada3f26d354355b2fdb21ee91b6e332aebd21173221d22a825450fa7c16e2200852e9b076673", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256536, "uuid": "ac336b27-7ed6-43dd-ad05-71db784b98bf", "value": "T17DE2F18A88D8AE0ECB6553BC956EB780FA15A5A42F5F53016ED5CCC2A8033F5F131933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256536, "uuid": "0823f3f9-8d6e-4466-bfd6-1e46ae1dd16a", "value": "768:WBbVkTrCrl546JCSVO0smsL0AjDTK1xtltOn:KpOADsLjPK1xM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773256536, "uuid": "6a04b0f9-6792-436a-89c0-8351f680386f", "value": 32276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773256536, "uuid": "77e845a0-001d-422d-ad30-6c555b1840a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256536, "uuid": "b8734c04-dc90-438d-9785-2d9d303f7262", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24936a6a-1d5a-11f1-a769-42010a9c0008", "comment": "Malware payload (ACRStealer)", "timestamp": 1773240842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240842, "uuid": "2ce4b177-1aa7-4c56-bedc-994314c137ff", "comment": "Malware payload (ACRStealer)", "value": "078302a2de374e5dd4a4426d89c595c8", "object_relation": "md5", "Tag": [ { "name": "45-150-34-180", "colour": "#D55A1E", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240842, "uuid": "6cfabf88-dbc0-4e0e-b81a-a723f5786579", "comment": "Malware payload (ACRStealer)", "value": "e9fbb7b8229e0d887460503b0e1c20a9c190bffe7d69e4d2337aaa6d92503f47", "object_relation": "sha256", "Tag": [ { "name": "45-150-34-180", "colour": "#D55A1E", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240842, "uuid": "964cb307-e525-4947-8b0c-0dd2062432c5", "comment": "Malware payload (ACRStealer)", "value": "f16ae2d7c5f728e754bac0683189e093f03dbce3", "object_relation": "sha1", "Tag": [ { "name": "45-150-34-180", "colour": "#D55A1E", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240842, "uuid": "3b3e189e-7123-4ca3-ac4c-ef3da65f8868", "comment": "Malware payload (ACRStealer)", "value": "fd25ae2ea5fc2579eadfc439dec9635bf4991225da10b41028253b860565ac5285543f1b2d9628d5e9bd6a6b3e2912af", "object_relation": "sha3-384", "Tag": [ { "name": "45-150-34-180", "colour": "#D55A1E", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240842, "uuid": "a24f803e-f94b-4615-a16e-1f58ac46ff7e", "value": "T127954900FEC744F5E9062B3259F762AB2734A8091F369BC7EA407A7DE9B72D50936305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240842, "uuid": "9da3ea61-68c6-4ec4-9f3b-550f45676a63", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240842, "uuid": "42a1a354-7af8-4eea-9cb1-c5deb4e03164", "value": "24576:v9KxUjHvwM3C52oHP0lmeOQpdYNflRLu/Jee+q3/ty03vaHCY2hF6NpGAaTle0Rp:v9pwgQBPBQQ2wq3/ty03vai8TzaTlR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773240842, "uuid": "f9887bb3-5a91-43da-99e8-4fc38d8f19ba", "value": 1878528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773240842, "uuid": "ad438d02-0da4-4ebf-b168-6866a8a5a8e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240842, "uuid": "5ded1f11-6888-4e7d-b41f-a7e948fff91e", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12118d3d-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249830, "uuid": "f0ce0347-3179-451d-85d7-d37c0d5c0368", "comment": "Malware payload (WannaCry)", "value": "d9ccc13c368a649d11dadba466528742", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249830, "uuid": "6536eccc-374d-4705-8c55-c448e9f426bd", "comment": "Malware payload (WannaCry)", "value": "eab75ed8496c3cf143f124f7dce9ab6d5dffac0a6d1680f1c85ca193fcbf2af4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249830, "uuid": "94388d46-e2e0-4a50-9bc7-ba101a59dd4f", "comment": "Malware payload (WannaCry)", "value": "0206f9eb7f274970eb415620e814a9d9ae81a7a0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249830, "uuid": "182ec4e8-6e40-48a0-afb3-96ffb5e26da2", "comment": "Malware payload (WannaCry)", "value": "e4205f928b84feba6ed818a654aeefd02b28357bcc0e3f919130a9b6dd9d3548c156b6aa1630e1e8a7be939caf224db4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249830, "uuid": "f935297e-4ec3-4424-b057-528e97935bde", "value": "T146362396756C91FCC00666B9A4674925B2B37C9E22FE9B0FDB908A220D03750FF64F47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249830, "uuid": "9b71d278-f701-4ea2-80a7-0cceaf40f1e1", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249830, "uuid": "dd8ecee7-b7ef-4587-bf43-34cd86b723c0", "value": "24576:RbLguriDQhfdmMSirYbcMNgef0QeQjGCX6SASk:RnuQqMSPbcBVQeje6SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249830, "uuid": "f24868d3-89b4-40c5-a829-ea608a9664e4", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249830, "uuid": "f29c1516-c2d1-47d9-9526-0d298b4315f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249830, "uuid": "d6338f86-8e29-46b2-9f6d-26c410e43e25", "value": "eab75ed8496c3cf143f124f7dce9ab6d5dffac0a6d1680f1c85ca193fcbf2af4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ad42a7-1d22-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773217087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217087, "uuid": "f3999e72-c38f-49fd-a990-274b1a7f9357", "comment": "Malware payload (RemcosRAT)", "value": "6f1215f08533f1db950ff41a73042588", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217087, "uuid": "ca1afc26-7251-40ad-8b35-9bcc32cc7144", "comment": "Malware payload (RemcosRAT)", "value": "ebad49c1788b32e370ceff9aabf6d44ac1f34aba6559da9d83a5073445db33c5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217087, "uuid": "f8b0ef7e-31ec-42bb-a791-237f0f58de45", "comment": "Malware payload (RemcosRAT)", "value": "67b83e4e0e817740bfb811d11e707443895a20b4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217087, "uuid": "a120c8cd-4c03-4421-8a36-11655b12eda7", "comment": "Malware payload (RemcosRAT)", "value": "7aae4dc55ea73a5ea5608da3ed9f60ee9d3dde04a147bea6c355bdbaf961fe793a4e131cbf98963f94762a892072bd01", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217087, "uuid": "5d0ef2d7-8022-400a-8950-2a0f9c20903c", "value": "T1BC963BB32382A8471E370D90D2817A91AD263857FD6DD948F9CA37F351F8E88E935271", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217087, "uuid": "f721549e-0d29-4630-93c5-3f85e4ce690b", "value": "98304:YL5r6CiT1bjyPADJHpKs2pN+sFGg/AhUa9HkCMUU3AJ:S52b1byA5pGN+sFBqzR0AJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217087, "uuid": "8e30d5f7-a3b0-4ac4-b120-357faa34f115", "value": 9076580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217087, "uuid": "e3007447-f9e3-4ae2-b7ef-bb3b1d19b5d5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217087, "uuid": "25688bed-b0c7-4c2e-a7b5-761f39b0205e", "value": "PO-O012DUDO209282782UJJSI88122.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cfec0ea-1d4b-11f1-a769-42010a9c0008", "comment": "Malware payload (XFilesStealer)", "timestamp": 1773234413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773234413, "uuid": "a52522c8-cbf4-491b-b8fd-e3e78d0e8719", "comment": "Malware payload (XFilesStealer)", "value": "d11b0dd3786ff58376083088a431a92a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773234413, "uuid": "ad13beea-8085-4427-a7bb-fe4f39fd3d88", "comment": "Malware payload (XFilesStealer)", "value": "ec5461c08f50b3249c434bedcf8e70fd6eb67fb2a351fb9969fa0d3ed3d65238", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773234413, "uuid": "477211b7-5d3b-43e2-86e7-bb82a5a2e473", "comment": "Malware payload (XFilesStealer)", "value": "5da20ab7121d1f513ea02d346f6d4e8478541aff", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773234413, "uuid": "f9255220-f50f-4173-91bf-c9b137eb8c0f", "comment": "Malware payload (XFilesStealer)", "value": "4b603b6d7a8b2b09396c9828d98cbe485db81db9ce0be2899423d8ccb672c036d54e37477413406ec9daad32e660d183", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "XFilesStealer", "colour": "#D1E15B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773234413, "uuid": "4627bf5d-2ab7-4a53-8c05-caa5f0995f71", "value": "T18517338ADE027F76F263DB3F47F1171D58A12D575453C0DBA3263A2C0A36B816BEA085", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773234413, "uuid": "b513b6c5-0958-4994-afaf-11475257fd41", "value": "393216:byM9mCjkFXI5zZM92F29mCWF0kbaAHbEeN1tn0d6pvmgRG+v:iCj8Xye2QRWFlbaAHbZ3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773234413, "uuid": "97380a3b-ed5b-468a-9886-3ec76e3a8ef4", "value": 18873344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773234413, "uuid": "d5c53ee9-de8c-4f59-923f-69239d9ac26a", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773234413, "uuid": "2780636a-38fd-47e3-9a2e-bc2fef5142fd", "value": "Adobe_plugin_V32-38.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71664e48-1d60-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773243548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243548, "uuid": "d0c4dad4-3bb4-4831-9306-ddfad62b3ca8", "comment": "Malware payload (Vidar)", "value": "ffe382af1c4e89314e48ae9ccedb1598", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243548, "uuid": "784d5f33-f4f8-42d1-abc2-6b72137f4e15", "comment": "Malware payload (Vidar)", "value": "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243548, "uuid": "92a2cf51-a926-487e-808f-722cd5e2ac53", "comment": "Malware payload (Vidar)", "value": "71c04d82ebdab4fb20f023f5c91aff9beb39fd0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773243548, "uuid": "a3037f08-0bbe-43eb-8ff9-738b98d75a2c", "comment": "Malware payload (Vidar)", "value": "f874acef1c141dfef1873df2cdcba304517d900cc00e8679a6cb6ad80ed9e1d4d07a0871225fb9d3d4066db037242cca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243548, "uuid": "5daadfbb-3109-47da-a02c-fe1a4625f832", "value": "T1E8B58C8ABCA408F6C4AE97368DB761923B35FC590B3263D31E61B6782E727D05D78704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243548, "uuid": "575858e2-1b88-414d-a362-882ff6828773", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243548, "uuid": "32a62457-f902-4065-aaf8-c767591d1106", "value": "24576:yRRC/SkPJOatMWpHIZms4aX0zBak/cm7zUZtx7nrR/XIC8C7LayOAZu+/nDAaWt5:yRRMSkPJOatMXZmA1rR/7xbOA0+/DAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773243548, "uuid": "40e1c438-8dc1-4958-bb55-3de44faecbed", "value": 2284032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773243548, "uuid": "4046fe72-97b9-432e-83e1-214e369b3e1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773243548, "uuid": "6d4890b7-e6df-42ce-a4e2-71f29fc28e1f", "value": "ecdd7a7404a2b1eef1d7a2acb2d3770fd4da249f84cfca2aca107dae960970e2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3d58ba-1d91-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773264611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773264611, "uuid": "9362b1c1-938c-48e2-b1cf-1f8ae54b5871", "comment": "Malware payload (Vidar)", "value": "4b6966ec05752b0554eb7f1a3ba24199", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773264611, "uuid": "ca3b25b9-4213-43bf-abdb-701c7f527936", "comment": "Malware payload (Vidar)", "value": "ee0237c9b44e50b8b2e76e40dbe83a5d1554598655e9a3e799937025d60743d8", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773264611, "uuid": "5d7bb39d-7038-42e2-a26f-f988b060647a", "comment": "Malware payload (Vidar)", "value": "591c353b285102f227b15345db9af304fa97ae38", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773264611, "uuid": "75b0ad99-0998-480b-b677-3c92f74490ca", "comment": "Malware payload (Vidar)", "value": "09b5f1b437d75408c831a434e320eaf15ab04816cfbfbcda643f62cd5c22e7ec22554ca5c5c3fa460841bc0d9ac20141", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773264611, "uuid": "fae6b43e-4caf-4652-ba96-0830ab980979", "value": "T13586D42BE657813FD21B823EC4D28A0195F371790733B9E7519903684A069F5EE3EDAC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773264611, "uuid": "91b490c7-3b23-481a-8a3d-2d7befb54e1e", "value": "fc6347d9301c949b4829eab103eca4e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773264611, "uuid": "0700865a-9a20-4398-a8df-d11290a8d718", "value": "49152:c68gjc99kBx46IBcqTtRJZWwQW8xEScB0Td1likafYL0uxz2fiF3ICWvBiMUBut0:m1+aMeVEBMQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773264611, "uuid": "c8bc771b-4103-4377-929a-9b20984381c3", "value": 8210944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773264611, "uuid": "0699b6a9-cf5d-45ca-9989-868e011d79cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773264611, "uuid": "731124b2-9873-41ab-9832-f36667b739c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a98849e-1d86-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773259750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773259750, "uuid": "a8369da2-a2df-4c83-bdee-039816e8ef1b", "comment": "Malware payload", "value": "5e5d40f22e9e2491602eeecc807273e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773259750, "uuid": "f850eba4-7ebb-4a77-bcb6-b72cd8bbf415", "comment": "Malware payload", "value": "ee7981a82ed8c254e9957701d136d47f18d8839b9e72734ca530ee56e4d057d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773259750, "uuid": "ba92ad11-2ade-4adf-af35-88d7a2f6445a", "comment": "Malware payload", "value": "7a583ffcbc6fd2aca2a054561af0735847bd8aec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773259750, "uuid": "df1867f5-736d-40b2-8072-0a2138ebf9d3", "comment": "Malware payload", "value": "46657d9aa9805b6bd3a526c7ec0b8db5e7f4292ae1c7f64c60cec74323288cb0bca7f1ec6d1110cc3be0c1fd701b91da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773259750, "uuid": "c338dfe2-5043-472d-aabe-bba0328085c0", "value": "T15F431A13788084FDC4D6C2345B7FE21AD923B06E1235B26A37B47E26BA9AD311F2D645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773259750, "uuid": "723a72a2-2926-4bef-a370-648ca21bf187", "value": "1536:+TtLrd9/RUSYumcevoPEHx/csOgZJ+4jRd/mQ2igw:+pd9/etvkEH6sO6M41detigw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773259750, "uuid": "b7998384-ed7e-44c1-961f-9af3bcde61e5", "value": 55792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773259750, "uuid": "7b555e75-4e57-40d1-849d-0122e3d0bc53", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773259750, "uuid": "e7ef859b-de66-4f34-b650-37eab1596be8", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b94569e-1d7e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773256477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256477, "uuid": "e67f542d-0dc6-4831-a29f-c3cc5963172a", "comment": "Malware payload (Mirai)", "value": "75d09061d79bef284cf24074de27e8c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256477, "uuid": "9b61f968-cb53-4687-b63f-36ce79f94d95", "comment": "Malware payload (Mirai)", "value": "ef0cdf4149912a5cc5b1bb4725de9255e86f9b21ad271669b1d72b13cc07a32a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256477, "uuid": "b5bf7f3f-b7b1-4cef-8abb-292f51bb2891", "comment": "Malware payload (Mirai)", "value": "2f6827faffafda2196cf03349112663eafcc5827", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773256477, "uuid": "f15038e5-0701-4ffd-81f7-04ca129df51d", "comment": "Malware payload (Mirai)", "value": "48945127ce17df0c2942c45341133905a6c02f11db7a20cfd2e5fa93757a6263cb03f52b2673217b72f17ebc35fa569f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256477, "uuid": "f2fae3cc-92b7-45a2-ab7a-83d5174cf28e", "value": "T1C3F2E6D1B8825A2BC2E423BAAA6F558E336173A8D2CF7317D8115F107B8991F4D63B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256477, "uuid": "69d815ef-e186-4fab-b772-6c3e9b0c3dc8", "value": "768:Zrk9VXt7tq56tW0G0xayo1xC3jA/AuYzryw/M9T:8X9to6do1eKuzryJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773256477, "uuid": "86c3c123-9b57-4122-8e8f-b2fd3b6dd4f2", "value": 37128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773256477, "uuid": "399e5398-ccdb-4112-be22-851818b24988", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773256477, "uuid": "9877254f-2501-495e-979d-36f4fd89ca03", "value": "parm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ceb084-1d75-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773252578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252578, "uuid": "bb5d3979-0a83-4011-ae39-02b91747f7e9", "comment": "Malware payload", "value": "6b71e6e1318e6ac6ccfadadf3042557a", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252578, "uuid": "10ecd973-3cc7-4f5b-860b-11553dd27ae2", "comment": "Malware payload", "value": "ef6bdba43b0c416e217186142ffa9a75f0fb5a4cb1d43ae08aa54634252bcc63", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252578, "uuid": "996cf6bd-3f55-42a0-b1bf-8acd458bc0ac", "comment": "Malware payload", "value": "96a6b820c83b7823ee2cf024d1186f2667f38ce1", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773252578, "uuid": "8e320985-9ce8-47b1-bb33-325d5e29abfa", "comment": "Malware payload", "value": "98de146e926377cfc6888fc99f93b9402749cf8b08f849ed4a5bd5c66f25155d5724f3a502f09fcdc85408b7c313a888", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252578, "uuid": "1ebe16e1-85a7-4945-ae9e-024ee5f9a7df", "value": "T15876C39AB3840BF45558ABCC830735CE23A1A1772EBB204D92E0855F7D2EF637664D78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252578, "uuid": "f1cd8dca-e0bc-4aef-bb15-0e41ad5f4ae4", "value": "24576:nFmFQFc5fFMFvFsFMFMFnFxFDF9FgFb7FbfFbvFb69FbWFbcFbDFbfFbOFbTFbla:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773252578, "uuid": "2cbd5cbe-e989-4b41-8f92-04b636f7c878", "value": 7555569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773252578, "uuid": "bc69fb3a-9cbd-42a9-8212-4a4692012fa2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773252578, "uuid": "057ad872-6c19-4046-b01f-41ddcd2dd7e1", "value": "global", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d617cd97-1d25-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773218376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218376, "uuid": "20aa72a9-b2dd-4621-a02b-178b64cdf0db", "comment": "Malware payload", "value": "e1dd32d49f9ee522e261f884fd8362ff", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218376, "uuid": "b3432a23-b0e0-4529-88e6-c631eaf61e65", "comment": "Malware payload", "value": "efbf42e100aa46484298223df8d48bc998c02c94361677aed4607b52c3ef1737", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218376, "uuid": "8cd3b515-7c37-4010-898f-7693578b6f6c", "comment": "Malware payload", "value": "aba004ba6c6046b2d77b6f96a2b801cf974dd4b3", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773218376, "uuid": "844d3e2e-7b26-4ca9-90d7-4ba27af8d165", "comment": "Malware payload", "value": "c7b72c04105de8ef2094a4eee4ef69c7cc549ed202c4c5e9fdca20d5146e7af9a7c395b01cbc64028edd56d90babe040", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218376, "uuid": "010bc3f3-5a86-40b7-8d25-eb9a530fb47e", "value": "T1A9019C253A9D8CFE1B8315D79C86E908E1B146B3D98A5C90B3CCC5E6EFD64BCC111255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218376, "uuid": "52be3653-f4b3-4163-91a6-d596cdebef9d", "value": "24:+L37VmoinPFjjlI3YzcaoKFTqCsQLQLQwtZ:23woi1caRlWQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773218376, "uuid": "2fbed049-9675-4cac-a1a7-34953cadf883", "value": 786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773218376, "uuid": "a5be24a2-c221-4052-8539-d94a8f907698", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773218376, "uuid": "e4be1c56-3d92-4ec3-b618-860878c1d65e", "value": "789.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e10650e-1d5f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773242978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242978, "uuid": "d2a29046-f6bc-443f-9b0c-48ae5c67c51f", "comment": "Malware payload (ConnectWise)", "value": "0242f87ea66fcdc11f76d8194cb35d56", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242978, "uuid": "88b24a44-b8dd-4bc1-a32c-1b6b75fded80", "comment": "Malware payload (ConnectWise)", "value": "f17fca4728918de6ead811c3df5ca791400ce8988dc6a8d3e7aabd52abbaf89b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242978, "uuid": "083b799d-0ec0-40ed-b56a-20c3bf5eb5ee", "comment": "Malware payload (ConnectWise)", "value": "74304586ffab20fe1f26b449c80be9f8d5f19319", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242978, "uuid": "605d84e0-c36d-4afc-a211-cfe18243c5b2", "comment": "Malware payload (ConnectWise)", "value": "d2cd834e28374b43b09df8fda72ca2b955b6c8d83ef7b4c9c0bd2f41e4a065be5e61acd9868c5a4b39b2fd6faf2481e8", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242978, "uuid": "2f02d26d-ccf1-4317-b6a3-52779c368375", "value": "T193D61201B3E69574D0BB0A38D87A9266AA31BD005716C7BF5794B92D2D33BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242978, "uuid": "58dcff0f-9056-4847-812a-f96597a29bcf", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242978, "uuid": "8972a275-e3a1-4c06-8ce0-ee236ca64e85", "value": "196608:XfefPvBn2hg5kEWmXhcfKjSV4h7vGeGBn2hg5kEWmXhcfKjSVJBn2hg5kEWmXhcy:ugdEEijRDGPgdEEijsgdEEijkgdEEijE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773242978, "uuid": "655b54bb-576b-41e3-9df4-b7f9bd4f6160", "value": 12637240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773242978, "uuid": "06324123-cce1-430f-ad84-97013d6a569f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242978, "uuid": "5f2972f4-5563-4d2f-b2bf-62707a3a6b3e", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae2a6dc-1d72-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773251160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251160, "uuid": "c7639b7c-7625-45f7-a5c1-bfca52415e6f", "comment": "Malware payload (WannaCry)", "value": "fcc4b38e42170b4c575f0e699ed5d429", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251160, "uuid": "af2e5724-0842-45e0-8bb9-1c96d1f3df42", "comment": "Malware payload (WannaCry)", "value": "f1ba28b861a8abf72b37e902121cd2506cea2b7323adba98c5426dcaa71fffc7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251160, "uuid": "89e01351-258d-4b54-b605-6348999f1496", "comment": "Malware payload (WannaCry)", "value": "43d8b0986a481db80ade7b6fee38e2417e31e386", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773251160, "uuid": "20d9ff31-1ff9-4499-b4f3-2127e7a521cb", "comment": "Malware payload (WannaCry)", "value": "7aa8dd2780c1bafb37357b50e996331a40dfc2827487342aae0eb618e86ddda67dcd1d7b662f5219405198cc50929b27", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251160, "uuid": "b27e35a1-dd37-4aa2-92ef-a380c12e37e4", "value": "T12F363366616CE27CD019657150730977EBF27CA5A3FEAA0F8B8487D90D0375ABF90E02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251160, "uuid": "8b0fa3ea-ca5a-4a89-aec2-38e6e2bc347b", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251160, "uuid": "c891ab30-8e61-4253-acc1-f2109fd4de18", "value": "49152:SnAQqMSPbc0hx+TSqTdX1HkQo6S8aEau3R8:+DqPo+xcSUDk36SY3R8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773251160, "uuid": "00d89956-d321-429b-92fc-23c1034fb778", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773251160, "uuid": "bb279e3e-4f06-4062-aee6-dacecfebb2a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773251160, "uuid": "4c184f48-05ab-49e2-9111-4cc8fd238232", "value": "f1ba28b861a8abf72b37e902121cd2506cea2b7323adba98c5426dcaa71fffc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26829313-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217652, "uuid": "3a8cdfd7-033a-40c5-ad5f-5205570def5d", "comment": "Malware payload (Mirai)", "value": "b1845c9cafd9277c7c4fa105c852d500", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217652, "uuid": "bfe0d636-c58e-4b10-85d0-e9a1c331330d", "comment": "Malware payload (Mirai)", "value": "f1ba596e1ce202309f20591100f0b515d37f2cf931b054e4f6d6e1eccbcfdfd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217652, "uuid": "f7f6407f-944d-4c29-a23d-c8aefd9ff694", "comment": "Malware payload (Mirai)", "value": "913b6e646b58204cbc987c2019df2f8e6082e8a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217652, "uuid": "b20d1f8d-9d45-4645-aeca-c6963f48c374", "comment": "Malware payload (Mirai)", "value": "4cfe6117af8427098a512f48171bad1d21c76a9bf35ac4794f0ac5d84ac009096138857e4f49bc23168efef6f4e29fdf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217652, "uuid": "c826bbc9-dab7-4f3d-ae48-eac00e64476f", "value": "T121A533F2E5F7E54AD792FC7832302B5F792157A7092FAAF655918CA1384800590FAF83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217652, "uuid": "422542c6-a19d-4a74-8beb-759a39f06e1c", "value": "49152:okQtSi/odTapYm87xSSb/wZ9j1kNWUo71LTZ:okupoPmqXyj1wDuLTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217652, "uuid": "d86f0bcf-6fb3-4012-a24b-a3b42208ed7e", "value": 2115756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217652, "uuid": "cb35cbd3-a845-4f9d-b45e-6f3d41829859", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217652, "uuid": "0498a53c-b6b2-4004-8cbf-0ae02153dc95", "value": "ip6addrd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0561318-1d2a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773220460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773220460, "uuid": "24078064-530b-44e9-a894-0fd846e516ad", "comment": "Malware payload", "value": "6db53d66629f95a2d830a4f56e8c69f2", "object_relation": "md5", "Tag": [ { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773220460, "uuid": "2d93f861-a2fa-40b7-8ac0-02d78845a176", "comment": "Malware payload", "value": "f239e3fedc4926ff3cf58f95bacff9d8f11289e58036ed507ab3f435dce1b2b1", "object_relation": "sha256", "Tag": [ { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773220460, "uuid": "1bff2e51-48ed-4f89-9497-18b5095b4951", "comment": "Malware payload", "value": "253d232e1485e7e60ff3380999412c773d0a9a14", "object_relation": "sha1", "Tag": [ { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773220460, "uuid": "f9bdefe8-4d1b-4dbb-860d-007d2a6f8c42", "comment": "Malware payload", "value": "717747097ee80b6eb0efb099755cf5e2c66468a28dad9bb6fd838fd040206bbb6ab281fa093a68a0a371bb0eea9e76ca", "object_relation": "sha3-384", "Tag": [ { "name": "MSC", "colour": "#F9E664", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773220460, "uuid": "eca191ae-dbd6-4a78-a21b-5b9d61391e0d", "value": "T145567EBEA001C58FB93749BFF96C1FD088989E47D9CC9B444098A4AD76FC65A610C8DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773220460, "uuid": "b691d7fb-9497-4d4f-bc6d-b1ef44723d8b", "value": "3072:78b665KfKOQC/DoSLVCIKfxSLwGNYQhSKns1sGNBXpn5KIicsoC7+ZrueP1JRTA8:8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773220460, "uuid": "bcbe7743-39f2-48b3-9140-131b4c5b768b", "value": 5906319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773220460, "uuid": "ee957d40-9c14-4cd1-ac38-40698b1c48b7", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773220460, "uuid": "e1811e8d-9405-4d90-89c1-25ce2214ddb0", "value": "plugin.msc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53edc479-1d18-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773212574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212574, "uuid": "e09e05d2-99a7-46ee-94ea-6f4b98372048", "comment": "Malware payload (Vidar)", "value": "613505ec6d254f2e4609b61628959929", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212574, "uuid": "de9fcbdf-3a32-40a2-bbce-443672bf9fd4", "comment": "Malware payload (Vidar)", "value": "f54b05b43900a82cacc5782446cbf870c04b5ac2bf21812253cbe627039a2677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212574, "uuid": "abad68e0-9f70-42fa-a4f1-f4afd00b4ef8", "comment": "Malware payload (Vidar)", "value": "e1defd033deb524cb5fb9d458008efd602818ddd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773212574, "uuid": "e2570884-7603-4182-9314-d47d24773325", "comment": "Malware payload (Vidar)", "value": "8c3ccfa01c31968ba1bcfae0fafe1063345a04780bb7d215055f6967815d9884c906b86657b71e1c0ba8f58cdf5275eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212574, "uuid": "3d12b2d1-2904-4026-965a-71894b7bbd10", "value": "T1A8A58C0AACD448EAC86A97328CB621927B71BC590B3223D71F90B67C3F727E06D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212574, "uuid": "dd81b2b8-1c53-4be2-83a8-db1bc34658da", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212574, "uuid": "ba2a88b5-baf0-4d36-9e97-578206596845", "value": "24576:D/zzlnaSQYmrsL3DpHkyyJ6hInbLYQwXUVNg1FRiXswcD9UYd24tPclSfsomvKHz:D/zzhaSQYmc3WyyYa/VNmiWD622U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773212574, "uuid": "ea5e1704-1fed-4864-b42f-fa924e9fdc08", "value": 2259968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773212574, "uuid": "e5f8bf75-b171-481a-9c12-a8b35777ad1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773212574, "uuid": "54637c84-0718-4af2-984a-efc07f2f77f6", "value": "613505ec6d254f2e4609b61628959929.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b497169-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773249846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249846, "uuid": "106bfe35-35d8-46b4-9240-8e5985326951", "comment": "Malware payload", "value": "bb5e9177b0067909d8cc44e5c956f62b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249846, "uuid": "587f2a8f-2248-4699-8e8b-6a5e209054c6", "comment": "Malware payload", "value": "f68abc59548baab3506d53a84a34e352e6dd21023803ad644003948b3c3bd09c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249846, "uuid": "8d8eb81f-ade1-4a06-b3ae-e92ccf9a7d4d", "comment": "Malware payload", "value": "85da5d1984c889249f2a4229aae678e6d043b3c2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249846, "uuid": "8c0ac8c9-9eb5-4d9f-baae-dfee968d163c", "comment": "Malware payload", "value": "182a5e24d90da61206d0b10fafdbd918c4dd46a85aa7ba33e6efaea97267c687f80a9dc937dd28424136d9ced5c4e69a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249846, "uuid": "5e3942bc-1091-415b-94e8-1b30bc4986f8", "value": "T1B136339971BC91FCD20529B444ABCA53B2B27C6E12FE6E0F9B4049761D03F56FB90A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249846, "uuid": "1cb08b6b-5aa2-4a6d-8c26-f7fc6ebab7e7", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249846, "uuid": "762161ab-3007-4c76-ad4b-74298d8500e6", "value": "49152:SnsEMSPbcBVQej/1INRx+TSqTdX1HkQo6SAARdhnv:+fPoBhz1aRxcSUDk36SAEdhv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249846, "uuid": "bafd33e1-3638-4050-b26c-5719c4bc7343", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249846, "uuid": "4cb49573-eb24-4cd7-be69-64aea8aab62b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249846, "uuid": "bcfd8029-1ea5-4c30-a937-cf27b01e2b44", "value": "f68abc59548baab3506d53a84a34e352e6dd21023803ad644003948b3c3bd09c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be76c97-1d5f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773242975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242975, "uuid": "aa781900-511e-4daf-ae9e-28573e7efcb6", "comment": "Malware payload (ConnectWise)", "value": "8ce1f905a278a78b2805abbd8a0654ec", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242975, "uuid": "2ab404d3-016c-4de7-b2c3-cdf987d9140c", "comment": "Malware payload (ConnectWise)", "value": "f6cc0e58544b195ff09bdfdcd74a83b754682670d1bd4d264704c31ede0c208b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242975, "uuid": "b81c6e74-55e2-4993-832a-df667e3dd58d", "comment": "Malware payload (ConnectWise)", "value": "b12d00a44c00dfb7927acf39ececa928c3777766", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242975, "uuid": "a29166e0-8c7d-473e-89c5-543989e8f708", "comment": "Malware payload (ConnectWise)", "value": "0bc6026744a127998c7640452fe745640d08b8883edecdf34c1bb731f7397e8d14f2ccfdd1da6efe1b58e97e336064a1", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242975, "uuid": "4dc4cbc4-aff8-4cb9-a659-70285093ea3e", "value": "T12FC533DD27D88806E08A753FBE642DEB62D1C9842D7837EDE4ED4A84DC56F90347B0A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242975, "uuid": "184c0896-2c8c-4604-877c-895cb6536964", "value": "49152:81+l89eeKCldL19wWyI0lxefzzDm66V4R5a7Uv0ErwPgAEezq5XyEY:81+lBI67izzDmNV4RQq0awPfEe+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773242975, "uuid": "6c2d2989-523c-45d3-9239-f51ee9f031a2", "value": 2612705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773242975, "uuid": "11b7a177-4a3e-4b2d-8a97-8009b1db83ac", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242975, "uuid": "b2a87efb-ab13-4d7a-966e-ea0a8e947570", "value": "Factura.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721a0d52-1d5a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773240972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240972, "uuid": "e469b086-b877-4018-8d0d-438296b18f0f", "comment": "Malware payload (Vidar)", "value": "0775c56d678142c524c4a41f2f194f0f", "object_relation": "md5", "Tag": [ { "name": "37-221-66-22", "colour": "#9E1FE4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240972, "uuid": "4f18be1b-a84b-4eba-af35-e3dd1d67f950", "comment": "Malware payload (Vidar)", "value": "f72ccf1c2c6c7abcea0bbcedbe6045153c903d3e80d8ec1c5525760903fcade7", "object_relation": "sha256", "Tag": [ { "name": "37-221-66-22", "colour": "#9E1FE4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240972, "uuid": "9651df54-8c06-4683-9641-43b708924a9d", "comment": "Malware payload (Vidar)", "value": "f9b03496b578da9adfc67895b6129c8b089794f7", "object_relation": "sha1", "Tag": [ { "name": "37-221-66-22", "colour": "#9E1FE4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240972, "uuid": "a9d870bb-8271-4c16-9379-312730adf8b5", "comment": "Malware payload (Vidar)", "value": "73074ef973ff15c7577af6a14ee3e1d9063f762e83f2cadb645c022d68a38472940ad6e6f59e1c1e6c702d182f76ae62", "object_relation": "sha3-384", "Tag": [ { "name": "37-221-66-22", "colour": "#9E1FE4", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240972, "uuid": "1da3635b-f534-4e93-9acc-fbc2207e3dc2", "value": "T14177BE02B7E80166F4BB873498B79612AB36FD511B31C3DF1294A26D2E737C09E35726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240972, "uuid": "e096d6e5-9552-4207-acfe-2a36e90e5adc", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240972, "uuid": "425a00c3-8900-4caf-a104-2881746889cd", "value": "786432:LH7olaP8pggQ0X58roA9q/EJerDxxV9O7snn:63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773240972, "uuid": "f41ae249-4a19-4879-ac42-bfd13f536731", "value": 34264576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773240972, "uuid": "5de92383-c40a-4704-b03f-60b342c200d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240972, "uuid": "c0dcc9f3-b302-4bb9-a2a5-8abc8bdc703f", "value": "source code of carbanak backdoor discovered_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879dadbc-1d5a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773241008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773241008, "uuid": "fcdfb31c-4037-4892-840f-8ae4cf11a6ce", "comment": "Malware payload (Vidar)", "value": "ef8c1ddbc82efd9bf56fa5999cd2fcc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773241008, "uuid": "35c38315-01e2-46c4-9937-70555507fad7", "comment": "Malware payload (Vidar)", "value": "f74fde9b0c775423a9b63813c0bb116213f2bc7b98d6bb1f813e0ba387a3c50e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773241008, "uuid": "1602a14d-53e5-4ac1-8e19-30d347e1ce55", "comment": "Malware payload (Vidar)", "value": "9301c288f90b80239ec21014e13b1b5b3dcedf4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773241008, "uuid": "522511e9-79b8-4254-852c-e50f5ca91019", "comment": "Malware payload (Vidar)", "value": "6fa0dcb97895221948a76711803a02b8da571841cb7330ba243ddb399b87e0ab5eeb4ccecc1bbb17f93c4ac08050037e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoLoader", "colour": "#20E63E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773241008, "uuid": "4e96c49f-9b9b-4244-ad87-dd3ce9ae6c47", "value": "T133956B0AAC9408F6C46A67328CBA62927B70FC490B3263D72E50BA7C3FB27D15D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773241008, "uuid": "149c9d14-7a37-42d5-a817-5179a2bd5846", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773241008, "uuid": "a7c00980-539b-4744-b105-8e4667277062", "value": "49152:4UDcSJo4ymf19ruww77g1wUIWWjmdlE2D:4U4WggAO/l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773241008, "uuid": "9edd1ac2-725c-4ef4-9b81-e18ef9257581", "value": 1936896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773241008, "uuid": "7eaa9289-1697-47fe-b08d-c06b7e13eec9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773241008, "uuid": "87ca7864-6778-4868-a357-c3cc418b3d32", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a3ee326-1d5f-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1773242972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242972, "uuid": "7f5b609f-5f5b-43d4-9b33-66b796970f06", "comment": "Malware payload (DattoRMM)", "value": "07f8af69e2dd4c8ae1102fda790d7958", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242972, "uuid": "9fcd9b8d-f065-445a-a11f-d95f5e8562c0", "comment": "Malware payload (DattoRMM)", "value": "f7e68620a86f2256b5063cfbfe62b8fd6b9c4f12890ad443c94ed97e5cd14c9b", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242972, "uuid": "f639d966-0654-4631-9890-b74faf693dc2", "comment": "Malware payload (DattoRMM)", "value": "b8a29cfd1324b5e7256f50f4b5e3f6bd7ad7963c", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242972, "uuid": "c8b58e9e-b195-4219-b2d2-e36ca3c083f7", "comment": "Malware payload (DattoRMM)", "value": "7542174f3aa17abab3bde47d671f1c8e866c8c273ff19a192763c5ed4f3b93afcb517f9cfdc4eeccf6043f02e6d03d55", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242972, "uuid": "3e091eb0-fb9d-47bc-8f4a-3936749e0cb1", "value": "T146B63347D9778DF0CA330A3890D2196B3305980E485BF4C9E609277ADEF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242972, "uuid": "57f15eba-a048-4107-b0c6-eefc35493d2f", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242972, "uuid": "697c1e32-2607-4796-be2a-9bf1dd3cd37d", "value": "196608:KaZk+wOP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s27:gnpmzZFw5S9pE7Asjp29qIT0jarlZr8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773242972, "uuid": "6935d169-5d6e-415f-888d-8d8b8bfa7e75", "value": 11056040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773242972, "uuid": "e37b9a42-d1d8-402c-a6a8-2d98cc62ce82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242972, "uuid": "6994fe28-733a-467b-90d9-658ce40d8a1a", "value": "Adobe_AcroRdrDCx64_Installer_en_US.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "723b39ff-1d70-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773250421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250421, "uuid": "d5e3e91b-470f-46f7-81d5-0c828a3d5e3f", "comment": "Malware payload (RemcosRAT)", "value": "573fcf46a8a5d7f6ce6c846a0b25af1f", "object_relation": "md5", "Tag": [ { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250421, "uuid": "4d36d127-39c5-48c0-a4c4-d2d7c7c141f8", "comment": "Malware payload (RemcosRAT)", "value": "f87e78b58711e82bf08aa3bec131f33f53fd5fcb9dfb3be847634e21ace80a54", "object_relation": "sha256", "Tag": [ { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250421, "uuid": "ca7c113d-d0ad-40c2-837b-fd09bdeed632", "comment": "Malware payload (RemcosRAT)", "value": "f655346d5988c1582f20425a058f7d661ebbc7d5", "object_relation": "sha1", "Tag": [ { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773250421, "uuid": "059f5dcb-647a-4a6d-98f6-3bd45ec0b888", "comment": "Malware payload (RemcosRAT)", "value": "a960c688a7f6c51645e7757f7d8f4415116ca530f6bf4e1b7c9f601d26306b03cb46678866a81d736a643fe2952ee022", "object_relation": "sha3-384", "Tag": [ { "name": "officedesk2026-4nmn-com", "colour": "#AC68EE", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250421, "uuid": "f2acaa57-fc26-4208-90b4-50aafe648ec3", "value": "T1B03519ED87C3F96DCAD5E753524A942224B4705279A0127E3FC0C5D7E7B182E8EBA10E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250421, "uuid": "817a2789-ca9b-462c-9966-1b07fe9a4fc9", "value": "192:q077777777777777777777777777777777777777777777777777777777777777:JH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773250421, "uuid": "cbfd237c-79f0-487b-9c98-37feae107109", "value": 1093763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773250421, "uuid": "f90a2565-9813-4245-adda-6cf216d759d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773250421, "uuid": "298a35e3-bc31-48ed-95f1-b0b3c596af4e", "value": "SW-036012291pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d83a17-1d21-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1773216363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216363, "uuid": "dfde5a4a-1b2c-4d1a-b05e-0dd51993577c", "comment": "Malware payload (RemcosRAT)", "value": "96ef9f674ac17626c39ab251b4208266", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216363, "uuid": "a23580f8-e8a6-4e92-9893-ea57cbd0f5fc", "comment": "Malware payload (RemcosRAT)", "value": "f8883b8ffa7ea27458b064285c2d987f1132f0ef0c1811e4c1e07e9b90aaf856", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216363, "uuid": "83deacab-d026-4bb2-be08-326fda37370c", "comment": "Malware payload (RemcosRAT)", "value": "a5e418a51d159f00256631d8f4e02e7468f100ae", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773216363, "uuid": "3f6afa4c-e924-4da2-a229-a586d60107a0", "comment": "Malware payload (RemcosRAT)", "value": "18458286e23d2d99fd0e9c562c2ea1af50a6a2ba132c3b0d84104104c2007a6155b5230a138af96734c3cfed73629002", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216363, "uuid": "4ac23e0c-370d-4a91-ad75-daef21796708", "value": "T1AC0523AEC8591FF29F1581C17F073B990D31125A6452D386D147DBB20CBFE2DAE8A21A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216363, "uuid": "06afa78e-4a50-4910-943d-4bcad64fb357", "value": "12288:MrZAjzwGQIF/JIlfdYGU5Klv/m23rGZJtBOW+yGPMy2EjSNo75ExJcPS:0dRIF/JUlpUKv/p3rSJtBOPP5W2VEuS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773216363, "uuid": "c46e5b83-b9a6-4395-8339-a11e2d16355a", "value": 813624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773216363, "uuid": "2d02aa52-c189-4544-8055-04daa3a1c95e", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773216363, "uuid": "25ca559c-317c-4860-a735-be590887f181", "value": "First_Tranche_Payment_Details.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd2ee26-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (Worm.Virut)", "timestamp": 1773249850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249850, "uuid": "fc01cfae-5298-4d4a-b091-f0e5ae22099d", "comment": "Malware payload (Worm.Virut)", "value": "264ffb0f4fe8dcd9a8c540b37529182b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249850, "uuid": "3b21cea6-7264-4972-820d-4e784c73a143", "comment": "Malware payload (Worm.Virut)", "value": "f8c605aa739331b9f0e165eb194dcc507df753482bb4c833ab0df511358b1a90", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249850, "uuid": "e01b2546-3279-40bd-8730-64d5b4763f1d", "comment": "Malware payload (Worm.Virut)", "value": "218de3dad947dcfbd99ee6b8f327bf10a727ee82", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249850, "uuid": "a5e05ea4-8837-4fdb-8b4b-8987572eef6e", "comment": "Malware payload (Worm.Virut)", "value": "64bb19d67e24cf7ef78d568ef219cbc77291672d5154e9c410dbb5ff3c3311aa64f0c186fbd6be6c522a3b28cb993451", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Worm.Virut", "colour": "#888CFC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249850, "uuid": "8d8c2c93-57e6-43e5-a22d-a0226a932a17", "value": "T1B4362322E11861B5E4A305F404EEAB26E1BF3C2417B795CBAB50466A4C217F77B34F4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249850, "uuid": "e4837e8f-a60f-407c-a2e6-4e53094fc04c", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249850, "uuid": "ae90ec1c-257e-41cf-8cdb-1ad1d6fa5c37", "value": "98304:FDqPoBhz1auk36SAEdhvxWa9P59Uc/JV:FDqPe1Tk3ZAEUadv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249850, "uuid": "1add1a6e-3d5e-4b95-bc76-dfd2215e1b4b", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249850, "uuid": "bf7d301d-cb29-4326-af88-85f2c85b16af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249850, "uuid": "1c0eaef7-ee1f-44ec-845f-f60080da4634", "value": "f8c605aa739331b9f0e165eb194dcc507df753482bb4c833ab0df511358b1a90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0023723-1d19-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773213158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213158, "uuid": "986cd16d-fd6f-4a2d-b5ef-7292026811c8", "comment": "Malware payload", "value": "4244ce78aeb4e1be2461cb909a4c7b9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213158, "uuid": "eff1ddc8-d31a-435d-b46a-b257111a6306", "comment": "Malware payload", "value": "f9049c88f59b9cff456925330e20a99789f2ac9712d511d0829bd252267f7447", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213158, "uuid": "e33037ef-83fb-476e-ad08-c4ac14c918bb", "comment": "Malware payload", "value": "ade9a2811d0d1c9dcafd8e86efaace648d8e9325", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213158, "uuid": "3020038a-e4b9-4f74-ad6d-b835ced12f92", "comment": "Malware payload", "value": "33ef860c7f6ba158b1bd76b30c144f3c97d32f80ec3f429ee50e9a59a07d8418d0ee24838df4aaf2e9ba8e9f29208db3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213158, "uuid": "50f7613b-ccfd-4e73-85a0-6d3f6134826c", "value": "T1EDF44B30B240D03FE5F309B5A42D97AA611ABE3217A558C7B3C41F6E56B81D19E32F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213158, "uuid": "5673b000-38fe-4d68-a898-05a8be7a318b", "value": "b49abf9ac0d8ff78fc424d0e1b30e042", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213158, "uuid": "a9a3261e-41f9-43b1-901c-220baaf7f588", "value": "12288:iSObJw4ZsJFJOiBJ71LrKsfUcCBaUalmrMJBAJF0NSvE5VNcQlyRlSR5AX:ipbJw40x98rZgJBAJF04sDNcsyRlSR5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773213158, "uuid": "486f184f-e341-48db-9a67-b91521baa07a", "value": 785920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773213158, "uuid": "4e8e9790-4eb1-42e3-b5aa-33ed972f7c81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213158, "uuid": "a6cc9882-2135-4210-963c-8e17fe64d4f3", "value": "4244ce78aeb4e1be2461cb909a4c7b9c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d4afdf-1d23-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773217196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217196, "uuid": "89ad3ffe-fb4a-49e4-8585-f0dc6eef5240", "comment": "Malware payload", "value": "2369e888e820007566ad695c5992ace9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217196, "uuid": "410d85d6-9591-4205-8f23-0e7d798ef99d", "comment": "Malware payload", "value": "f9f19078896a885f30f88f764ccf14a1b83b375278d3c6b7f78fdfe5f23b7dff", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217196, "uuid": "6dcbb7b4-78f3-44dc-8cae-70d5d392a13b", "comment": "Malware payload", "value": "bca2143b4cbc3ac29728e450ab954398107ba256", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217196, "uuid": "0742b484-b36a-48d5-aa06-5149eff2a888", "comment": "Malware payload", "value": "25d9d296051ab6d70b31ce5ec9696c2aebe3745e68bd693e884c04376904cf1aedf1833e304b8b472dfb96bf9a952463", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217196, "uuid": "b29ae780-f24d-4c75-b6a0-49cb584456a7", "value": "T1A5E302503A4A3F70074837F9EAEF2E0D8D6402E1463E35F9B7919A8E918D6E5433B5B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217196, "uuid": "93e84415-9e14-41d5-9a08-1332fd323127", "value": "3072:VejPSzIULD9WgPuSaC/TQCyYwZbdq90L8DGJwrsGphEo:4apLpduzAeYAbdZL8DGJEXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217196, "uuid": "79b6de41-4dc4-4c99-8604-96b976745fe2", "value": 149354, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217196, "uuid": "336caf15-c9a7-4e0a-9dc4-bde31121d45a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217196, "uuid": "85352fb6-41d0-47f4-a7b5-346aa6bc63dd", "value": "2369e888e820007566ad695c5992ace9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb58e0b-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217882, "uuid": "7e6e0965-c7e1-4830-936a-022b1e998ceb", "comment": "Malware payload (Mirai)", "value": "2972abc3d1498b0dff3925e4fdd945fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217882, "uuid": "699d0654-3234-400b-9f27-052339689c91", "comment": "Malware payload (Mirai)", "value": "faa624f7de16bd4612c05bf1c08bdcb65870cb7c27b00fd3873ea4142490533a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217882, "uuid": "24f90ce6-4356-42e1-ba96-c87200ad2d48", "comment": "Malware payload (Mirai)", "value": "3f4bc1681aa6f4349fb544ca5c740b0e20e5cebb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217882, "uuid": "a2d11db2-41ba-40c7-9534-8fdbb6c2a2f3", "comment": "Malware payload (Mirai)", "value": "61585a37aee072605cf1d98a8411a4bd87bea1cc2a75dd1e2ec8ecc4f514142eaa5c2cfd21cd6644d716267f0bb87b95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217882, "uuid": "b9eb0cab-aa38-4cc0-9e88-fd7e9b6577ea", "value": "T1E686184BB8924942C5E43A77B8BD80C433631EBA9B8756576D05FE383EBE1D90E34364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217882, "uuid": "85935594-e84b-44de-9712-6a3e0f21a4c0", "value": "49152:aVAhWhsw4eUM0Yf/LdgPYAngs7s9EIDSX7vBgM+FMIurwRdG+vKrNJI08FG5E6:aVFdLanrpX7ujdG+v2NfE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217882, "uuid": "1170c805-2826-45c4-bf60-385c6779891f", "value": 7995540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217882, "uuid": "890ddb83-d0c1-469c-920e-d00c211a3b70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217882, "uuid": "74a5fc72-034f-4f45-8b3b-a6393861a6df", "value": "mdsync1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0969e95-1d19-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1773213133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213133, "uuid": "27e9ede4-247e-4aba-8554-22f7ba09fd51", "comment": "Malware payload (XWorm)", "value": "9753b1ef32d786d1786423bc60313059", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213133, "uuid": "8e4bb979-413f-4102-90b1-9ea9efc7be7e", "comment": "Malware payload (XWorm)", "value": "facff271be2129b9df9b0b748918b3f15db650099803c087a0b0f19f2498d937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213133, "uuid": "af06f286-1673-443d-b6c7-96c4c51a3ff5", "comment": "Malware payload (XWorm)", "value": "4349877a0101896a6a7cdefc0aaf02c7154002e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773213133, "uuid": "16073787-3f3e-48cd-870f-e3460b2ebe2f", "comment": "Malware payload (XWorm)", "value": "2b64c924a54d9d44dc956fa8ff6c828d31ef577a4381bc49f9ffad9a315edad2730fd4d808e183d262740b1ab06c1b44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213133, "uuid": "dddfdcc5-9d0e-4667-b0c9-e2be68170de4", "value": "T19C44187EAF97AA41C4950836B92353814B798E75A0CFBA524EE37FFD5AF3CA40407061", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213133, "uuid": "2d32a828-737d-4c81-8bf2-2cc01e69684d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213133, "uuid": "5fa6a1c9-7bb8-465d-9138-a0eee2123b27", "value": "3072:jFPb/JmdjV6OEaGz3Nsx6NJbjOSOslubo3BOoVm4NpVq8BxFRzaqF+o2GQJ7/Jz/:jFbij4nZBs4VOslubDgVqwlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773213133, "uuid": "ce642b29-6868-4435-b7ba-605bb29b8b02", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773213133, "uuid": "cc23eb5a-8074-49bc-9b0f-27b8567f9804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773213133, "uuid": "eb81c639-9a42-4857-ab50-b1a743576f80", "value": "9753b1ef32d786d1786423bc60313059.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32079486-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217672, "uuid": "4097b466-1596-4bc5-bdee-af542e560973", "comment": "Malware payload (Mirai)", "value": "b71411dd1b2233db6a09fbbb76431ed5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217672, "uuid": "5a75ecd3-c5c2-4657-a20a-d1804d8aa7a7", "comment": "Malware payload (Mirai)", "value": "fb35b3bb0f6ccfa88024ab70e6425c4b1b4b1974e2d93fd37469e7ac7b96aa77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217672, "uuid": "fac43d4f-d437-4a38-b260-8887e617f14d", "comment": "Malware payload (Mirai)", "value": "0ca607a7f26ec5e452c922be29cb60aa58582062", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217672, "uuid": "39ac4d7c-cc6d-4e18-9077-10e62b0cfc38", "comment": "Malware payload (Mirai)", "value": "d6cb1c5e4ade5e1a1bd32c4a39db3c814941e3ecfc36834db9cde5317f2cafa840a4eaee2e92daa1e4b7e91f21904bca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217672, "uuid": "b767c5d2-0d2b-42e4-8a5e-94e408257e99", "value": "T117865C0EFE558B61C6A4067789F911982370AC026FCB4707B224F73CFCB6AD4EE46695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217672, "uuid": "97591076-9495-42ce-b51a-e127cb97b769", "value": "98304:R+EcYaL2ryupspNSBT9fH+9HlC3NA+lyHEi:gEwL2ryu7Bi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217672, "uuid": "737cf5ec-981e-4213-b2c7-a0838c2d803c", "value": 8061076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217672, "uuid": "0572bc1f-d130-4186-802a-d69d8b596772", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217672, "uuid": "4ff0e204-5c1e-4482-92be-280a303c26ac", "value": "kvmirqd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e7d7490-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217800, "uuid": "bd940c25-9289-4093-a001-778a268157eb", "comment": "Malware payload (Mirai)", "value": "6a9ccc1985f94aaf8cde008294db5fc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217800, "uuid": "fdf3042b-845b-405e-b304-5a17cb3b70ac", "comment": "Malware payload (Mirai)", "value": "fbb790dc87ae0e82cb566d1f3b3c01938a3b8c87865be69926b18e68b818c31b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217800, "uuid": "bdbfc960-1b1d-4abc-891f-ecc46519379d", "comment": "Malware payload (Mirai)", "value": "bcd464aa7b84cc3c48ddb7847eeaf3ac774705ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217800, "uuid": "d3f3caab-e3a1-477c-bcf0-1444ceba658e", "comment": "Malware payload (Mirai)", "value": "f370c0e5e23236b45e28c969ed727b7843d0509a4687cb8290866fe4f3f14af1d644e4494e2ed13398280e4f5b743bb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217800, "uuid": "99687f0a-d18a-4d61-96a5-4217b7ae6397", "value": "T19096F914AD842BEAD42C4F7890EEC96622746D104AF14A366164FFEDBC772797F0788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217800, "uuid": "1ee49116-4ab8-48cb-8498-97b94d21e9ed", "value": "49152:3wlJMFZsQgfDAguRqUozYiTQpxdVsm4YAYOBFzCA3z4nojTm9/1Cmjcggm5EJ:ouRqtcpxrSODEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217800, "uuid": "19dbb1c9-0501-469c-83c0-00da16065c61", "value": 9044147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217800, "uuid": "842a14c2-3581-4486-acca-63fc6f6802a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217800, "uuid": "da0d6e38-dd86-469c-9d0c-d71a397390e1", "value": "devfreqd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e9638a9-1d7c-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773255596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255596, "uuid": "bd816adb-80a6-441c-a4ef-8a2f2006575b", "comment": "Malware payload (Mirai)", "value": "4b34c372a4510688429dd078960c9672", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255596, "uuid": "5f6dc600-9cbe-4f55-a20b-2dcf7bb226ca", "comment": "Malware payload (Mirai)", "value": "fc3ec0b158121039c730d6e9d173b240c4ce8c76e22d393c63fa29916dc44c3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255596, "uuid": "c9af1e0f-d323-4cbd-b13d-3a5e4486f2b0", "comment": "Malware payload (Mirai)", "value": "33853ea750bd5e5757ba5b3e05b20260f700e74f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255596, "uuid": "f5e27c48-bae9-4900-84bd-51bcb9ee84c2", "comment": "Malware payload (Mirai)", "value": "5d79bcae424a9e1a1b1052320c224148c629760d8838b00ad420bc086f726893c788f03390475146e02b35dfc15401b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255596, "uuid": "e56f3e36-d16b-41c5-9bc8-9d01746c090b", "value": "T1F9834B13B94286FFC086C6B4179BA9359C2374BE073AF3937794FE662945EE01D1DA08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255596, "uuid": "c3d09991-01e5-4fa1-aa38-1b554fddc9bd", "value": "1536:eRxQUxdntAvYa73UCgYkWEu7jRdZRK3oaawirJN07YdXWzEGeganH+H7UwH8kSbc:qxpbnt+YaL7WTu7jRdZRK3oaawirJN0N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773255596, "uuid": "65a4f15a-4b4b-4078-a744-a8c9c3e2717a", "value": 82964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773255596, "uuid": "20a63812-1355-4d4d-87aa-7658528fa8c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255596, "uuid": "63ad7db6-1091-425f-801b-1bbf671b0b06", "value": "xdlol.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd0f824-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217852, "uuid": "155762d1-9527-412f-9638-1e82d85db972", "comment": "Malware payload (Mirai)", "value": "860ae2163488549835e73067684ba888", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217852, "uuid": "5482f4af-67b8-4f95-a135-afe57be6890e", "comment": "Malware payload (Mirai)", "value": "fc5b87d15f5db3c2b29f70820a3fea17ffde7fae0e1baf8d0696201656d14210", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217852, "uuid": "a0e0b23f-8ce3-4c6b-a163-6460356360b3", "comment": "Malware payload (Mirai)", "value": "060048ef0c0d3892e54b847cffdcda217871eca2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217852, "uuid": "f40f09dc-ea5d-4776-8878-97aee3a9f677", "comment": "Malware payload (Mirai)", "value": "9aac91b9da201d1c355d7b79e65e84e7fb4ce368d0a7eb39bb5acd0ac9b81b9073a84451c580e982178bba54f8ba74b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217852, "uuid": "02d00271-4bb4-44e7-a56a-ca2622bdf46d", "value": "T1B2860787B8C24986C5F43A77B8BD80C432631EBA9B9752566D05FE3C3ABE1D90E34354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217852, "uuid": "226edf5d-9758-479d-8cdd-9d6a8c488ca9", "value": "49152:wGnLRG1/h7DfthAXxVILITKF6/+tdDKBgM+QyZtF6pjldmb7mcRbj+rG5Er:RnyJHthyxG8G6XyCjlda6cNj+gEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217852, "uuid": "96d1605f-9e5e-4f08-9f3e-8fafcd58053d", "value": 8061076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217852, "uuid": "1daee0b2-2709-436c-bcbb-05fb3766b644", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217852, "uuid": "5eec3bf3-9f64-4a2b-b966-1015fa770357", "value": "kswapd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404a3ef2-1d24-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773217695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217695, "uuid": "011a1ec9-9855-4e27-906c-47fb6d10d8ff", "comment": "Malware payload (Mirai)", "value": "972f486f9ae0215092b0a95a446c9821", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217695, "uuid": "0958037b-b801-4e04-80fa-434946b2c937", "comment": "Malware payload (Mirai)", "value": "fc83982913bf7b3e03f0cc1c4e00b0e02ba91db545628f68266f77d90fa282f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217695, "uuid": "3ecc1e67-f6e2-4ea9-9796-ba72cf1ca99a", "comment": "Malware payload (Mirai)", "value": "6e6591e863e7ce2be40229e68119d29ad1734e39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773217695, "uuid": "7640e28d-645b-49ff-8e30-f11a68ddf11d", "comment": "Malware payload (Mirai)", "value": "d8809c638e3796b3a47cc6e5258192a95e0bb85a2ee4661a8b7db4515ac78005974bf692da2b06b0b5756c55cd474e90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217695, "uuid": "1c9558ab-7ba9-44f4-ac85-8d093e10e451", "value": "T187A5335D18A8B07EFFEDBED874C73B06282D958631355B8699C8869F5E0C40F06ADD0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217695, "uuid": "f375cb10-02d7-4425-be40-86a90e8625b2", "value": "49152:uNmVPZviMdTyIWIujr4S7csqrBeG6PzpmJzNW9s:0qVYXIu57dqrc5pmBNWK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773217695, "uuid": "223228a7-16cf-4a78-9758-eacfc88e67f1", "value": 2179040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773217695, "uuid": "b43dc97b-9a3f-47bc-ba58-db0131a030e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773217695, "uuid": "bfae4207-6195-43fd-9a7e-686975d6f3bb", "value": "ttmswapd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e86834-1ce9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773192311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773192311, "uuid": "224d5f51-0517-4e8b-8e10-df6e02b21e64", "comment": "Malware payload (Mirai)", "value": "6b9bd6505fad54698ea43c211e66fb98", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773192311, "uuid": "388b4c2e-46fa-4dd3-bb76-8e8ee59ab99e", "comment": "Malware payload (Mirai)", "value": "fc8f2d1594b27eb9610ab0402c6f146498727d923d74045d385819bc049318d7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773192311, "uuid": "619bc6a1-3bea-448e-abaa-ab8beb13a708", "comment": "Malware payload (Mirai)", "value": "74b0d149190ada371929d6d1abe1d503dd811d84", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773192311, "uuid": "214e09e8-84cc-4163-8581-390d3fa88aef", "comment": "Malware payload (Mirai)", "value": "53516ad52ae715c7583cb2da24a578448c99705cf3521d11a9537c6739e8c111107941f6b3a69d2b7da1d01b4a15f6d7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773192311, "uuid": "1ccc398d-8858-4610-bba4-06d1e78675df", "value": "T1F60144EF11711F72835CCF4CAB7548245006E9D0F6631B88994B447A8DD978ABA25FC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773192311, "uuid": "06ea3b06-98f6-47c9-b6d2-85a152201861", "value": "12:xyxoAwR7ZNIjlTfCiKl28F8xt90JUFG10GjQf6PZ7s6JjhqjB7n:4xUHNIpTKlkjSlU6Pdl+dn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773192311, "uuid": "10f63df8-c3d8-4a33-88bf-d8b1b57d9682", "value": 822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773192311, "uuid": "6a1fc49b-9331-400d-a5cc-c0ffe58fc8a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773192311, "uuid": "8c20a57c-9ec5-4871-a9b8-9193bc0e8bd5", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25b90963-1d6f-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1773249863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249863, "uuid": "3eb21ca6-7812-4168-b98f-eeb288e0c45d", "comment": "Malware payload (WannaCry)", "value": "f4801be4bad2b235893d388d78a628cc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249863, "uuid": "462a48f4-3e26-44ee-a836-f721f7b43950", "comment": "Malware payload (WannaCry)", "value": "fcccc9a6bb99ef779ec50bc4b2e8d4982400f29fa19c92d67e28ba2804fcc149", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249863, "uuid": "82b36224-0c3a-409e-8059-f5e9533f9d19", "comment": "Malware payload (WannaCry)", "value": "ffa8939d1aa4885a0c7b0947832c74a0c85d45a4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773249863, "uuid": "33455b8b-ff77-4ffc-8abc-28503c477601", "comment": "Malware payload (WannaCry)", "value": "21c43ffc43a3e811a8e069e4bd41c489d196b1a25bd27abcc02ddda9e02ecf1c4118301d4c81f1eecb9a79e83a6615b7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249863, "uuid": "2233f1c6-d175-439a-9b6e-3e73c017cb9c", "value": "T12C3633EA71BCA1FCD10579B544B78A13F6F23C5E22FD6A0F5B804A660D03B59BB50A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249863, "uuid": "ae5e9030-97b5-4bd5-b6dd-ae0f4a8db614", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249863, "uuid": "916f0f9d-da73-4171-8b7d-e4e130ac036b", "value": "24576:RbLgurgQhTdmMSirYbcMNgef0QeQjG/D8kIqRYoAdNLKz6626M+vb8VXmiHkQg6G:RnsQ2MSPbcBVQej/1INRx+mX1HkQo6S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773249863, "uuid": "ba17bef2-d850-4e84-90f3-6489ef40940e", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773249863, "uuid": "3f55399f-1ccd-45a4-a925-076729a6475c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773249863, "uuid": "ea184388-08d5-43d8-b9ab-febdf6c5a6e9", "value": "fcccc9a6bb99ef779ec50bc4b2e8d4982400f29fa19c92d67e28ba2804fcc149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054f53ce-1d59-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1773240360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240360, "uuid": "83195985-50dd-4271-bc7c-645efdcae9ca", "comment": "Malware payload", "value": "96bac2d06f58de3694d4dadbca699c97", "object_relation": "md5", "Tag": [ { "name": "194-102-104-222", "colour": "#D2890A", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240360, "uuid": "9b43401b-70d3-4471-80fd-8f5ee899406e", "comment": "Malware payload", "value": "fcd9f0a39b3e64d352e9e55df8d4b033814e65ee1c9ba299a5ef9d5e31829c29", "object_relation": "sha256", "Tag": [ { "name": "194-102-104-222", "colour": "#D2890A", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240360, "uuid": "9f9abe2d-d3c1-495d-8d70-d3a00baeaff0", "comment": "Malware payload", "value": "57c83dbae8aa3789ac1e97f9427442b92ebc60bb", "object_relation": "sha1", "Tag": [ { "name": "194-102-104-222", "colour": "#D2890A", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773240360, "uuid": "75382a4e-6392-482a-bf5a-ffffa02e77ac", "comment": "Malware payload", "value": "72f91246d7fe78de80492709c09e2fdbc6c03cd0fe4a52cd720302a2e9bff784237e6ab7317579d72de692ae6f1ee194", "object_relation": "sha3-384", "Tag": [ { "name": "194-102-104-222", "colour": "#D2890A", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240360, "uuid": "ae7572ab-bf9f-4010-b3d3-d520f65eadca", "value": "T1F5D523AC763325F0EBEC99B53A6A178717E21774DE1D9214493C29BE3E5A04E0C89D0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240360, "uuid": "f39a1a94-50cb-46a9-9581-5c0ed8791832", "value": "49152:+bTL/DjxZDwKW6Oqs6bT+H1UMVrP0L5Wdq5JnMC7s3TFrr4tAg8wA:+7/DjrDwKW6Oqs6OH1UYsL5WdIKC7s3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773240360, "uuid": "1344055c-81be-4dfb-8c9a-7ab5736f898c", "value": 2914074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773240360, "uuid": "26132606-c72c-4fad-9b40-42496fadff4b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773240360, "uuid": "c1d2fed4-cc79-493f-8547-5c2f0cf63399", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c3d04f6-1d8b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773262061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773262061, "uuid": "3d5a61db-96b0-4531-acba-c62f73f45d76", "comment": "Malware payload (Mirai)", "value": "7329156a4f2f87701970e1d139d27c7d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773262061, "uuid": "f06eb60c-f5cc-480a-a21c-6fe9c5a0e202", "comment": "Malware payload (Mirai)", "value": "fcf601740994019ef3d38736ff4e823d7884fdf67002c08a43e447bc98cfb937", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773262061, "uuid": "c3a16596-0e5c-41c1-ab5c-37001ae6ca01", "comment": "Malware payload (Mirai)", "value": "8a5f7aadc43b9ca29b0f1c71b00e1e3b5c67d0bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773262061, "uuid": "d3e6deb3-9f3e-4031-9043-a3aaa594402d", "comment": "Malware payload (Mirai)", "value": "b512464159681ca9b1f83e6896ab2e3841470334bb9ec65dc3af0fc12f5ab31747b20ec266fd32ef2a7a12c7b7b0d273", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773262061, "uuid": "eab02b2d-0fb8-45db-b6b3-8b480930a477", "value": "T1E883A54E7E218F7DF76D873547B78E26975823D626E0C644E16CE9001E7034EA81FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773262061, "uuid": "a16e035b-7da4-4ea1-86ea-eecb551db360", "value": "1536:4afnr/qRCcGJF/Wb0dty9QUH7xVOjdlef4C9XBRNnXxWhB6yG9g:4aPr/qQFJ3tIQedUdlef48BRjWGyYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773262061, "uuid": "25b4c51a-7274-40d0-b2ad-7b6eb0c7bea8", "value": 88660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773262061, "uuid": "dda12127-37d7-4a06-af94-1b10a1462b8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773262061, "uuid": "58653a4a-0c28-4a31-8d37-d9ae3c6c2712", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837f06cf-1d7b-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1773255174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255174, "uuid": "8acda125-e85e-455c-9b74-ce5bba84ad1c", "comment": "Malware payload (Mirai)", "value": "1fa4b5b9bfc1f9e68a7c9674c3649117", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255174, "uuid": "b4b6c379-c065-4e81-9e55-13dd021e661c", "comment": "Malware payload (Mirai)", "value": "fd0cc0e6b2972930f4ca1a2c366287377262c2828e3131809eab665a0c278526", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255174, "uuid": "e8298ae4-05bd-4134-a7ef-517320e4d0fa", "comment": "Malware payload (Mirai)", "value": "69f0993fea58cb33d8d5fe6d47f196458f1ebe54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773255174, "uuid": "062a2046-0750-4711-97ef-15b9cde88e70", "comment": "Malware payload (Mirai)", "value": "5f127d8a29e50d0aa019ca005c4ab2fc37a235747e0100d61731aaa3aa4cc175877898bd57535e05fba366f0c4899739", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255174, "uuid": "0499101e-53c1-45b7-b761-4b9509e40a2f", "value": "T1EC263A57FC9155A9C0AED230CA6292537A717C485B3023D32FA0F7382F76BD0AAB9754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255174, "uuid": "23eadf54-8d7e-428c-8d0d-d4ff69f2653e", "value": "49152:uSX/A6wuN9W9Uh7u6hjJQkI2LjM8pzkXT5EUX4AOv2EKZyhBNLK8pl:t4nU9W9U9PC2LjMcoEUsvY0KE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773255174, "uuid": "e97a3f10-baaf-4cb8-a234-fadea473c76e", "value": 4841624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773255174, "uuid": "7ea2acea-54cc-41d2-af94-c5f96419826c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773255174, "uuid": "421cacce-97da-4a7a-a71d-3ec8d9769967", "value": "boyl7molon.old", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2615d7db-1d11-11f1-a769-42010a9c0008", "comment": "Malware payload (VoidStealer)", "timestamp": 1773209491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773209491, "uuid": "851d8e96-ce86-4850-9818-d64d35cf911e", "comment": "Malware payload (VoidStealer)", "value": "86cdad1d928edc3401328786054ac146", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VOID-MONTHLY-85185E724665", "colour": "#762FFE", "exportable": true, "hide_tag": false }, { "name": "voidstealer", "colour": "#8A5A75", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773209491, "uuid": "afcb7bbd-0523-4305-a30e-bd7cd47ec043", "comment": "Malware payload (VoidStealer)", "value": "ff6e13de81fcfda3a6bca573c6f23ed5150a233f3c4c0ff6f6a81fffa0583377", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VOID-MONTHLY-85185E724665", "colour": "#762FFE", "exportable": true, "hide_tag": false }, { "name": "voidstealer", "colour": "#8A5A75", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773209491, "uuid": "20176e7b-0e1e-4c51-b4d1-fad8d70cc595", "comment": "Malware payload (VoidStealer)", "value": "e22a1059c2d77a407965e3f17eff2f0611545d0c", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VOID-MONTHLY-85185E724665", "colour": "#762FFE", "exportable": true, "hide_tag": false }, { "name": "voidstealer", "colour": "#8A5A75", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773209491, "uuid": "84564fc8-7b88-4cac-983a-b41022d72e50", "comment": "Malware payload (VoidStealer)", "value": "6fd885c3c276b13076a8697528e360a2214ed50f635f9ebd131a165042a1d22d25c063403c07ad9ac7699604fc4a1030", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VOID-MONTHLY-85185E724665", "colour": "#762FFE", "exportable": true, "hide_tag": false }, { "name": "voidstealer", "colour": "#8A5A75", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773209491, "uuid": "9c913be5-4a03-48c1-a285-56645293f803", "value": "T1BAF733F463F5EC68D4F1D87EF36088787A1CD2730B8BA169A26DC8D551794F43708A2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773209491, "uuid": "04f1e851-b784-4953-8a41-9eb428b78bf0", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773209491, "uuid": "f2b98632-cfe9-4036-a85d-0f76bf8f98af", "value": "1572864:3xejOYfiGmrb8UioUVPcAhr//C4Rnx82h3eVV/1yveF:3x4KG87itVU8r//Cwq2sVjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773209491, "uuid": "a75eff8c-0fae-4383-a185-c3885d3a072d", "value": 76589558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773209491, "uuid": "20f74f82-7f15-4844-9af0-a2ff307400e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773209491, "uuid": "6de0e7b8-d540-4a81-b6ac-2e81b242fc9f", "value": "Realmsouls-Installer-Wizard-1.4.2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a96bf14-1ce3-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1773189795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773189795, "uuid": "42d7c82b-5f6f-452b-8215-b6bc0d3bf786", "comment": "Malware payload (Vidar)", "value": "7928e6069e7037b9c1a8e49daacc5498", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773189795, "uuid": "b44c167f-e932-4c25-9f41-ecaf17f91193", "comment": "Malware payload (Vidar)", "value": "ff87e5d5b79f1764c7eed48b31d125676ddf33bade6dc092e9710f46432f1b3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773189795, "uuid": "98c799eb-d846-4738-9cc3-5762c59aaa39", "comment": "Malware payload (Vidar)", "value": "a19e22bcf00525ca243510e6fe0fddabf7880832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773189795, "uuid": "2b99e187-5967-4b2f-8c9a-f1aecbe6dca9", "comment": "Malware payload (Vidar)", "value": "95615ae2bc6ee9e565b2552a25b7bd53ca38ba12fb10890bf2b898d756d899c845c6fb504984e852edcca4cd3820be28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773189795, "uuid": "1cde8406-4918-45ae-b0d1-39c52336d247", "value": "T162B6E62B229085A8C1FD823BC1A28F40D5FF65B55B32C6E7FF905FE44A568C45E3A5E0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773189795, "uuid": "619552dc-9c17-4d54-bd5b-4d20f9125ce1", "value": "be27ca3e2433d9854a57851ddb822150", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773189795, "uuid": "029a0938-f36a-471b-a6d7-270b710d8fe7", "value": "49152:J24+J84zmrSOJ30Fz5h/cetKxvqS9TWNKDKv+yUMCUYfwieJ7ivXeGOSsl3laVgT:JgI2AmsvOPSA31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773189795, "uuid": "c1770069-63b3-4e0c-ab65-11f788bda7d3", "value": 10575872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773189795, "uuid": "53c48e62-5c48-4df4-b60c-15b129c0b7a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773189795, "uuid": "c70afdbf-dbf2-4d2c-a2c8-9c97952e5e55", "value": "SecuriteInfo.com.Win64.MalwareX-gen.85557415", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241b6d0a-1d5f-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1773242989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242989, "uuid": "8b08b14d-f648-4e67-a286-8101b96e5f04", "comment": "Malware payload (ConnectWise)", "value": "99b7619ca08e23460ac39e783d0e6d1c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242989, "uuid": "705e497b-33b0-40f2-beb3-ed8d06b3e388", "comment": "Malware payload (ConnectWise)", "value": "ff93759e80f3c471fa164b1d228d6f40d6632546d3fbe96e9bfe75ba591d92db", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242989, "uuid": "f7364dc9-862c-4c05-b1be-edf47ca3d59f", "comment": "Malware payload (ConnectWise)", "value": "75fdca9272d247f9582beefaf5d484c968a1db22", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1773242989, "uuid": "817a7cf6-a5e0-4f24-b43d-8aa36fa001ce", "comment": "Malware payload (ConnectWise)", "value": "35eb479f38f3a55175fc6ac2ad579b4766306aec2dc8f4e1b47cc6388dd84da0d2d37585cf832e4e463decd77a19be6b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242989, "uuid": "0451d83d-7e09-4b2c-b0dc-cb33c532a847", "value": "T162D61201B3E69574D0BB0A38D87A9266AA31BD005716C7BF5794B92D2D33BC08E32777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242989, "uuid": "9dfea038-7e95-40bb-a88c-b7920884e9ab", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242989, "uuid": "b38fbf35-325e-4d47-b11f-1e771709ca13", "value": "196608:2fefPlBn2hg5kEWmXhcfKjSV/h7vGecBn2hg5kEWmXhcfKjSVJBn2hg5kEWmXhcu:rgdEEij4DGBgdEEijsgdEEijAgdEEijs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1773242989, "uuid": "e96eadf4-b1e1-42b7-9183-62032e5af890", "value": 12637240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1773242989, "uuid": "7281d905-fef5-49a8-a50c-1bd732203105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1773242989, "uuid": "cd7934ce-6df6-444e-9460-c48371834ade", "value": "Statement_05574_2026-3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }