{ "Event": { "published": true, "date": "2026-03-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-03-03", "timestamp": 1772582581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d6e489f3-cd61-44de-8984-1c54fb2b0659", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6ed6acf-16a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772502863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772502863, "uuid": "0b18f1f2-26bf-403c-968c-32f0a2cf3111", "comment": "Malware payload (Mirai)", "value": "a4019e6318d1ef179ae52a1d8e37effa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772502863, "uuid": "42b42b35-fa61-4fc7-988d-5c511b471719", "comment": "Malware payload (Mirai)", "value": "00373ae35c7a9b3306787a9b4d686e59dfc1a4790df78a4a84a30016b0005731", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772502863, "uuid": "24ae4032-6871-40d7-aaa2-e3f21cb9e757", "comment": "Malware payload (Mirai)", "value": "fe0a95b2db43695a5cce40e7cf51ac904cd65d37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772502863, "uuid": "3a5fae23-cf18-48c3-a1ac-19bc1ac1216a", "comment": "Malware payload (Mirai)", "value": "432f03eed059323cbb40c0468d8cdd20cdb245d516b060c5f5bcabcd4e0cbb69f4e5088ca7f515372e6f0a8a5be2b4cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772502863, "uuid": "46cca3af-5c82-4798-9ee3-7ab7db18b604", "value": "T1CEC31859FC829B15D5D526BEFE0E528E33131B6CE3EE7212DD146B2427CA95B0F7A002", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772502863, "uuid": "1bb74f81-2f79-4a0d-a1c9-01f2ca66db2e", "value": "3072:QDtiEoz51jaJSF+bcgOIAaaGv6aSmFxvJtKMLzLQ3lCtv2FWkl:QDtiXz51jaJSF+hOLiSaSmFxvJtHLzLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772502863, "uuid": "48d2f9a0-2604-4a53-915c-a16b9e997b72", "value": 119784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772502863, "uuid": "9fe99faf-c8e1-4c9c-ba98-4225ec27ef41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772502863, "uuid": "efa9ecec-fd52-4ae6-888a-4c9a673815f6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13ab7be-1727-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772559493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559493, "uuid": "23ccdd6e-686a-424c-8f86-f620690724a2", "comment": "Malware payload", "value": "318f4fa2a90d7d3cbd23b8678bd105d6", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559493, "uuid": "7ea12ff0-acda-4537-80a9-2bc7813c5d2e", "comment": "Malware payload", "value": "003be86cfc64e7e86f504d080ebb79b15a127cb15a494dd2c80c5833cb496a36", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559493, "uuid": "86793529-0644-4e9f-b4e1-91e57bec1d24", "comment": "Malware payload", "value": "2c123b3f29e989f746686ef2ad46bc8ade84f0da", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559493, "uuid": "c24ed37c-0910-43b6-8329-e7ab2c2f152c", "comment": "Malware payload", "value": "fd5ff659745bcdc58e7aa1ed5ad5286fc8d9d31bf60fd4bfac0ff815c5e8f9035280db822ad73310af1fdd8c5b3a4a1c", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559493, "uuid": "c5b7ba33-3148-41c2-bd24-c8b4d3102962", "value": "T1D5322C3373A8D6B882C252B5A1E96701417F460E81127D1CBAECCA264F512DF8BFF59D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559493, "uuid": "cc8fe267-a696-4bd4-b88c-116ed188a555", "value": "192:QHPYwPg97/5pwVfZhD/jMG19yTVgUYyU4rVeVD1/8eqBDLac9+m3qR6TxrfIRl:QHPNPQ7/5pwVfZhrf19yTVgURk2eq9li", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772559493, "uuid": "34181d35-c3bc-4463-a16d-3d3d33f74186", "value": 11364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772559493, "uuid": "9234404e-1a7e-4a68-a674-155efea5d05c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559493, "uuid": "6132e98b-9552-4f91-93b5-3ea6d2529a90", "value": "003be86cfc64e7e86f504d080ebb79b15a127cb15a494dd2c80c5833cb496a36.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76218ce6-1729-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772560226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560226, "uuid": "4608ab13-1d8f-4377-b0b4-3e189ff16047", "comment": "Malware payload", "value": "326d199a13d3a052f592551829412223", "object_relation": "md5", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560226, "uuid": "f9746510-ddb2-4023-a85c-65cd1a78b32e", "comment": "Malware payload", "value": "022c96fbeedce37e73b9de69b662115c9286fa51c7d178c5263b6ec5f5599a8b", "object_relation": "sha256", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560226, "uuid": "7271d607-4c57-479a-8016-e5bc751ff7a8", "comment": "Malware payload", "value": "ddcb4ea3c2d69dbebd2c0784446ecc64033a5e00", "object_relation": "sha1", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560226, "uuid": "7fc3896d-2842-4a6d-8d9b-7552d3e1d21f", "comment": "Malware payload", "value": "bf3ed3684e0cf76c26e7ca135b28b746484c016a9a45bf5843a1d82123f6d154ef880e544d782d166d516325e066d871", "object_relation": "sha3-384", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560226, "uuid": "df2db972-e54a-4648-b936-3e782a154362", "value": "T147513229D5C6E911D95FA077D1CCE2CDCA8EE640A611295B0E602A478B4BDD03F276CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560226, "uuid": "5e5766be-9066-475b-8b99-da15e46b53b8", "value": "48:9y8MDefnDjtPEeAH6N6HuMZV6Jd5fzlzlKKh5NQmo5Tz+8PX02PH6Yp89LFe9G9+:oDmnBAHyM4Bx5QmodtPX02/lpksCt7B+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772560226, "uuid": "efc66133-26d4-4cc6-9218-7205e1e2aca5", "value": 2565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772560226, "uuid": "3e28e381-3811-4363-ae4e-b68cad034e9f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560226, "uuid": "53fc3ca6-4c66-451d-9577-436d2145991b", "value": "022c96fbeedce37e73b9de69b662115c9286fa51c7d178c5263b6ec5f5599a8b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f31df10-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772518902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518902, "uuid": "e2776d10-72b7-4185-853e-cb35dae9a832", "comment": "Malware payload (Mirai)", "value": "3766cec0fc22e63d6d51800a1f853faa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518902, "uuid": "3e494176-7cf5-408a-9cad-9ee2cc92592d", "comment": "Malware payload (Mirai)", "value": "02b884806382cee54c3b4d9665768e13aec5718739f23bbd1162d96723e09abe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518902, "uuid": "c34c30f0-1f6c-45ab-b8ca-e623289037b0", "comment": "Malware payload (Mirai)", "value": "606a7f9f712a7ef28899d5e73d1049a059e5b616", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518902, "uuid": "6449e875-bc5e-430e-9913-8b4194199dad", "comment": "Malware payload (Mirai)", "value": "13108f0daae96ecdcb5e0287914f18eba279fac1d89131ab0482fb3fafca67d2531246aafcd45244e982cbbca23ab3e1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518902, "uuid": "24e68d61-9d64-4b6c-aeb2-bcc15ce9c4e4", "value": "T1FF832829A87A2A17C0D4A13E12F78715F1F6330E14B0CA6D7D760F8EFB54680A55B3B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518902, "uuid": "3f09f3e3-792f-434d-965f-93c0fecd5c4d", "value": "1536:xURSo05BMjMOsvlGQlSCVQZsJjSqaVeXVTQFlERPZF:91IoOKlmsJj+VeXVGM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772518902, "uuid": "4355881f-a26e-4539-88d9-9dade0389644", "value": 86648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772518902, "uuid": "b8deb3b6-8702-4517-9131-8ed009839c2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518902, "uuid": "2ffb6ec2-456a-4bd9-ba93-b973e4f1cf50", "value": "nullnet_load.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be8bd4e3-1727-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772559489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559489, "uuid": "e5c01f26-409b-418f-a8a5-357c22707d61", "comment": "Malware payload", "value": "8704fd68cfc981978710ddb539e0bdeb", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559489, "uuid": "7e7d2567-8c97-4ade-a419-e475b07aa8ec", "comment": "Malware payload", "value": "02ce59ce3bf2da44ec665107ed382dce4bdcab7ef2a8551ac6b2862186161eb1", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559489, "uuid": "e6313bd1-df86-4fc4-902d-9366676c7ac2", "comment": "Malware payload", "value": "6bca41a41b312ad7255acad8d7e6b07c6ccf1077", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559489, "uuid": "49e305f9-46c8-47eb-92d9-5643dc46a0e8", "comment": "Malware payload", "value": "b59f38abd0b237d9e1783aea444a154e1eb40c5b241e6fcdd914397a6988eae8fa041120ff950d5f36e382894c74f616", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559489, "uuid": "51e7abf9-a6cc-4c87-9543-bf5bfdddc33d", "value": "T1FB322B336328D5B586E76272B0A523016637420F92013B68BAFDCB069B407DDC7BE66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559489, "uuid": "bb790ff0-f8b1-4c85-bb87-11c56c059843", "value": "192:flPYBPgN1nVVVZuD/jkoGDtEubVSwbKeXQ0q8eDAKLa7Jo+m/15scQNstjQ:flPmPq1nVVVZurovDtEAVSofde0vJols", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772559489, "uuid": "9cb715b1-ea5f-4768-b288-92ff34f79ef3", "value": 11340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772559489, "uuid": "b0db9c80-5c1e-4fb8-8795-7186e6b9a928", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559489, "uuid": "d5d6bca5-78cc-46e1-a5e5-498d34384ed3", "value": "02ce59ce3bf2da44ec665107ed382dce4bdcab7ef2a8551ac6b2862186161eb1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2007a826-16df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772528299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528299, "uuid": "133c41cf-411d-4422-9e3e-2923aab94d25", "comment": "Malware payload", "value": "be6829d49206208067accae233a0d15e", "object_relation": "md5", "Tag": [ { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528299, "uuid": "bf3ae00a-af13-4582-9032-480a04389e24", "comment": "Malware payload", "value": "032922e952f5f67582ad5a894920794f89b459c477499bd56e57c60f5559f6b4", "object_relation": "sha256", "Tag": [ { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528299, "uuid": "cd4a866b-9e15-445c-9cd7-ca9764eed1ea", "comment": "Malware payload", "value": "49626909bab402471210d34084b8ec0feaa4734a", "object_relation": "sha1", "Tag": [ { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528299, "uuid": "0b0473db-b0d2-4325-8822-4e7cba44d1af", "comment": "Malware payload", "value": "20f5245c7522b7ff47d5d7145c7056aa8147cb981133cf2626825961b5a88ad5162b53585e88e93c0430f522e10724ee", "object_relation": "sha3-384", "Tag": [ { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772528299, "uuid": "34968d3c-54fe-44e1-907a-df3c78ef4e33", "value": "T16CB6336CD77F0627FEBB2A31AE91CE1E971D87A52059B40F5F8D06D38C82490274AC5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772528299, "uuid": "e7b9dc12-7659-4a6e-9201-f233ff8db44b", "value": "196608:wYIfpCv4hVdVhP40osM57wu9Qa3LVgIg+PpSpfVCSvGsedfpwecQX8U3Sx2ZD8ec:wdfpCvMV/hP+Nwu9FLVgf+Pi5eJdOech", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772528299, "uuid": "2e4b3ef5-0e30-4377-98df-9a5e027652a3", "value": 10534819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772528299, "uuid": "5808e7ac-e23d-45d7-a68e-aeedc689ebff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772528299, "uuid": "c1c30776-502d-4a0b-9c50-9f9df5df4a57", "value": "032922e952f5f67582ad5a894920794f89b459c477499bd56e57c60f5559f6b4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b07aae-173e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772569222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772569222, "uuid": "8d9aabc6-1d72-43d8-b9fe-bb29ececcd23", "comment": "Malware payload (Mirai)", "value": "9b32abeae58c324b7893ec11717cde16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772569222, "uuid": "c50c9c19-8f9a-4762-89af-a0150300a5d7", "comment": "Malware payload (Mirai)", "value": "03908b14289d4e8a67f1534d69d91f797aa027c0be72a22df0660f1221053779", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772569222, "uuid": "7fe6ecf7-87a4-4809-843b-7bd2fe70d375", "comment": "Malware payload (Mirai)", "value": "3e6d2f0584cd1ea8af913413f7510a7ed50f934e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772569222, "uuid": "993f2fb5-44e5-4c75-b435-fbc9f834b67f", "comment": "Malware payload (Mirai)", "value": "dc8d77955a0695fcc8084972f37ee067174dac7bdfe386f3aa05c8b961ed9fa4fc59c93d4b77fe75d98ac56d54cd1214", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772569222, "uuid": "2a898b84-ec64-4e5e-8ba9-4b114e6a1345", "value": "T1ECF2F13A86A115DEE53698774F4F07201BAA0FB227D2CD901D35D576EE834B9284EBE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772569222, "uuid": "f57e1adc-b35a-4e76-9305-499159b34a78", "value": "768:PlWqYyhC6/x3A8xLZuqjNyNGDIhjJgGlzDphMgEI:Mq+WxQMFkcDIbV0vI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772569222, "uuid": "2ac7d665-339d-4a46-82a3-c2f33804bdec", "value": 36360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772569222, "uuid": "16c8c405-c649-4025-8dc0-7e69cafb24a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772569222, "uuid": "b18f6723-ac85-457e-b76b-fffed0dd59b8", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "135a2af5-16d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1772523983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523983, "uuid": "2af184af-8d46-4802-b830-59bf993981a5", "comment": "Malware payload (Hajime)", "value": "f79348bfcbe1e04eba21ef41ce85846c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523983, "uuid": "c0abbf15-d8f2-469c-ba30-9f0caf3fc9ad", "comment": "Malware payload (Hajime)", "value": "041331a7f8ee39d151eaf454f0ded5f1d40da4210f2b9ae6d0ad1b7d9a89409f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523983, "uuid": "f330b82f-2efe-48b0-b32d-0c26a9745f7e", "comment": "Malware payload (Hajime)", "value": "4ea2210357483b16e9944f55e458b85fd552785e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523983, "uuid": "5f9be4cf-9a78-4a77-9274-6e76ee5c64f8", "comment": "Malware payload (Hajime)", "value": "9a7c1934a70462584470f09a46944929aa56ee452a5c09127616e3fcb5eeb73a0dda8065af73dbe2e0159c1dd912edda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772523983, "uuid": "9cf6c147-451e-4e61-a9a7-d73e29aff463", "value": "T19EA2F187279D3743A86256F4F27D7F8972026EADAF7F582B4045316320A311FA64887B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772523983, "uuid": "07566e8f-a2d5-4561-a4bc-25bc26cd6290", "value": "384:YTYXvQDuYY2xZ6VTgDK4mpwTl5yejHSDeWBbo7hcXBOo3g1qs9Lz:YTYIDfYG6ZmewZ59+Nw1qsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772523983, "uuid": "1cbccdfe-1e29-4266-bc3b-428400ea35c1", "value": 22916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772523983, "uuid": "5ac413e7-1844-49a4-81a4-3fa36d9c3c2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772523983, "uuid": "62aa53ab-d006-4d97-961f-87576f683fc7", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2931e66-174c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772575441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772575441, "uuid": "3b820fe3-5f65-43cd-bc9d-0236ac43c64b", "comment": "Malware payload (AsyncRAT)", "value": "5c7a8e944d88e82c09612fd70d767ceb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772575441, "uuid": "913dd0b2-efe7-41b5-ad16-c5d8c236b914", "comment": "Malware payload (AsyncRAT)", "value": "04349e82927bd45cab42e0943dccc81a04c94baea252a1dc678ccdf4ee58b061", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772575441, "uuid": "2b12f572-0b88-48b7-8789-4dcbf895d919", "comment": "Malware payload (AsyncRAT)", "value": "e9d8091fa12d10eafc4cc6ae171c34467023e2d4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772575441, "uuid": "af4567af-7d52-4d11-9fad-58c1169ef42e", "comment": "Malware payload (AsyncRAT)", "value": "bd71aedb1d7dc3276236c04759b44dbe898afbe57c79a5e5c633e9b9629e94d1dd8b558df66410c78d67e53f3e245b79", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772575441, "uuid": "2ddda6fc-8e0e-4a21-954e-b594bb562cdd", "value": "T1DFD23B08B3D88561E1FD57B94C7293048775EA5BA973DB9D1FC440AE2A23B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772575441, "uuid": "34b6ae47-9f43-4a30-83b8-2cbd3d30eb7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772575441, "uuid": "aafe6276-a848-4a74-a4e0-f2206251decf", "value": "768:kCWyRRX48Nj8Qcg/cIRGqo+/Rb7fB/dT9/+:zHRRXNNj8Qd1iwRbN/X/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772575441, "uuid": "4eb08dba-5700-47d1-806e-d07c27ca404a", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772575441, "uuid": "4224c7e8-ea38-4cd0-8c3d-fde1f71cd8a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772575441, "uuid": "82978fc9-c52b-40d2-a19c-b1fe324f1bff", "value": "7jiyk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbdb07c8-1727-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772559484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559484, "uuid": "ddade2de-e5b2-4f29-92f9-2bd12788505a", "comment": "Malware payload", "value": "0f6f9d72805946b3fd4dab1f734350c3", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559484, "uuid": "054959fe-0d1c-4861-bcc2-512e15ea21f8", "comment": "Malware payload", "value": "0655086e9a6efe28f8dd5d3ab22938e47ce9ac84a231cb3568623a2f27b5e9c0", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559484, "uuid": "7d17c2c1-6d59-45e0-973a-28acc2ac4c2c", "comment": "Malware payload", "value": "d698214be0a8416ff66ce2ea1f60ab9c87270e5b", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559484, "uuid": "d4a589fc-e5c6-47c0-aede-e0558f58a7ed", "comment": "Malware payload", "value": "92aed64f7a2676b30b94481310acfcda2ae252660ca59e5989364da8323644ea13a3f99d3501c63b18e42a91e7bc03e2", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559484, "uuid": "a8d8fe5a-ecd0-4121-8288-c39e5ee8f65f", "value": "T19D321A33735CD7B843C220A6E4F6B210D57E890992123A85BAFDC9168F417DC87BE64C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559484, "uuid": "7b525989-aea2-42a7-90e1-203eb01801c7", "value": "192:36PYAPg7MJvVlZtD/j+G0zSI3xVvv/08U+e2Yu48ewZLap/C03+mVg5YBLILvn5p:36PTPIMJvVlZtr9ySIBV3/08ZNeL/Vly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772559484, "uuid": "36fa0d86-33af-403e-b8b8-d34c5c28cd3a", "value": 11396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772559484, "uuid": "beea9b81-f4f9-43cb-9082-8b5d16e8201f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559484, "uuid": "84e8f5e9-1e39-4c70-b7ef-6a969cda91e4", "value": "0655086e9a6efe28f8dd5d3ab22938e47ce9ac84a231cb3568623a2f27b5e9c0.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e99375-1733-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772564712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772564712, "uuid": "b508b56d-8e72-4f69-8ff2-16f6130cf2a1", "comment": "Malware payload", "value": "2e8c67488ac278ed0cfd4da1da51c21d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772564712, "uuid": "a8786664-7e3e-4606-a6ec-b3af0ead8c9f", "comment": "Malware payload", "value": "07498f30263ddf0678fc5e1f1ccc974b993046ea305ce3461aa282643e9e0ce6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772564712, "uuid": "fd06a367-d419-4da7-af77-79a1977c765e", "comment": "Malware payload", "value": "be95fe6e74484eb36b4332e2e801eec9c1c52697", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772564712, "uuid": "4640aea9-ea27-47dc-8064-946bfea609dc", "comment": "Malware payload", "value": "d26e8ccdc32a7aa4dfce58cae6aaa4b74e3fda8086121496fd0cf718cdcefbd2778b45c315081a954ca1c0c1bf5e8366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772564712, "uuid": "036c380e-ce90-44b7-b89c-1692ac0d6bc5", "value": "T129A7CF03B2A501E5E4B7D1388AA75203D772B8674731CACF325D06161FBBAE09A7F725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772564712, "uuid": "2e8e73d8-d421-466a-aff6-32c9335c6409", "value": "f0486e7e054aa57188c99b0f71783b75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772564712, "uuid": "26d36802-b64e-421a-b1e2-8ba8bf82f1ca", "value": "786432:h3on1HvSzxAMNZFZArYsFpPvmPvG57OZsc1dy:hYn1HvSpNZXmra8Lc1dy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772564712, "uuid": "95f433cf-c75f-458a-9971-075ef1c06bd5", "value": 46069938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772564712, "uuid": "82161792-92c3-4478-9bd7-077ed6c021bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772564712, "uuid": "cab816e3-de34-49b7-9731-2345c5e8caa0", "value": "r3 aio.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd6c64b-173c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772568504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568504, "uuid": "da7388f9-57ae-4380-bd89-b64214a1ac52", "comment": "Malware payload", "value": "a77ebb5ec54a005127a1dd97e25dc514", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568504, "uuid": "3512f4f2-4b47-4e5a-984e-f0c81d193b23", "comment": "Malware payload", "value": "078c22f167a9c4c734de6988c00338d1569402cf71d5c85809d768e5f358e8fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568504, "uuid": "59a8f786-a845-46c8-9c13-67daecb0b9d0", "comment": "Malware payload", "value": "a25cb451236902083b126d1433215929ed344324", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568504, "uuid": "a899bce1-a8e8-4c49-b76a-4cfbba8e15e1", "comment": "Malware payload", "value": "8e6a16ab27e00297859710fe512250e9aebbcfed5d868e14fb090debc3b8cba66125cb520d7f993a3fd6a00d647aea87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772568504, "uuid": "bbe99e30-f995-4f4f-bace-61eb48f68e85", "value": "T10BF65BC3E8E21ED4C4EE8271D16A425BFA627C091B3823DB1690F7241F37BD4AA76751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772568504, "uuid": "4c4da803-1f83-40a4-9548-89520defabe1", "value": "196608:VEcrBNHAHBE+R4JCVj3a59WKXxlG6EfweNOAKQzW:VEcrB9EiWKnveQ11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772568504, "uuid": "424a095d-2259-4faf-9e26-16540fb35636", "value": 15384724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772568504, "uuid": "8ca78353-8d00-49f6-8f16-5884535d3a90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772568504, "uuid": "5ffb67f6-efef-4d24-97be-e391de0d9134", "value": "sysmonitor", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d4577e-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772519021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519021, "uuid": "72b9afca-1e8d-4664-b3a8-d74111b6c620", "comment": "Malware payload (Mirai)", "value": "686ad6d887165a6d877b04a645faa513", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519021, "uuid": "6b7d5f01-11bf-42e1-b9db-88b1fc284f51", "comment": "Malware payload (Mirai)", "value": "07cbcb6489958a7c6e972f308c6284abeb81e06f66547a911472d991c1e5a81a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519021, "uuid": "abe80a6c-3aa9-4ab0-9c04-5a5ea44d6c7e", "comment": "Malware payload (Mirai)", "value": "6fef602b4db52cb7f286317753d659d72cf3fce0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519021, "uuid": "a2682b40-e804-445e-aff5-a5df8452142b", "comment": "Malware payload (Mirai)", "value": "2e4e57287a407c6dd5c599b4fcb0684cca48651a749a407ce08e4ccf32c1f3b5c670bef846600b9a89a4e2a168221461", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519021, "uuid": "20f087fe-e9f3-49f9-a4c7-b7445e8dc8f5", "value": "T127834C46E687F9F0DC4109B8216BFB31D937A8323220DFF7E7C4BA57A999641905326C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519021, "uuid": "153d8ab4-82e5-4dc9-8d3f-4a4abb05d18c", "value": "1536:aHHDEczfY45I6NfF4NhM4XcB3A54amcQYd3/1SD7zYhCiKgt:IDE4YO7FccB0RED7z/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772519021, "uuid": "3f90bb04-db93-41fb-842d-9f382973333a", "value": 82520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772519021, "uuid": "1a5b0337-e9ef-41ac-9a75-616c7de2ad08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519021, "uuid": "71297d47-d8fc-4fc3-9bbb-6a70fcb9b360", "value": "nullnet_load.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3da89f9-1702-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772543580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772543580, "uuid": "dad5d38e-9d17-431f-8a82-99c64ea808d2", "comment": "Malware payload", "value": "cc1448e7c1a3f724c5703877e9af33eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772543580, "uuid": "d7b2c31e-b75a-4853-baa1-640e0ca9a138", "comment": "Malware payload", "value": "07fb349619b84b7846f20ed121537f86bda484aae9fd492f259eb60ca36cc357", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772543580, "uuid": "dea45895-4411-4f46-839b-f4353a9c88de", "comment": "Malware payload", "value": "dba95a09c903f2d10486a691b051c52890ef21ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772543580, "uuid": "29295c8a-5df7-4417-a704-3431a50dbda7", "comment": "Malware payload", "value": "d02302f804bca66224aa0836aa54d22f64d8ba596de4642e3ba105385e3d06c81f575ffebe712e71e3bc87d7544d9a14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772543580, "uuid": "dca8c78a-50c4-410c-9a65-8b130676f3d0", "value": "T19A937D1279C1D871E57614362874EAA19B3EF9101F619EEB3348137A4F345C0EE36EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772543580, "uuid": "def54478-5eda-4f76-974e-854578cb772f", "value": "71f77a6ef317148cfe24ee2d57d52ff3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772543580, "uuid": "cda9f4f8-a1ae-4b1e-9fb5-451f94d00b3d", "value": "1536:r9WZkQW6SgJQTYKnFL/AaI2XZbxkgD+sr4EDvNwPqRe0Asf2NVCGId8zysW/cdR0:JiW7aWRxPbxkgD/4ERwPqRNAsf2C8lR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772543580, "uuid": "ab02ed0a-085b-449e-9ee4-6a11f07c2987", "value": 89600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772543580, "uuid": "e195a744-fb80-4896-9ca3-80a738af9301", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772543580, "uuid": "6fa4b059-80f2-4ca7-b7e3-53f5e4c018cb", "value": "ups.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d3c0c0-1727-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772559471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559471, "uuid": "83bdb46e-7b9d-495c-af01-7aedf119640a", "comment": "Malware payload", "value": "bcf8155d2cc6f1d3a6bb73fe07228614", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559471, "uuid": "857d9596-c0e6-4706-a3e1-6546691a7aca", "comment": "Malware payload", "value": "0826f822d3ff9b530b6b9632f408ed3723ed42346b6661f365a2c7bc7eaa5a1b", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559471, "uuid": "d2d9db4c-d901-435c-a03c-a23c16b7f817", "comment": "Malware payload", "value": "5f9104db6c5cd739753d010d4494c71b7601dcb3", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559471, "uuid": "87c413cd-b1ab-4c7a-907a-be4f0bfc4c9f", "comment": "Malware payload", "value": "967af58d09f6bb5e02741e1b1077c321fc0d0a90bdb694e9559a7b5f1bef83605b9bd7389bdece933315a753a05b0fb5", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559471, "uuid": "2b7b4c54-9ae8-45c4-b8a6-6b9a65eaa445", "value": "T1B0012593C35FA6BD464241E7E4194314C5552E87A6556A40D2F7E457D0C12CDCEB8041", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559471, "uuid": "4aed3d6a-c149-40c0-a9c4-f2eae2225d91", "value": "12:0G8qF1RCvrN2imUK0mn2i5gnyRN3N+RB2DOexWYFzLgyaISVdUibROWfPcRRUrOp:02F18pBSZjRNd+n2DO6FzLwVdUopPc3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772559471, "uuid": "08950198-e8e2-4bd6-ba0d-6c96eff94fbe", "value": 745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772559471, "uuid": "66f803c9-f403-4cd1-9ed2-da06c1cae872", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559471, "uuid": "d4285fce-3b46-4b95-a5e8-c068f79d3ef0", "value": "sys_init.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d417a113-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772548788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548788, "uuid": "3008f857-28fd-4554-b2cd-ecff4d20958f", "comment": "Malware payload (RemcosRAT)", "value": "bf10f2c31fe545fb68434244dbf31f4b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548788, "uuid": "db5ad97a-b759-4270-bbce-9a67d8a689fd", "comment": "Malware payload (RemcosRAT)", "value": "08e51e36a95e7aa0b388ccab1aa085836ed86b2ef8c0ccc21f10f700029e31a9", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548788, "uuid": "5e0c0762-41f5-4f9e-857a-7bdec9f3688b", "comment": "Malware payload (RemcosRAT)", "value": "99c22b874554e7f4f45aa31feb7557552e43ff04", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548788, "uuid": "5a6feb84-0540-461c-b4e2-c1061dda2eab", "comment": "Malware payload (RemcosRAT)", "value": "f0966852877691dd6baa314c99b377a3b3cbbaec659c5f6da15f946a1029400b638ad0f5387a2008c41b32f24b347220", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548788, "uuid": "0d845d34-1afd-49c3-90d6-057ef34be3e6", "value": "T1A9B22E3EC9899FE0076B31A1A56F7A16A5140323B5382A0D7DCFC5AD3B75610CBB10EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548788, "uuid": "ecddf633-8998-4725-959e-b1a66b553258", "value": "384:KaQ1aGXcQo5ICIDaYJ6YykjyfF3Iv/rDBsfhY88vN7MIFETYXJc1xeD:KaQyQHkCUg+yc1xeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548788, "uuid": "4fa3c147-7f23-4b5a-aefa-93858713a681", "value": 23686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548788, "uuid": "9711d0fa-0bdd-4202-842b-93109d459a2b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548788, "uuid": "c734fbff-649c-4d1d-99c3-8511f3c88b59", "value": "bf10f2c31fe545fb68434244dbf31f4b.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a06323f-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772518894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518894, "uuid": "c958f4c2-49fe-4c59-8c6f-723dfff2ea7b", "comment": "Malware payload (Gafgyt)", "value": "ab57e4390b27659c7d68863b44571f06", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518894, "uuid": "64a86106-9caa-4cd8-bae8-32dc302a1d54", "comment": "Malware payload (Gafgyt)", "value": "0a4381506c6b51f0f849a966a5afc60f136693e3faf6004440a0ebc920b2bbbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518894, "uuid": "be07b4cb-e1dc-44df-9850-cc0a0da5bb99", "comment": "Malware payload (Gafgyt)", "value": "23b1a0641479157600b47fd07a9bb1b41ad678a3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518894, "uuid": "7cb976c6-d348-46c5-8ae4-533addf5caa3", "comment": "Malware payload (Gafgyt)", "value": "30b4c5004d8bd8b77f30760ca5090fc107645b82836b479257b6a61548eb0d4058bc14d02744fd1fc433e3a4af7fe9d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518894, "uuid": "7753ee5d-791a-4340-861d-768e320b44da", "value": "T1D8C3766A3E51BBBEE5A8873107F35F70C399299226A1D781E26CFA185F7128C1C5F350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518894, "uuid": "d8b07d37-54e9-40b9-bd24-e125c9d4a615", "value": "1536:fVNy7K4v/V5KnaVIAsV/NdtkxGTYQH32rKAPtXG/uYe7ealBUD/sNO5e+vg8:KjtSToW/uYePBMhI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772518894, "uuid": "a4ff92b6-fe98-4d58-b487-ee6caf5c39f0", "value": 119167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772518894, "uuid": "c7e62708-d903-4d32-9369-5b60af6d9a15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518894, "uuid": "f6df9fb8-211d-43f9-a944-9b2215b1d75b", "value": "ntpd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e88dbcc-16f8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772539115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772539115, "uuid": "974c87f4-8c62-4177-820a-b9c9afde85bb", "comment": "Malware payload (Formbook)", "value": "0506b39eb6559b3d9655b1b534eea96b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772539115, "uuid": "daed02c1-5689-448f-82e8-991c60e4801a", "comment": "Malware payload (Formbook)", "value": "0a49ae686b7a7d0153f290bd5d125d354e7aca15e095b049f7107a23e53137e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772539115, "uuid": "1caaad63-b9bf-4a2b-8cf0-98b28d623aca", "comment": "Malware payload (Formbook)", "value": "71ca28552e16049e3e0c50341738eb75c6994a86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772539115, "uuid": "9065136d-aa84-4c6e-998b-677ffcd2cf0b", "comment": "Malware payload (Formbook)", "value": "e00e987a0657912d5382de0773d2ea1d2de337e116b5ad2d06018b51e0b2450e6a3c58087dc9cd7e97a3c199e927c7ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772539115, "uuid": "c19fc401-3b91-4093-a19d-7a8d597d9aa3", "value": "T14045BF027381D062FFAB92734F56F6115BBC79260123E62F13981DBAB9701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772539115, "uuid": "d78a6d66-3eb1-46b6-ad8e-3aa910505a85", "value": "1895460fffad9475fda0c84755ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772539115, "uuid": "c7975981-0f09-452f-8c5e-7e1548a3fa7c", "value": "24576:s5EmXFtKaL4/oFe5T9yyXYfP1ijXda+tbMwmWvYaaPZ:sPVt/LZeJbInQRa+8Wv9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772539115, "uuid": "8510bed0-efd8-4a67-8b0a-0fd87776a254", "value": 1264640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772539115, "uuid": "47f15794-99c6-4979-9e78-c9f7d0fa760f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772539115, "uuid": "15b0b04c-afbb-40b9-983a-0823edd6b28a", "value": "Remittance_90523_03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031b3159-1723-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772557456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557456, "uuid": "a543a5a7-576e-481f-92f3-117cb4fddc21", "comment": "Malware payload (Vidar)", "value": "2b034349543f55e4062d94689d59fb0b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557456, "uuid": "c9e09d83-7727-42d2-93f3-dc659b3587ab", "comment": "Malware payload (Vidar)", "value": "0a6257b11f140a1ab6385b0e660cd31a438fdb68a08cdb6573f18adaae1c38b4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557456, "uuid": "427b2ac9-e0a2-40ec-8e82-18863becf8f2", "comment": "Malware payload (Vidar)", "value": "d27ce68120ad646f9354e33ec6f86f9bcb3046cd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557456, "uuid": "d5b1eae5-ba70-4a49-ab6e-dc1f02a00e24", "comment": "Malware payload (Vidar)", "value": "8e981a05e712ffcba16848fb0b6b5184adfc54a34983ac2d8b095f5d826a46e62b88de0bba7e5c3f8418ee5b83005d0c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557456, "uuid": "40f2df9b-4629-44ef-bbea-6a2b95f5e5f7", "value": "T1EF96072B23A59D68C26EC13ACC93CB41D4F3757A0B3FC1E712A5176B5A21AC54F7A720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557456, "uuid": "de7c3c57-dc61-4850-bb66-ee626f6c3769", "value": "9fa09a64686909db97ebc147f2f0d1cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557456, "uuid": "4d1ec98c-247e-4ba1-a801-9f43c6d300e3", "value": "49152:pSC0G9vUq/7AVxLk77pe9wueSuTgF/VWfHOjOoeouBunDfLTTP4qSFnBAAvCB7JH:37b2OoeoSKLqisCAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772557456, "uuid": "14d23f6b-8a4a-43d6-91a6-7302de602028", "value": 8671232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772557456, "uuid": "e9023c6c-5112-455b-9eae-73237ff924d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557456, "uuid": "9a786275-50aa-4302-a7f1-fc5c1ad57db3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea811183-16cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772520908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520908, "uuid": "e80ba94a-860d-4ee8-919b-b45075b22564", "comment": "Malware payload", "value": "22b46b4e19825ba88a8b046b3bb1bb6b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "manchidodemainehdero1234456htdfihgfdsdsg-duckdns-org", "colour": "#4B45D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520908, "uuid": "ffd47e3d-ea9b-4b2d-9783-70e2752946cf", "comment": "Malware payload", "value": "0aa2adae40e8ea0602eca7d14829e2c4e91c2cb326cff1bf30acf04991efa2f8", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "manchidodemainehdero1234456htdfihgfdsdsg-duckdns-org", "colour": "#4B45D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520908, "uuid": "20c0c353-bb6f-45f8-9b9d-df3ea5f6991f", "comment": "Malware payload", "value": "ca23cc8893e8443270c194fb9872bcbb41c7843e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "manchidodemainehdero1234456htdfihgfdsdsg-duckdns-org", "colour": "#4B45D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520908, "uuid": "65c0b6e6-d31d-4a36-9a0d-f33d4a68a8cd", "comment": "Malware payload", "value": "8e8c6dd88fc660474a70ea542fae055385eb14dabea1128aa832e49b7eded2d2ebb1e56d60e08105cb0ad4755f7b3abf", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "manchidodemainehdero1234456htdfihgfdsdsg-duckdns-org", "colour": "#4B45D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520908, "uuid": "bd85ce0a-5433-4e90-be18-7fab5858b4c5", "value": "T199659A36641032AA6CA637A2FF3B7078BC50F1B6728D8D9A3900EECFA75313D94555E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520908, "uuid": "72541ea5-77e2-456c-ba20-5cfdbca0b03e", "value": "768:dliuW1LNf1LZW1Oh7BH/PbLA4/3Ufj0AfhXFrhA24liIgZLA4xL8W1GYelAAeaX7:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520908, "uuid": "0316577e-7f83-4c3f-af16-1c199f5a8424", "value": 1460468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520908, "uuid": "893ad41b-662f-456b-9bf1-67f33dc45d0d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520908, "uuid": "44c11034-0f20-4247-ad73-99274a074e94", "value": "0aa2adae40e8ea0602eca7d14829e2c4e91c2cb326cff1bf30acf04991efa2f8.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127f6c1b-16d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772523981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523981, "uuid": "e79286c6-fbb8-43c6-b9bf-10fc4e16a852", "comment": "Malware payload (Mirai)", "value": "49411d466966ceb7505cd352154b657f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523981, "uuid": "1c70829a-3e7c-4635-8ec0-285874986904", "comment": "Malware payload (Mirai)", "value": "0aea4555589b1b899abc68c1c6e60903e9f79c29d7f817275762fa40505d2f00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523981, "uuid": "6e661c6e-4bb6-471b-a98d-6a1ca6813d36", "comment": "Malware payload (Mirai)", "value": "5d4516b5ab11b632c55a8e23446f744f1b873802", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523981, "uuid": "e84f840b-793b-4b86-9cdb-7ee03293703d", "comment": "Malware payload (Mirai)", "value": "54292f59821bfe6319527cf6965ecac6c54005e7a47ce1776bdb15e531fb989dd54a1ff6f4be9d4542c0a47529cf6b9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772523981, "uuid": "caab54f8-26a3-4458-a86b-a70893f37a1b", "value": "T1DC93734D6E219F7CFFAC823547B74F259248339A36E1D584D1ACEA021D7434A342FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772523981, "uuid": "25f96539-fc46-4ff2-9140-0a3ceb60caa2", "value": "1536:8xJJYl59EG23bgd9HrAcm3pDZxMaiPJPlJ2ix3SIy914+0zH7qbA4ZB83X71B:oul59EG23bgd9HrAcm3zxMaiPR2ix3Si", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772523981, "uuid": "921542b8-0f25-4e15-92b2-74beedbb47e8", "value": 97656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772523981, "uuid": "1cd43480-9c6b-4753-bd4d-c5445c95ea74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772523981, "uuid": "beb8cfe7-01c0-4727-b9ca-74af9b13fd84", "value": "nullnet_load.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ea01765-172d-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772561797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772561797, "uuid": "6ea89fbc-2a48-4d54-8900-38dd711713df", "comment": "Malware payload (SantaStealer)", "value": "a25f5350d3ec57042320990aba5c8373", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772561797, "uuid": "b5728550-7947-409e-a782-ce9dc651e0e2", "comment": "Malware payload (SantaStealer)", "value": "0b29ed2f39b87cbfced859e51110ce32081254449917bd362ff50a7f6fcda4eb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772561797, "uuid": "704c9820-8fe6-415d-ab16-b4dcdf4fcc7a", "comment": "Malware payload (SantaStealer)", "value": "c1cb5b1f896a71ac7d1533cd11b6c682ba994bb5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772561797, "uuid": "a5d81599-9e18-4bc8-ad7f-ca4bad29d1b2", "comment": "Malware payload (SantaStealer)", "value": "06366ec425765440cbfb9fe761803d399de39e3ffa5561fab7957932672cf1f20b2b4e716c9ec7baa639d45bde141184", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772561797, "uuid": "796c1b6a-b60a-4f3b-aa65-cc897b8e6bdb", "value": "T160F6281010D96607FC3EEFBD85DCB6444F7AB2957722EA38AB410DE90FD1B18C9429A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772561797, "uuid": "ee8d7a80-2867-4436-9fbb-0e8f4547ac51", "value": "196608:H0c1TFL8h5y7GMADcw0fWnbQq2n9XmX46paruHaiTLxFQTnZ:HxFQ7rDl0TF9MSAaMN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772561797, "uuid": "b440491a-d310-457b-b0c4-41ed7d66b0cc", "value": 15973888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772561797, "uuid": "d4e97575-88df-4d29-9f97-356eb471c4e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772561797, "uuid": "022117e0-6258-478a-8e94-231a94152fd0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a528ff-1708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772546072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546072, "uuid": "616389f8-743e-4e3d-8b55-1de6bfc7d6ec", "comment": "Malware payload (Mirai)", "value": "0aad6da593bb4631371691c5cdccc98e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546072, "uuid": "407d5e65-d0c0-45ba-b940-2ee2094241fc", "comment": "Malware payload (Mirai)", "value": "0bf3d9d543f72b2b42f1cd0c64a2e08840eb6b892bea2a4b63ea57a7b321963f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546072, "uuid": "cf0f1e63-c3a0-417c-abfd-c5554b6bc82d", "comment": "Malware payload (Mirai)", "value": "6d3f66e1f8563c3dfec7f647288cb09791d7e9b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546072, "uuid": "06be22a8-5ac7-4367-b044-187a5c1327fb", "comment": "Malware payload (Mirai)", "value": "fd6c8482f263bf8a12e32ebf2765cd5df99370dd5003bc9c250a8b4c3c1bd037172156b7fec93126f4e73f8aeeb2378c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546072, "uuid": "796c089c-f0cd-4d76-a79c-f7db56d97935", "value": "T1E9D33B07B6D180FDC4D9C2744F9AF13AED33B1695238B26B2BC4AA171E89E309F5D614", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546072, "uuid": "f1923f8b-00af-4c86-8dfb-06a8bf649dd5", "value": "3072:+Kzk/bIs2eUkmx9nzYZPRZ9tIX5gDCCuD3pIE9fu8vB:+Kzk/bIs2eUkmfnA6lZM8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546072, "uuid": "18772395-db2a-4d4b-8ef3-cc8674eea390", "value": 141288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546072, "uuid": "87531b07-4050-4e8c-8406-88f30c1fb816", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546072, "uuid": "fb8983c4-9dfe-4c74-a3e5-720175ef678e", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f27def9b-16e6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772531659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531659, "uuid": "013c204a-c00b-4ccb-baa9-1c6109cbd8e1", "comment": "Malware payload", "value": "4b7a47b639a2aca7818d111ee7f23b3e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false }, { "name": "vo-msecnd-cc", "colour": "#4EA23D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531659, "uuid": "15675100-72ab-428d-968f-71567e404d2b", "comment": "Malware payload", "value": "0c63857269205f6505c259a56ea53b23b2bf7432aabb8647d59b321232ca7e36", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false }, { "name": "vo-msecnd-cc", "colour": "#4EA23D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531659, "uuid": "4bb9caee-e14f-4dac-a00a-cd1b2d6fcb97", "comment": "Malware payload", "value": "2dd614427b80cdd38e8bbe0ace24a484671c0da2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false }, { "name": "vo-msecnd-cc", "colour": "#4EA23D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531659, "uuid": "c891c516-b0bc-42e6-b53a-5cba769c9c5a", "comment": "Malware payload", "value": "8f15326f77ef4f5582bda8289fbfe8a58f9fe371058cb6fa2b116d6075b53182951ea4fbd1062f2599ffbb6170a1e5cb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false }, { "name": "vo-msecnd-cc", "colour": "#4EA23D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531659, "uuid": "0d2a7e41-ca63-427e-ab53-2bf560456cb1", "value": "T16B535E01B28040B6D1724B3635F5A676C93A2D126BB548CB3B87375D7EF26C1AB7530E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531659, "uuid": "207a2283-9dad-4786-8e75-9ee29a7b0df7", "value": "ca204b9f0006500092402f4a38f0a743", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531659, "uuid": "ac69cf97-cbfb-4dec-b141-83816c98bce0", "value": "768:7+JqwbggNFLor7KvLMLVP3PrW2yTZC0cf7FAhDmdkBdhHqxYrfEDDnBJAc/7eFpZ:iqwb1NFEr7KvLO3PsFojsNQtU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772531659, "uuid": "9b8fd528-b043-450e-86d7-7fa446e3339c", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772531659, "uuid": "31399792-d896-4ae2-a0da-63db32aa7683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531659, "uuid": "b33000ce-378b-47ed-9d6e-cd2340a97d9e", "value": "uxtheme.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ca2d4f0-16d6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772524455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524455, "uuid": "5555e30f-6f8d-4fc8-b40d-412a2f88c431", "comment": "Malware payload", "value": "98294a2c838eaf63fe94cccf52af3ce8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524455, "uuid": "e38c6348-a644-4d15-b7c7-66d76a3c6247", "comment": "Malware payload", "value": "0cba66e78ddaeecfdd462c8cb39e443d083dc58c609b0edc73e8101e59ca91e8", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524455, "uuid": "9426abdc-a174-4cae-8ef2-4e16373fbbbc", "comment": "Malware payload", "value": "dcabe0aa3b8c7e4c682d396060c91491964032c1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524455, "uuid": "9a623ce2-533b-4602-96f8-dd3aab1182d3", "comment": "Malware payload", "value": "047e7a5507bcdcc3f475b181e106770a251a9bc8b0cc2d7c98ee835e21ffa351dacd9570954b8518b7213e3f7a5228f5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524455, "uuid": "a866b4d7-68e7-4954-a43b-7df855a8096a", "value": "T143C62343F784ED5BF0F383325A365661E1064D198B03EBCBA988777938B36C49B85AC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524455, "uuid": "8f7f8cc1-28f7-4e45-b199-28217c43e58c", "value": "196608:94Bb2Z+XpRaclGDOQj8h49fH0rrAW6eN/U2H8HKnGHvMoH1sSZvu:9eSclsjU+fErz6eNstoGjV5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772524455, "uuid": "3bd83c5c-406e-44cd-9955-29d8aaa453c8", "value": 12005232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772524455, "uuid": "21057a30-341b-491f-ac25-53e9eff16b73", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524455, "uuid": "476d3f36-c9fa-44e4-8877-9ff8eed0a540", "value": "0cba66e78ddaeecfdd462c8cb39e443d083dc58c609b0edc73e8101e59ca91e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a11962-16cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772520329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520329, "uuid": "7e22b37f-2218-421b-877d-257ab5a764f4", "comment": "Malware payload", "value": "899abbe0b2070dc57c9ee60a4bf1fb20", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "manchidodemainehdero1234456htdfihgfdsdsg-duckdns-org", "colour": "#4B45D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520329, "uuid": "9ef0e388-c83c-47d4-853a-47ae6443cd04", "comment": "Malware payload", "value": "0cc1c78cdd33e479ab80ea5403b669a5f36798fe3a2c804793ab110c26005ebb", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "manchidodemainehdero1234456htdfihgfdsdsg-duckdns-org", "colour": "#4B45D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520329, "uuid": "2db78087-00dc-4f10-ae85-85c5ec357454", "comment": "Malware payload", "value": "8b079ce2127d404d9d6606193b59e4bc4d5c4b58", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "manchidodemainehdero1234456htdfihgfdsdsg-duckdns-org", "colour": "#4B45D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520329, "uuid": "642f7b13-c48e-40e4-a560-d7fad0eb843a", "comment": "Malware payload", "value": "48b426d632150c3b480e2bb99119c7ce88043b36673396c8a8418d1f9871ab686bd3be1af4235c7f4ffed38dc1a42531", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "manchidodemainehdero1234456htdfihgfdsdsg-duckdns-org", "colour": "#4B45D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520329, "uuid": "46b9593a-f886-4382-902c-32cd2879a38e", "value": "T1CA25234BB5E48607C077AA7C09D1C191A10D6C98ABA58E9FBE037F1F71FEA749D4220D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520329, "uuid": "45ca2dd3-131b-47d1-8ddd-56016997c645", "value": "24576:dt8gBRkZCx+6zIg2P8e/Q5EqEDURZFjmqBh3tZJ9:UgBeZU+PgbE4TFbZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520329, "uuid": "8426ae00-d8b3-4b61-92f9-a346d7465b02", "value": 991232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520329, "uuid": "27ac3650-ee28-4785-9413-fb891a560485", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520329, "uuid": "0f04fa71-db51-40c2-abe1-93bf1324d828", "value": "0cc1c78cdd33e479ab80ea5403b669a5f36798fe3a2c804793ab110c26005ebb.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0287cce2-1718-11f1-a769-42010a9c0008", "comment": "Malware payload (SyncroRMM)", "timestamp": 1772552731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552731, "uuid": "97db902f-e46c-43b1-8809-24c4a402fd96", "comment": "Malware payload (SyncroRMM)", "value": "96d840902104f02884da77819c57d838", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552731, "uuid": "7be45322-db95-41b1-8019-5d8886ff7266", "comment": "Malware payload (SyncroRMM)", "value": "0d9a2fdbaca26cd3bfcb6123b1434a00815e3faf7325035bc654ba5ba5413afa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552731, "uuid": "8d3d167e-8a8a-4bd8-828a-140e2580397d", "comment": "Malware payload (SyncroRMM)", "value": "afcfbde1e59621665332def9e2979082fa888842", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552731, "uuid": "74968e8e-bf93-4e42-a142-1a0c98b63e10", "comment": "Malware payload (SyncroRMM)", "value": "fc4cc45ea83d2db632fd4893198222d0f31a156209c3f43df8c2fb418cfbeab89a72243af5b264dd023a1eb49636ff52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552731, "uuid": "8959d450-3d96-4f40-959c-dd785c6cc2cf", "value": "T15A461204F7A5061DF466FAF62D21711146B3BE479815C649E3B33088EA76E43CE6C2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552731, "uuid": "cce0df0e-a5d0-4405-b83a-5b84bb17ada9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552731, "uuid": "50250da5-1dfd-4ca2-b8c9-0263347381bb", "value": "98304:Ah/evJLeTmDDi9UeK7kqXf0FGxLCbD3ha5Uc6v6O3xUM3/L9LI/cbt7/Cp/z2OIn:Ah/ev5eTeW90kSIbDoUcfOhzT9cEt720", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772552731, "uuid": "aac5efcf-64aa-421a-a799-70e9f18c3b3e", "value": 5858856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772552731, "uuid": "1db4e7cd-2f26-453b-9c2a-24c24eaed2ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552731, "uuid": "33d1849c-8649-41a0-b1f1-d6fea4e17709", "value": "ContractDocument-v1-4909320.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430bb30a-1756-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772579468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772579468, "uuid": "eaa29a04-4f75-4118-a1de-1e08185e69ac", "comment": "Malware payload", "value": "0f82fbdae36c38f41cb99e0952aa9fc2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772579468, "uuid": "a656971c-7faa-4b68-a916-5769c89bc797", "comment": "Malware payload", "value": "0ec05b8971e4afa1e1bad6f51cd5c26e58bca40604fdb485d8199f651a99e986", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772579468, "uuid": "06522a1c-f5a9-459f-806b-7a37f03d32aa", "comment": "Malware payload", "value": "1830668423b0435d0cac0b5ee5a1e62418fd44f3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772579468, "uuid": "c0cc1197-20a9-4a71-92ba-45a0f4cc10c0", "comment": "Malware payload", "value": "63db45db185c8aa15e4a14f6f0ddfa1b9a0a3f37ebea681127108af577156328f1af05f2ef10e4f015abeb901a64ce7f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772579468, "uuid": "c6cf4d0f-b7f5-4b7f-acbe-ab6a988dfd16", "value": "T1DAF20A6811C9313A5FD8E433C0B4B15B487A442289C328A695F950BFE1E7DF0DADB6E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772579468, "uuid": "d4b22f1b-b659-40ea-aacd-68edd0f36685", "value": "192:bHIIrv5amwIBmQRP9HOnbN9WqUu3wD4KYkTaEbAQNtT:bHIIrvUmfBVRVOnx9WqPwD4KYYaE1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772579468, "uuid": "d2f90118-7e49-4767-824a-7b10b3af7c57", "value": 35140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772579468, "uuid": "19b2f144-c066-435d-8412-e1333ed450ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772579468, "uuid": "e457586a-0bb9-416f-b90c-7c7f021bc402", "value": "GD IMPORT purchasing & Transport (PT).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "660855be-1723-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772557622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557622, "uuid": "8d26fe08-42e9-45a5-961c-8fb07e0882af", "comment": "Malware payload (RemcosRAT)", "value": "b5fe41746ea43ed6cd3bb8e6c8891959", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557622, "uuid": "83822335-1165-4648-b26b-8710b3686905", "comment": "Malware payload (RemcosRAT)", "value": "0f203bf0f3606da0235d8d30515b7296af0bdf672fdf4d8c96058944c5f8737f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557622, "uuid": "056f79c1-5580-401a-b8c8-d3d09e9eef35", "comment": "Malware payload (RemcosRAT)", "value": "f3bd62abf6f8562ffecbddc83a67d7a073adf3ce", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557622, "uuid": "34edd843-64e7-40be-a833-0be17502b6a4", "comment": "Malware payload (RemcosRAT)", "value": "5ec1c3ba952934d63e219770e97e255b5eed8aaddb69018f67fd6967f3a47c28db76ed2fea97a4f31eab6fc167bb2db0", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557622, "uuid": "7f443216-2fbb-4679-a21d-167eaf7c4670", "value": "T11672961D4D950669555F2EBD4CAE3479F530CFF2A12028EEB518B710982C3787E6AC8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557622, "uuid": "1d49fd35-5522-41b3-b6ff-e049aa60ec02", "value": "384:Z4NpK8RMcZujnMiU3RICOX1PVTW+dVII/FUD:ZepKIZDMXW+dVxtUD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772557622, "uuid": "626bb873-41bf-41fd-882f-d2e01367abab", "value": 16713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772557622, "uuid": "28db12e4-f06a-4e9e-a762-1fe043867dbc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557622, "uuid": "41a5090c-3d32-4311-b323-b7d7893a7a68", "value": "NEW PURCHASE ORDERS @300499754.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79346690-1758-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordRAT)", "timestamp": 1772580418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580418, "uuid": "4e8e30e7-35ec-474c-a968-c0e8cb702966", "comment": "Malware payload (DiscordRAT)", "value": "789b4cf512636156394656b7450e8251", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580418, "uuid": "a42d042f-c5a9-4f2e-b45e-776866cc21b1", "comment": "Malware payload (DiscordRAT)", "value": "0feb6448a0e5014ba533e19f26d000062b9632744d164c940f481314670e8460", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580418, "uuid": "17093c7c-9ef7-47a3-b85b-c175b5576e55", "comment": "Malware payload (DiscordRAT)", "value": "62ca27797773be8ff7f21346d435e8d96350087d", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580418, "uuid": "4cdca049-851e-4b65-af40-e2232f466077", "comment": "Malware payload (DiscordRAT)", "value": "03a0b35a4a45514f5e31ea3cce748640726768920346c561363ac30dff4382fd8f9e0b2cfdf2e3a1b7a2109b4ac78c59", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580418, "uuid": "74cceaa1-82a6-4cc6-9bcd-65a1a6b33cdb", "value": "T1E773C8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611B2B828C42B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580418, "uuid": "ab4e3ee3-e458-4b05-b11b-46de59313f7e", "value": "1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+mPIC:5Zv5PDwbjNrmAE+CIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772580418, "uuid": "bd14dd25-8dab-4e6d-ac97-41d9ed6ab060", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772580418, "uuid": "101a106e-9674-4371-993b-99568472ba6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580418, "uuid": "fbe92f64-7e75-4cd6-bfb5-ca844d314649", "value": "Client-built.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435a8dc7-16a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772504307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772504307, "uuid": "4097e958-6eb2-4de6-8832-4c1ce81ac0aa", "comment": "Malware payload (Mirai)", "value": "916a95bafbf319ef89c5d95128b77456", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772504307, "uuid": "6bf922f5-ea5e-49c5-b25d-a70506edcff3", "comment": "Malware payload (Mirai)", "value": "11261321ec75bcde1aa101a0670998ee095a1c3927351ec047a2ae2c024c64a9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772504307, "uuid": "c0477e1e-0d00-4c40-8dd5-94f21c317466", "comment": "Malware payload (Mirai)", "value": "84df2becbe18ec2fdaa0db28fe780e2c87b34c09", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772504307, "uuid": "62395b9f-d21d-4f4c-92b9-ae0ee9327cb0", "comment": "Malware payload (Mirai)", "value": "1254ee43325b1c7936625ffd1cca81148f1256cd71a028a5dae5592a374240326618a993f91c5eeba394dd760e00300b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772504307, "uuid": "385d75b3-f27c-478b-a274-a98c0de34664", "value": "T12C415ED7189909742CDDD9AB33BB681034D4D09B2BC5AF0F68EE38E4098DD85B8C4BD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772504307, "uuid": "0a425b3a-fc88-4b78-8b09-d2499629442b", "value": "24:vyGnDL/dLJLYWRL9LgoLRLlbLC0+MfnLAR9RG3RFBHLlbL1Lrchig:vyanpNJhgKVtTlAR9R4RFBrtZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772504307, "uuid": "c1eddc8b-7db5-4c04-adec-48a6021907b0", "value": 1968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772504307, "uuid": "ea070f9b-8885-456e-8381-45994e887a4d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772504307, "uuid": "64dac77d-e2ef-4660-a78a-b190c071cfdd", "value": "dick.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ed21b4-16cb-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772520033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520033, "uuid": "859c8883-1801-4732-b8df-6cab61bc6200", "comment": "Malware payload (PureLogsStealer)", "value": "61a1d85d99ebf03772511b2bdd2cbf35", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520033, "uuid": "0319a44a-86ee-4d85-9d86-cc8cf229ebb1", "comment": "Malware payload (PureLogsStealer)", "value": "116506107354d91ba1c1654b6bfaca1567862a96e4f6f0ab014d37d5b7a2fdd7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520033, "uuid": "3c187caf-2fa2-442a-9652-197fba94cfb4", "comment": "Malware payload (PureLogsStealer)", "value": "1d6ffc2b64f583513600c2c26b43c619efa83470", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520033, "uuid": "8d617e36-4f38-4360-93e5-163a15c59cd5", "comment": "Malware payload (PureLogsStealer)", "value": "b47faf96ffcbe4bca685b9f4ad024501426a952f0e0af5e1d1b5276c8ba37bb5fdb8f28ca8fd7fb39fdc28fb8fee1ae6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520033, "uuid": "6278a4b3-799c-4363-a0a2-677a91cff338", "value": "T116350048897F0FA59F69F296D320A0A7EC1D1E10B2C64DA92C74D8DBB30E1BC45DA5F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520033, "uuid": "f0e29c5a-2d23-432d-ba72-a66a2ea87929", "value": "768:p0iBSDTTNMNotWr/FjFSM6zEKeOjKVBmP7r94Gmd/6lZLbId5JMz0BzMDAJfDqu9:qjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520033, "uuid": "6be45771-31d9-42f5-85c6-0fa0ec59734d", "value": 1152781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520033, "uuid": "9a464b77-8f35-45e1-9aec-bb07fdf32eb8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520033, "uuid": "23ee06d7-007e-4a6b-b30a-190f840d4892", "value": "61a1d85d99ebf03772511b2bdd2cbf35.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3651610d-16d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772522753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522753, "uuid": "639cb36c-dc23-4dfd-85db-d5412dfd41d9", "comment": "Malware payload (Vidar)", "value": "8db14e2195be6d828346dc5c9cbc2823", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522753, "uuid": "aae9c07b-747b-422b-b08a-5fb197fe6708", "comment": "Malware payload (Vidar)", "value": "13047daa89a40fc8aac030d5e6f3ef326682719633ff996908f382934ae3fb96", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522753, "uuid": "22b59faf-09e9-4731-a7dc-e36e4ee08361", "comment": "Malware payload (Vidar)", "value": "f3f8d71e4a87023c774d2c4858824e70bf3f54a6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522753, "uuid": "a1fc5d0e-40ec-4057-997b-5681e59144ec", "comment": "Malware payload (Vidar)", "value": "415ab322013aa40110d5b5bb9b1b5b22f8bc1f36c6312ec44d4909446f9bd44424b27910a043643f0532adec74895959", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522753, "uuid": "00ece56b-a05c-437a-9dfa-494b2f2fac10", "value": "T1CBB56B06BCE41CA5D06AA3768CB752927B34BC580B3263D32E5276782FF37E09939754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522753, "uuid": "df38c62f-43ec-4ead-9766-b1cd706ff6b2", "value": "1ee5ceaa8651bf31ebd235088b7e8b9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522753, "uuid": "d66cca2e-848e-4e69-b788-7a3c4a14c320", "value": "49152:i95SP4tfxQ4Vngiq16HDoYyRD5yzLZwHmN:i9cw13gi8z6mmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772522753, "uuid": "a4e033a1-077e-47bf-94ab-5e45a1a2b7b0", "value": 2419792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772522753, "uuid": "8a813e26-aa6c-4b79-993e-12a90ba8dcf9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522753, "uuid": "b5952ba3-6378-458a-8302-4842adb23f9a", "value": "intl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff397093-170e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772548860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548860, "uuid": "4f895ada-a912-45bb-9579-52ba9eaeff04", "comment": "Malware payload", "value": "c8f269d59279d3ba35284da2f8e6cbfc", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548860, "uuid": "f91c0b6d-766b-46f3-94c6-01ff1cc0fe4f", "comment": "Malware payload", "value": "13dfb4a0f8609c8c2a125e2a3b6e0dfab885ef92715e10bdc9979b591b25e49f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548860, "uuid": "c134f315-f966-43b5-8e40-2f53fa6567ab", "comment": "Malware payload", "value": "3a4bf3fbbb1f40d6a83b7db058209e280cb1b24d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548860, "uuid": "ac8aa18b-49e9-4048-9d39-cdc4cc71437a", "comment": "Malware payload", "value": "651458167f8ae75deb4f441926b60fcd00b1d43bb60eeac77e3dda57c632946e24cef6287735197cf5a9e2dea6f432cc", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548860, "uuid": "bd37c8dc-477d-418f-b4f2-bb345195dcb7", "value": "T198215C2426ED0B20D3B60B37D87AA7758A7EB815DA60976C055496CC685AF00D821F36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548860, "uuid": "adadebf7-ad1e-4c19-a4c6-ba6666a8ef6a", "value": "24:8I2sFJVm5PZiHwCj7SAA6J+/5KGh7M4GdQ4gZYmGgPPkmh:8IbmJZZXpNM4GdQ4kRGgPs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548860, "uuid": "a4b457aa-a1b5-4211-8add-cffe1afba2ff", "value": 1212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548860, "uuid": "ef2d6837-e8f1-4eb8-9e5f-540e977c5886", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548860, "uuid": "483d676d-b845-4c3f-87cd-c4347a58cee5", "value": "document.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "722e535a-1708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772546046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546046, "uuid": "3ac71d83-c1c0-4c42-9ce3-39393990b79a", "comment": "Malware payload (Mirai)", "value": "9dba4d449f3e02b0f31b22c1258c2ded", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546046, "uuid": "54211392-118a-4942-abd9-94d83417b23f", "comment": "Malware payload (Mirai)", "value": "1427be5ba7464f5faef7935f4625d4d597c6b75371a6751d053668696b24f410", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546046, "uuid": "d5401361-b964-4814-87b2-62fc1dbe2989", "comment": "Malware payload (Mirai)", "value": "61674a1ba72282867f3136928dd0fcdced0380cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546046, "uuid": "c3d58b8c-690b-480d-985f-23baf550bc1d", "comment": "Malware payload (Mirai)", "value": "7a8498ee3a6e51b87ea65d9c01f3cd21f0aae235e878a9737ee8ab495c3568716caa0ee78a966d57ac37b85df8bd4486", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546046, "uuid": "aef764c5-7ab6-4181-a93e-7356a1e5215e", "value": "T1ADA3C94E6E218FADF768823447B34F21E79923D627E1D681E16CE9041F7034E645FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546046, "uuid": "af147e67-2463-4cad-8127-a1397f2bfa46", "value": "1536:/6yRDVWDpn4Xowda3ps6d6+CukkWe5Vjtz:xDwDpnOdU6pukk1Bz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546046, "uuid": "644cd1d3-d95c-4312-8c28-bf7129e7bdc0", "value": 101712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546046, "uuid": "f96ed5d3-7e62-41f6-9b25-20518ce3a532", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546046, "uuid": "89f46282-f457-4a15-ae24-9f615be10ee4", "value": "titanjr.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8485fbe-16fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772540580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540580, "uuid": "c1cee00f-6522-4546-baad-56ffe137c96f", "comment": "Malware payload (Gafgyt)", "value": "a0e38db34621fc91ea7abb5f09099efc", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540580, "uuid": "a379b760-5417-478e-a558-a1fe22013772", "comment": "Malware payload (Gafgyt)", "value": "14bcfa03c6d23874482864d4fa501934c58b4f75bfe9ca90d7d5fc0a71028d8a", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540580, "uuid": "a06e5c43-737f-4f6c-b6e2-874047c3c77c", "comment": "Malware payload (Gafgyt)", "value": "c0ea79dd14ea1cc67b7b306038c232aebaa55bd3", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540580, "uuid": "cebe87f1-1e8e-436f-8ac4-7a00a74e4a41", "comment": "Malware payload (Gafgyt)", "value": "932ac2ae4ddb90a816c2a5b4735a748148ea82c08533db203f2f974a35673a9af89879074d17f9f0a92c0558f60c7c49", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540580, "uuid": "43529c30-a889-4396-8fe2-2e8f41ffdbdc", "value": "T16D731A49E552C6F7C4821BB10397BAEE0766FD394E7A9E48F7083CB89B724D43929311", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540580, "uuid": "342134ab-ca13-4965-9d2f-fce8681a3550", "value": "1536:xVVI3lguLYiPvoVjRWSbXJ0rWlC/kPstVkYFBw2bQW83LZ5:a3KwYiPvoVjRWSbLQ/kPstVkEw2kN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772540580, "uuid": "2ae1fbd7-866d-47c5-9741-aae6444394d8", "value": 75580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772540580, "uuid": "b1a196f3-0c37-425b-9c91-0ec0d63c7df7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540580, "uuid": "6025a208-8742-4e9c-beb0-41915c91b3c7", "value": "wget", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94e796f-16fc-11f1-a769-42010a9c0008", "comment": "Malware payload (VertexRAT)", "timestamp": 1772541065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772541065, "uuid": "58593b81-3d71-496f-b27b-9c0a06c87012", "comment": "Malware payload (VertexRAT)", "value": "0606c43c9b6079e71f3f93930b865ae1", "object_relation": "md5", "Tag": [ { "name": "VertexRAT", "colour": "#2E8349", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772541065, "uuid": "6c7ff7b0-e4b7-4cd3-a371-efb918361917", "comment": "Malware payload (VertexRAT)", "value": "15682e3a3efaf41969596294ceb1686d4b4a1e49c0617ddcfcb95f58de0c0336", "object_relation": "sha256", "Tag": [ { "name": "VertexRAT", "colour": "#2E8349", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772541065, "uuid": "ba815036-c054-4492-86a7-e04d7335242f", "comment": "Malware payload (VertexRAT)", "value": "42c2db0ee48743e49a6c139e103c47898569122c", "object_relation": "sha1", "Tag": [ { "name": "VertexRAT", "colour": "#2E8349", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772541065, "uuid": "98ffce0e-bc28-4c78-8e4b-1af57a4314bb", "comment": "Malware payload (VertexRAT)", "value": "e2dc9736438c57bcc7397212fb7ade03a0e3c0bc92e43de1f08dd1bf65535e63fd83e28f26b6058227200cebbe532d00", "object_relation": "sha3-384", "Tag": [ { "name": "VertexRAT", "colour": "#2E8349", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772541065, "uuid": "207ea25b-b6d7-4070-9ad3-2c679b9bffa7", "value": "T1F4E38C2279D0C032D06B11715AB9D7B69969FA33177484C7F3840FBD6E612E09B7E34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772541065, "uuid": "5125b1cf-3fc9-4417-9e71-dc7add049453", "value": "eb6f4bdf978fc07ec2cb56d40474a6b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772541065, "uuid": "83248eda-2f86-4155-b43e-2644d44bd700", "value": "3072:RsD2ADkpFGkTXlDJA6ba2esDetNxVgbTGV9X4:RplzpTVDVa2en/V6Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772541065, "uuid": "eab995e0-6b90-4938-8da3-82f43e2ed51d", "value": 146944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772541065, "uuid": "4d8e0167-ea9e-4321-8bdd-13f846611aba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772541065, "uuid": "8db92373-b5bd-490f-9d8f-72f2c3cf53af", "value": "triage_260302-b93asah12d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94cf74c-16ef-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772535509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772535509, "uuid": "090fd81e-2c07-4a6d-a59b-6f30e2c24c17", "comment": "Malware payload (Vidar)", "value": "1f4564be3647f3e23921ee47ee8f0a5e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772535509, "uuid": "8f0c7ab0-70b7-4540-a187-1821118f0c5e", "comment": "Malware payload (Vidar)", "value": "164db72af466485d17cabd5b5dee001995e1f9a0ac9e572d8ac80e65fd0985bf", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772535509, "uuid": "9b30075d-3623-4f02-94c6-56301323bd32", "comment": "Malware payload (Vidar)", "value": "eca8721893669398bddd5d29b7e588db77d5c1cb", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772535509, "uuid": "e3019dd6-be18-4658-9d98-e362bd6e6a6a", "comment": "Malware payload (Vidar)", "value": "6ee99f7c92b35157e7cf2985b723f653aceb1eb31de3f8b53e540914faf11112687766e895f407ac8ddbeba69e944aae", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772535509, "uuid": "c39d981a-e443-4ee5-b9e5-be8c8e2d2988", "value": "T17086E8AB22649168C25FD5FBC0928E41B8F365FB1B33C5DB069107EA4A574CB4E7ED20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772535509, "uuid": "fcb7e74a-40f2-4ab0-9300-7ee4a0e03660", "value": "98d407ce7cb1a3b4203bb905c8b5b3cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772535509, "uuid": "b643cf83-7c27-4c36-bd3b-cc025556a3aa", "value": "49152:LBWw3ljiKrjRxjeJXQaaD1QSy5G95iVOtD+SbZPurqwsjfLaRm/wjpkkJmxMj1DW:LrMepu1v8Tx90he", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772535509, "uuid": "aa19944b-9f4f-465f-927c-7896dbc27dc5", "value": 8088576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772535509, "uuid": "6465e58d-a388-4685-92f4-a7b60e0c7eba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772535509, "uuid": "817f2836-8987-472b-8eb9-100bee95de60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8df475-1717-11f1-a769-42010a9c0008", "comment": "Malware payload (SyncroRMM)", "timestamp": 1772552726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552726, "uuid": "e4f16706-e79d-4fc0-b65f-486bf3901edb", "comment": "Malware payload (SyncroRMM)", "value": "0a3b76a2f80ae4cdaba28111a97e30b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552726, "uuid": "31e7a5da-8068-4308-871c-e573af8eb30e", "comment": "Malware payload (SyncroRMM)", "value": "165ad7a1453482031c26be0f52730d31cc6f3a9d5a67233dcdce698de34ae6f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552726, "uuid": "f9327caf-6008-49a3-a157-c4dda5b6c346", "comment": "Malware payload (SyncroRMM)", "value": "79261836ac60505fe3140b68e977ea4994f0d854", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552726, "uuid": "44e420da-6ac9-424f-abde-d2b0f8745049", "comment": "Malware payload (SyncroRMM)", "value": "c7795db21eab9b54b059acbbd3dd1006f24b54365cefdcff7ef13249933017008c60544fb45e95ae50e252a379b9ceab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552726, "uuid": "0708f450-8e9f-4e14-8814-18a070142ebf", "value": "T112461204F7A5061DF466FAF62D21711146B3BE479815C649E3B33088EA76E43CE6C2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552726, "uuid": "6d946ea1-f5a1-4d97-a938-e7583e409b76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552726, "uuid": "a219d117-274c-48b2-8d50-713ecc5674fc", "value": "98304:qh/evJLeTmDDi9UeK7kqXf0FGxLCbD3ha5Uc6v6O3xUM3/L9LI/cbt7/Cp/z2OIn:qh/ev5eTeW90kSIbDoUcfOhzT9cEt720", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772552726, "uuid": "42690b8a-6daf-4d8f-b70c-8589bdb19fd7", "value": 5858856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772552726, "uuid": "d68e3d7a-1b6c-442d-bd9c-e1bf5d33c39e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552726, "uuid": "bb27d060-2a59-4ce9-9ba7-c664007d7e83", "value": "Celebrateinvitede.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b277f307-1711-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772550020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772550020, "uuid": "7cca417a-2db8-450d-8ae7-5dc78601fbc1", "comment": "Malware payload (RemcosRAT)", "value": "f9d8154195f7557b910b97bef2df0c81", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772550020, "uuid": "5152aae9-60ff-4534-abc1-6e409ef6752a", "comment": "Malware payload (RemcosRAT)", "value": "168a8f539999c5aa8be06a620fdc7d0f9dc44ea28fc436218a1bb9fd04d273be", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772550020, "uuid": "4e930fcd-8d30-4300-b330-d3cd67b6b961", "comment": "Malware payload (RemcosRAT)", "value": "a5795db2ce82cf09fa67b8551eee6539943e54cf", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772550020, "uuid": "3b09bf14-ed76-43cc-b24b-b268b346e69e", "comment": "Malware payload (RemcosRAT)", "value": "e16786176a0ac66279e1dc6103098e3f89801a97cb4d3f9f3273b8b7a8ea23a34d1002fe4f2132c30c39c9e343fa1258", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772550020, "uuid": "ba4d9a8d-f99a-48c1-8bfb-8f37642ece39", "value": "T1F8152311E569BEAAE806033798C144996709BD22CB18911B6ECB370ED47FAF0B1DB53D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772550020, "uuid": "8bb1c1cf-b955-4352-bca7-dcc3837b6957", "value": "24576:ZX3kTPluu0VEYeSgYdzIsz6cZVQLbJ0s:9I9jnaBRIbcQLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772550020, "uuid": "ef4f0079-30e2-4ecb-929e-deaa64d565b4", "value": 936960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772550020, "uuid": "d8f63e54-2a45-4016-9d23-32c3668ff397", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772550020, "uuid": "dda6426e-a36c-46d1-a300-82846d78ba83", "value": "PO33202677.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7a43d3-16b5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772510442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772510442, "uuid": "e5bc2fa4-5dbb-4ba9-954e-53736c9ee5fe", "comment": "Malware payload (Mirai)", "value": "8a4510580036ff84f2374386768f60fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772510442, "uuid": "b5e35101-4812-4def-a6b1-62c128182751", "comment": "Malware payload (Mirai)", "value": "16997823d0b770af0cb30943c2ba783dbce5961643b696bccc01f82dc7f65b65", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772510442, "uuid": "12d87e2b-c373-4601-bc15-2488c30ba227", "comment": "Malware payload (Mirai)", "value": "73f1d6447123f9b673f824f159823f8c7026293c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772510442, "uuid": "151f2d79-2676-4e34-abab-e0cf7bf7282d", "comment": "Malware payload (Mirai)", "value": "41ad54df1528780568b1f96bb3816c7d1328a3dbe1948be724165ec1da26953d4b007a739612233e7f6cb167363abc28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772510442, "uuid": "13e5ce03-65e0-4e1f-af73-d7dc4ed8b693", "value": "T168F35B0BB4C090FDC8D5C2B48FAEE216D932F45D2138B21F27D47E262E5DE216B5E691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772510442, "uuid": "c478d24d-576b-4907-8c99-00afb2d2eae7", "value": "3072:DmwwNVKnjtOmZhjhNirlsJrWpngvH4e8R+4E8s:OWbyxWG+8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772510442, "uuid": "0e001972-12e7-4d03-9086-95f280731aac", "value": 164776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772510442, "uuid": "8fb2da76-4dc5-4495-9a7b-e160292ed9d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772510442, "uuid": "23b19019-422c-46ae-afc3-5ad3d5ce8682", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b1b4f58-16ea-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772533150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772533150, "uuid": "28f95735-bd2f-4bb7-b2ca-6fc90da96927", "comment": "Malware payload", "value": "004d30cddf8fd6498d85b16cbbf3ae3f", "object_relation": "md5", "Tag": [ { "name": "adobe-reader-pdf-visualizer-nota-eletronica.nfe-pdf-shop", "colour": "#1DB831", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772533150, "uuid": "5a65a591-d668-45a2-9a54-2c82f7900404", "comment": "Malware payload", "value": "16e7ec5d8b14bdfa1cf95dd9175e444834c4bf4f8684dff75ededd19fa3e3546", "object_relation": "sha256", "Tag": [ { "name": "adobe-reader-pdf-visualizer-nota-eletronica.nfe-pdf-shop", "colour": "#1DB831", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772533150, "uuid": "aaf82675-2434-46be-84e3-2902458e3c2c", "comment": "Malware payload", "value": "b04c62fdd77ce3a36bca1e12818814ca1eeac216", "object_relation": "sha1", "Tag": [ { "name": "adobe-reader-pdf-visualizer-nota-eletronica.nfe-pdf-shop", "colour": "#1DB831", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772533150, "uuid": "29656702-39c3-48ad-9250-7248e16649e1", "comment": "Malware payload", "value": "faa4d363892cca43ee6e25fe8c24f32ad2607b3307cdc32a795b3185fd82128f9750a5487c1b7ecee6cedf3229c9413f", "object_relation": "sha3-384", "Tag": [ { "name": "adobe-reader-pdf-visualizer-nota-eletronica.nfe-pdf-shop", "colour": "#1DB831", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772533150, "uuid": "e338a752-0e53-413c-b5a5-68a74aaec28e", "value": "T1B771E7278E972C0647F9851D10CD18C11C2C53C9515769EF32E7DF78E68C02E68F6A9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772533150, "uuid": "6448b525-f7ff-4d1b-bbef-a85bfb64fff5", "value": "48:NKNMJEl8wy3KMipwUCTrY7wy83goOA9gUqEPWLG9lLy3aAfGi8cqG1q1WdygVRWK:NQevKMi2Y7wn3kUV+ElLvjUtdy2MK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772533150, "uuid": "06896ef3-85dd-4401-897c-b6aad5ff2f9e", "value": 3805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772533150, "uuid": "41f2ea5b-1443-4732-8ee2-5d9d392a1410", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772533150, "uuid": "4e3a62c4-3d9a-495a-8f83-57afd3f61239", "value": "zjp.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9edc95e7-1704-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772544403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544403, "uuid": "acb0dd47-1560-4084-bb11-f80e80067bf5", "comment": "Malware payload", "value": "003c8d2c18abb92a49daab159fb283aa", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544403, "uuid": "f26e8ae6-0356-45a6-a790-c71936e4ebff", "comment": "Malware payload", "value": "18535509a6d259487b6b06edf2f1b2df3c4890fe16d630c8a2ec6af32cbe8b32", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544403, "uuid": "41da24f8-1223-4578-943b-647bcb502283", "comment": "Malware payload", "value": "c5373670c4b2ed32115e20e006141fecabf342e9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544403, "uuid": "930c2737-6ca3-47f4-9ab4-4f28fdf6b8a0", "comment": "Malware payload", "value": "3a78d9b5bb9875515f68e113fb33e0be23bdf4c8aafdd71786c4d59863289d7a5bea0758a8a82d9990b1b36cbda4ed6c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544403, "uuid": "6cc3bdc7-24a5-48fc-a655-bd0d37b70a42", "value": "T1DCA5D03FB28B753EE06E5A367A72E210593B7661A4174C1696F4C84CCF250B02E3E797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544403, "uuid": "ec3f3c61-2a3a-49bb-92a2-8085e4dd1fe4", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544403, "uuid": "4d83b599-548b-4b1d-8c00-3cea44ed5c76", "value": "24576:pXNrSLScusMmOkKIhzvL4Kc7RTVqP+GGDu+uZ2w6OqCu5+EmcB9535T0we6CRwHN:iuI5hNS9kP+bDuB63Cu8E9Bvd0/Nrbzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772544403, "uuid": "ad83d10a-adc0-40d1-a3ea-eabe7e7b3f89", "value": 2093360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772544403, "uuid": "0de72dc1-ca86-43d8-a45a-90ad96eea311", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544403, "uuid": "29f2c2c0-81df-4b64-9df3-c2dd0bfb4392", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb21579-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772518928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518928, "uuid": "2cf7226a-0906-4ec2-b42f-6b6158ef6464", "comment": "Malware payload (AsyncRAT)", "value": "b3edaedf52442bca2403be04ae7b3b80", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518928, "uuid": "180574fa-31f3-4457-af47-293d7e0135e9", "comment": "Malware payload (AsyncRAT)", "value": "19b794bd2efbdfb13afb138d45d3040d5aed52e0a2a951e6bbc3395517ae1802", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518928, "uuid": "0d1749a0-46e8-449b-b21c-c1b73f9a7487", "comment": "Malware payload (AsyncRAT)", "value": "fffb42327459d45f3d6f45d5b7f32641b164b4a6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518928, "uuid": "60d0752f-9824-43dd-a84a-b294f0f8a188", "comment": "Malware payload (AsyncRAT)", "value": "e104f97e52c267b9e419e33800dfe108046066c4ebb72688dc94837ec5036ae073731eca70eb29d59061e6253a7a3eef", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518928, "uuid": "49cb1ef8-16a2-443b-9b21-c437c7d5cec5", "value": "T1A5D23A08B3D48562E1FD56B9487293048775EA4BA973DB9E1FC444AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518928, "uuid": "6eaeb2a3-9091-45f4-93b3-ead51f6c0789", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518928, "uuid": "6ed897f7-aab8-47d0-a8d1-ed7789f3aa8b", "value": "768:88fRXNsH9aOQg/cIRGqom/Rb7fB/dT///+:TfRXGH9aOJ1i4RbN/5//+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772518928, "uuid": "3310b55a-3c9a-41dc-86b7-7f9f055a731d", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772518928, "uuid": "c02fcbe6-0df0-4e38-abae-688a9cf02ed5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518928, "uuid": "337a86fc-c2c3-4e24-8682-108c2bd714a3", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ae348c6-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772548638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548638, "uuid": "29ad2881-5cb2-49a2-8d26-5e5536e5a3c1", "comment": "Malware payload (RemcosRAT)", "value": "2cb2e142a64ff10645bd3e7f66b95d70", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548638, "uuid": "b53295c6-f6a4-461c-89e2-77eae700d21c", "comment": "Malware payload (RemcosRAT)", "value": "19be387664e72c18ee90523d33cb19780d4f8500ed961b721baec81a0af9d37f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548638, "uuid": "fe69eb4b-a471-472c-9c21-a90c0ed5b0a2", "comment": "Malware payload (RemcosRAT)", "value": "c5abb1edc5e1d110a77ef94791dbfa88d1f1f92c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548638, "uuid": "d8911cee-407c-4ad0-884a-603a2fbb5808", "comment": "Malware payload (RemcosRAT)", "value": "88d16eb34964156ef219022baf83b2ce5bd22e4844584aeea0305bd0ad80b97b0f53bc0183008e61acc26940389c0a48", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548638, "uuid": "93aef4cc-6649-468b-be2f-0d365f2ba7a9", "value": "T16486E8735387A46326331B9D9476A9219C0B7867B5CDD70CF2CA336A7380D47923B2E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548638, "uuid": "bf1fadab-0405-4c2e-aa08-422f3c5bef3f", "value": "98304:dbTF+TlYAwhdifjCIWSh/IpNPc8N4jmw4psB2r7ot8SnIuUG/95ni+:dl+TRw2r/cN4jmdsgAGSnhUGV5r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548638, "uuid": "8bb6c88d-78f5-4c5f-92b3-fe559b14e1f1", "value": 8288562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548638, "uuid": "d495194b-cc43-4778-a2da-99250e0a19ce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548638, "uuid": "a3a73590-9895-46e1-97bd-36d77f678891", "value": "IMAGESCANDOCUMENMTFILES00102910.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054d9d9d-170c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772547582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547582, "uuid": "2e8f8b6c-07c8-4f99-b3d3-9e778f7cb0b4", "comment": "Malware payload", "value": "7167eba00a082547c3e2a046ef6533b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547582, "uuid": "88821ba5-be37-4cd7-be0a-6f030acd5b9e", "comment": "Malware payload", "value": "1c1970b7eb207cf5010fadac2f014666da0a80ca78994c37dedbaf22c0fc8823", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547582, "uuid": "ba31e19c-2ca7-4a16-87c8-b4d26dbae9f3", "comment": "Malware payload", "value": "98b52c441e8ded9d77b283f9d32a2bfa2dd82a50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547582, "uuid": "fa338a97-36f2-4c24-9733-b532e712f839", "comment": "Malware payload", "value": "ef5edb8cdf4680f13c631b11408d4bf776a7980e4adf1aa2bde181bcbe1d0de6654a42128b5d581329c1ae2376c35c59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547582, "uuid": "ae8dab3c-8a86-4dff-b4cc-91b2bc3393e3", "value": "T1DDD2E64C539420BCF613A23CC9C3D017E2E1F06A9BF099EB177187650F72AD2A535B9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547582, "uuid": "8a8770f0-2661-4ebb-8fa2-75f434bdb022", "value": "384:ijd8aleHlZhDtgL5VdMdpyGJwaxYTgDvBVnJ4PWetoerAnskaFenwI46ad5e/xi6:uAhq5cdpDJwaq0wWeRrei74eyPwSp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772547582, "uuid": "2ec5391c-14fe-48a4-a0a6-e2789632390b", "value": 30700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772547582, "uuid": "fc94c03a-faed-49b0-b583-af139c447893", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547582, "uuid": "f932b72a-8f18-4baa-90e7-e98dedcec548", "value": "7167eba00a082547c3e2a046ef6533b7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dbb64e6-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772518900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518900, "uuid": "5e135de6-f85a-4e94-b123-30900c5c9c33", "comment": "Malware payload (Mirai)", "value": "b864b9c654d5990870bd306b4dc1b182", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518900, "uuid": "f957ca10-f179-4663-a841-3574ef704221", "comment": "Malware payload (Mirai)", "value": "1c7b6f5fa0c351e4ab7c2fe458ea4ddb957c90c0f3df599f4ff11bd66f1e3139", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518900, "uuid": "68b5631f-9d3e-4cb8-8f79-82d55701556a", "comment": "Malware payload (Mirai)", "value": "5aa753a6bdd6b60d8e760bb8e9f9ed218d4873a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518900, "uuid": "0c67f72c-cd48-4116-bbe9-3742ffd30d8f", "comment": "Malware payload (Mirai)", "value": "45a8e5f29ed311657b8d6c5330dcfc67ed7d95b1c4005f54edf0c7de3c40f5af984888f570d0493cecb241e4b30483cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518900, "uuid": "22018d71-0f1f-472c-852b-5702c6988cc9", "value": "T1C083F881F8C741F5C417493460ABF33FCA32D57A80719AADEF999F26DA27602911329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518900, "uuid": "f776924b-40bd-43f6-a8e7-467e4811c481", "value": "1536:BxdeVSDsgyIuj3QMAwdTsymavw1YfW9gYKYWoHkmTU2ygt:BXWgRuj3Wwhm/Yf51YWOpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772518900, "uuid": "3f884609-1730-40f6-9628-4df7ca30b83c", "value": 83696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772518900, "uuid": "154e6ba1-5e54-498b-91a8-92ced8061f72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518900, "uuid": "894ae14c-3c49-4725-b856-d1666d7f8ee1", "value": "nullnet_load.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e984087-16f0-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772535706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772535706, "uuid": "62547750-560a-4b64-a1f7-511479e3df84", "comment": "Malware payload (Formbook)", "value": "fbbc1a14ce16f349ea053e688860da23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772535706, "uuid": "cbb0f8cf-64c2-4ec4-8bcc-c069787d9a4f", "comment": "Malware payload (Formbook)", "value": "1e301925942e4bd6ea46f7d62167177d6b0ab958feb620cb59ab17954867f4d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772535706, "uuid": "54f05e91-6cfa-4702-b509-d8fc5873d0a0", "comment": "Malware payload (Formbook)", "value": "efe35a1c8d009c7c2e8d7f5eebe263d60db92341", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772535706, "uuid": "ab2327b6-c36c-479f-9c2b-c6ac1af2ec07", "comment": "Malware payload (Formbook)", "value": "80e06b9ad18f2a4d4c9eee8373fea3d9596f6b975f016cef36a9c977cbbcf8ffe3cde929c11e2199f274642b5ad67e3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772535706, "uuid": "205b8d6e-a059-45fd-b191-5eab5390bae4", "value": "T1A7F4BFB876047CE6E66F467BCA929DCC137639638F87A4CE41A46BD30D63361EF16804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772535706, "uuid": "e22b24cd-9ff2-45df-af7d-2d2b2e9dbcbe", "value": "79c2877b90f1bfb58c906f4d9155285f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772535706, "uuid": "19e925fa-403a-404c-9c44-a502d3c0b399", "value": "12288:1/XHaQ0m9Fr6BqexKOZ4mTc4OdHg57bdT7db2OJ5SEVM/bTQxi9ugCR6KZIve:1/Xj2PJIBZuThaOJUoxiMJcKZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772535706, "uuid": "84b102b3-f55b-42ee-b882-667bdc5cf3c9", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772535706, "uuid": "20d40437-ab77-4ff5-82e0-b521af527333", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772535706, "uuid": "b5b3a17a-a8f0-45bd-b7e7-942793848dc8", "value": "FinalDraftDocument2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c55c498-16cc-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772520240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520240, "uuid": "62c5c79b-a0b8-4be2-8f90-265b5afe43bc", "comment": "Malware payload (AsyncRAT)", "value": "c4aea68d3f23fefeca8d07a12af6ca2c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520240, "uuid": "94678f4d-b0bf-4f72-9d52-c4a47400509d", "comment": "Malware payload (AsyncRAT)", "value": "1eb45380386099c5554002969542a7f8738dbee7a65910e6686b8133a8c17e01", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520240, "uuid": "e140e3b3-4c64-4ca9-81b7-fbb6a93f3f27", "comment": "Malware payload (AsyncRAT)", "value": "29a551f6e8f5ae9b8a8e99736c051c0e7322b276", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520240, "uuid": "12f4d878-94f3-4ae1-89d0-8a46c4279cc3", "comment": "Malware payload (AsyncRAT)", "value": "02af19215d96459873742865999581bc22b6eb4434df6f2eb4919ea565cb72b94b7de379ac9a0a31ee189bacd889b78f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520240, "uuid": "3b3fcaf2-4f5c-4c43-b1a3-3ae241deb487", "value": "T102D24A08B3D88551E1FD57B94D7293048775EA4BA973DB9E2FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520240, "uuid": "be2d23b1-5d48-4a29-9622-4027a48a53a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520240, "uuid": "28854722-460d-4940-bf9e-92f0a926fc56", "value": "768:YQjRXQO7Wqykg/cIRGqoG/Rb7fB/dTb/+:jjRXH7Wqy11iYRbN/5/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520240, "uuid": "5b03850f-61cf-49b1-a2be-eb7ae93f9fde", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520240, "uuid": "a8c0995a-440b-4983-89aa-a401d4b6c232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520240, "uuid": "ff800704-4e45-4f7f-8a27-bfcd9f1ee623", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7833eb-16d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772525503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525503, "uuid": "dd00c782-fb89-4ec1-b6f0-2b59283a2c19", "comment": "Malware payload (Mirai)", "value": "80cafb64b19d0b20b29c197f441fb151", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525503, "uuid": "57ecb58d-19de-42e3-9454-a8b4e63d609f", "comment": "Malware payload (Mirai)", "value": "1ef4f2143568fb1a6daa77cf4f34b430f9d5e5cc7e1ed05a9edc959ccfadfa72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525503, "uuid": "32f2af52-4c18-42eb-a394-d6008fa25ce1", "comment": "Malware payload (Mirai)", "value": "ef6ff3627a831726221b9863d3ea4afc1f574adf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525503, "uuid": "165e19d4-f655-40d0-8959-a65e0236c4b8", "comment": "Malware payload (Mirai)", "value": "dd04f8847cf636b766637749dc0111b4fdf9fd8669bccf102d729bd9aeb80a7172868ad3212eab3fd6ec54a720b669a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525503, "uuid": "13a63293-cc1b-40a3-aebf-1e002dcfb40d", "value": "T198735B8AE697D5F0DD420AF0207FFB36D93598353264DEA7E7C4F957ACA2202905229C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525503, "uuid": "fd488653-e8c2-4366-bfb6-f68f437b48b6", "value": "1536:VXxfAvPcun4feW9JEhd2uSXh7JcO27cgt:VlA89ed2tXRqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772525503, "uuid": "0682402e-580f-426d-968a-dea0c3451885", "value": 74972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772525503, "uuid": "b24baa0f-7a26-4c31-98c4-7c1a765a4785", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525503, "uuid": "43467824-9bad-4045-9e24-e1cf73d371e2", "value": "nullnet_load.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f90da64-1705-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772544807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544807, "uuid": "c1175215-355e-4deb-a60f-042c098edb05", "comment": "Malware payload", "value": "3dab9ae980729d965e35821419e66884", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544807, "uuid": "67d1ef52-26f7-4636-8c2f-6695bcd85a55", "comment": "Malware payload", "value": "1ff72bce3792b9b977e2ba2ac8fc292b4e1ff2fc0907d69f89131737a314fd28", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544807, "uuid": "d9b41a5f-e9d4-4d57-bcd0-d6bfa98531f5", "comment": "Malware payload", "value": "fe1621bbce550462043ce6197e0d8f04069c365e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544807, "uuid": "66322ef3-5354-4b7d-a24f-64602f1c12f3", "comment": "Malware payload", "value": "afcc89e4795ad1ad8b1ce537b4a7d74db3dac7819b9976986735f2ee713f36e8f1cd75bdc1dc15ec106626d5261a3a48", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544807, "uuid": "10811fb8-2e1d-4702-b701-e3cc1b729e4a", "value": "T13C65FBDB86F348C7C0F2C659200B8518EF8BC66F60DB97AE709401D758619BE97E533A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544807, "uuid": "ffc3bf84-3b40-4e68-a9a9-529fde18ef37", "value": "768:OxInlj8ifbAnVaavjIBLzYQP+y23Iy0RQ6jqxQgOlrABJB3d1cFdNODGLf5Zi6rU:e4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772544807, "uuid": "0d70f59e-bbc9-415e-987a-61130af0880c", "value": 1543441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772544807, "uuid": "0b111a08-cdd8-4ac4-994a-dc798c92b0c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544807, "uuid": "e90986b6-70c6-45a4-84bf-f52f9fa0d954", "value": "Vitro 203AS-010QA.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de82562f-16fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772540645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540645, "uuid": "656880c7-8670-4911-ab55-a21847c9ea53", "comment": "Malware payload (Gafgyt)", "value": "fc29eb8f670bd3ec6e56ce4749490dc3", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540645, "uuid": "a9ad9729-f5ee-45a5-aacb-b28357599162", "comment": "Malware payload (Gafgyt)", "value": "204685ac618abf7262cdf4b0034f5e88fcfe1829a87932625346d8766ae28ed7", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540645, "uuid": "5344a323-19e7-4133-a4dd-f74b66988074", "comment": "Malware payload (Gafgyt)", "value": "50a44131420ee8975eefecd3a0ab1225583534b0", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540645, "uuid": "492e8f3c-16fd-47aa-91c8-65f7ce9ffedf", "comment": "Malware payload (Gafgyt)", "value": "2c69215100ff7a36f0179acef3d1c8176c92130822d49e2064c95ccf12a99533c4e49922ac03b50541c325472258e440", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540645, "uuid": "982b5dad-1277-490a-b0f5-0f0011ce79b6", "value": "T19FB3F805D9905737C2D23BBEF79A82CE73261F98979733118A287AF41BE5B9D1D39020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540645, "uuid": "90d68f33-02a2-4e2d-ada5-993e3b523be3", "value": "3072:o6z1WqLgV4ZQGBcD3i/lMpaLhmVAQ/iz1Ta3ErUxglryYlfg+JGfsJ2W:DhTa3ErU4fg+asJn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772540645, "uuid": "fc7d6dc5-784f-4ccf-92bf-bd96c6455fa2", "value": 117425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772540645, "uuid": "4ee83ffb-58f4-4227-8bc1-f3b5c36768bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540645, "uuid": "ff6d37b2-d6e7-488b-8e8e-8e62cb0f290e", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02959f9e-1727-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772559173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559173, "uuid": "13f50109-9b64-4f07-8a47-456f45169377", "comment": "Malware payload", "value": "0da544f39ef4ad13c2d30ffe8ab56808", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559173, "uuid": "5ccb6e0d-2e0f-4831-9e9a-2d3697152f17", "comment": "Malware payload", "value": "213ed5d4cde493d49f94ac6076ae353559fcd75a49c907242baa34a418dfab70", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559173, "uuid": "fdb92f1d-402d-41df-aa01-1dde01b255b0", "comment": "Malware payload", "value": "5312607c7c8abec62eee31ea6f0f0270cf6b066c", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559173, "uuid": "c91a9c3a-d741-4691-ae86-4d575123e224", "comment": "Malware payload", "value": "3d5f0144335ca4010c09b7e55c31dbda5cbdb43e6802868e04513545b71f00638ba4da67479602128f2db56106ed1cc9", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559173, "uuid": "d609a571-726a-48ec-aadd-dd60bba1aef1", "value": "T1EA252212D961FDABD84763374D55809B5100AD03EA1BE01F2E8B375EA87B7B4B1CA93C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559173, "uuid": "392f85de-7fa5-436d-903e-cf18434a33ec", "value": "24576:WX3/G/EUNYPHQSgYTCrBvrCWb2XCBypj3jEL:ovyaLBmhx2XSojEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772559173, "uuid": "8dc7a3f8-6788-4377-b074-8c10c3fd50c2", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772559173, "uuid": "f748690a-84ef-4aa9-a02e-faeac0e7d016", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559173, "uuid": "70c85e52-91c5-4e9d-a7c9-2868092095ba", "value": "SecuriteInfo.com.X97M.DownLoader.2343.19103.8599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42552ce2-1724-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772557992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557992, "uuid": "fbe9ce51-3ad2-43ac-92ef-c373b3566c95", "comment": "Malware payload (Vidar)", "value": "1076cd3bb425fac182f1e91d22fbff01", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557992, "uuid": "0bf79a33-309a-4c25-a70d-e0cb3ebb052c", "comment": "Malware payload (Vidar)", "value": "2198c366b3727c2c784891d9915c3ee3360ad4e1bc9c4a0ace1dfec3c3326c21", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557992, "uuid": "7c0d2c4f-0a04-4965-99b4-d755668e6c9e", "comment": "Malware payload (Vidar)", "value": "a89aacda1bd30bcf7f82b1ea59a6c73cd379c084", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557992, "uuid": "0e9eeeef-3f04-45ff-923a-4ace01b42370", "comment": "Malware payload (Vidar)", "value": "f529c3f03f3fb27f07735e9218922575a235362a0e80ce7b9ae331aefedce8e845e929015f121c57940ad085d203b7fb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557992, "uuid": "ffc24807-fd33-43c7-8a3f-ae53408114f2", "value": "T1EB96C36BB7E5C169CD6B813BD0D28B4C94F37774072681E712513B6A8A31ACE4E7E630", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557992, "uuid": "1a438a48-8b46-417b-90aa-0d6b75eeeec9", "value": "9fa09a64686909db97ebc147f2f0d1cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557992, "uuid": "b1853966-3937-4eb4-94ac-cbcdca091b9b", "value": "49152:KSC0G9vUq/7AVxLk77pe9wueSuTgF/VWfHOjOoeouBunDfKTTP4qSFnB3AvCB7JY:m7b2OoeoSKKqt6jjEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772557992, "uuid": "14befe8e-14ed-446e-ad24-4205819ee2ed", "value": 8756224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772557992, "uuid": "f4d7bd26-0872-4bdc-bb25-f7f15e1aec34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557992, "uuid": "7e0c352a-c5be-49d1-a34f-65ea7a448be3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6f01ad-1728-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772559888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559888, "uuid": "a73fb120-15ed-4286-aeeb-9672fb30afe7", "comment": "Malware payload", "value": "06d3f7f1a73723925577bf6020ddabcd", "object_relation": "md5", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559888, "uuid": "d2756b23-f3d9-403d-947c-1585e4a7280f", "comment": "Malware payload", "value": "233cce296843336115c771c9c3720faaa77bbb8904517000d87d5d26ef6de638", "object_relation": "sha256", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559888, "uuid": "104ccf99-435c-4cef-be3a-736c653c13e2", "comment": "Malware payload", "value": "6bee1926b316012a1525760f080cde6cf387b687", "object_relation": "sha1", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559888, "uuid": "c309ff72-408d-42a2-804f-0197e5421c9d", "comment": "Malware payload", "value": "336fb6a5bba3a6faee0469ceb112f3a0000c2dc9807127b303607d1ed69ce94d730ebd568d27640fbed452c54ff092f8", "object_relation": "sha3-384", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559888, "uuid": "d7ab1769-f771-4990-b33c-0e52062b4e60", "value": "T1E0E07D71C60E7E66C0466FF024C78106C0254606C612B20B08DB154F3E1F3F7295D00E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559888, "uuid": "2fbcf1bf-f1bf-4de4-9573-a0bd62ff1c7f", "value": "6:5jeOmbjfu8tgQITUY+AiEEhHV7Ddhe/lWrt2Of2Jx+t3uDkgdri5tBn:5j3m+qZpAEH72of2LbDkOi5tB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772559888, "uuid": "907c7bdf-68ef-4ea3-9b85-620644e9c701", "value": 400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772559888, "uuid": "c9e727a0-c1c7-41b5-9563-f0f7fd34fb9a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559888, "uuid": "f920f7c6-bff3-4d42-84e8-cb62a1743ce8", "value": "wsh.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff5ff78-16dc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772527064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772527064, "uuid": "4b632fa0-efc6-44b9-b4f6-88d1df011793", "comment": "Malware payload", "value": "ab2c4bbbf9865bb60d8304415d6d4d64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772527064, "uuid": "37990979-8bf7-45d2-a31c-ef63b6599375", "comment": "Malware payload", "value": "236e22b2adf2d7934234c89d19efcf69a94dd9cf351dc500a6bf4e00cc6af7d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772527064, "uuid": "0672b2de-8721-4749-983a-da4b91dd7fe8", "comment": "Malware payload", "value": "689528dd892dc11adde252fb9ec37f1359fefb1f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772527064, "uuid": "e5f8baa1-4a4a-4f0c-b064-6be9bb8867ce", "comment": "Malware payload", "value": "3f560df8c6f9181c1ae8a3593f7447f21894a1d00d7d173350fe8ee0c199d291e084e87775ca41b001c36ec96b1ddc3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772527064, "uuid": "40dac7b9-dca9-46a6-b0de-468d3b9ff662", "value": "T161D46BD5DAD7E0F1E85300F0116FEFEB1935A1368006DDFAEA901962B471B916B4B32E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772527064, "uuid": "01e58b7e-e1a9-4d7e-9dc1-d50a80feb9e3", "value": "12288:g5T2L+hjPk2ZhA9hUf4z5NeNzpilb695zfw0Q/yELLHS:A2LujP7ZhA9hb5QN8lbetHQ/hS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772527064, "uuid": "4a28c45b-18b4-416f-b472-afefb7f5a3a7", "value": 615134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772527064, "uuid": "a62f2d85-a556-410d-8dcd-10c67d4817e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772527064, "uuid": "d9e1a476-1075-4d3f-9770-c9723800db12", "value": "data.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10edf821-1718-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1772552755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552755, "uuid": "902af288-fa7e-40fd-b827-9884c79ca9f1", "comment": "Malware payload (DattoRMM)", "value": "9bebbf9ff336edf22e3b54e1e4e151ca", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552755, "uuid": "d0f280ca-62ae-4fd4-800b-ef7aa531b184", "comment": "Malware payload (DattoRMM)", "value": "24f410dbc698816e12076ef118c900661b853471941c414d754563dd265da8f3", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552755, "uuid": "118783cb-5b76-48df-b95e-b6049a1454a1", "comment": "Malware payload (DattoRMM)", "value": "f911437d8f0ae827d72871568067922eea804697", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552755, "uuid": "d4729564-008b-4397-8037-7183d0ac8f07", "comment": "Malware payload (DattoRMM)", "value": "a8f48ace479a4589cabf887693f4d1464c6404a9fa1a84b3fdaa633744994765f1f242bd632a93a8479ed10a7d2e95bb", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552755, "uuid": "80d6b892-7a10-4b9f-8dfc-bc2399b10ee4", "value": "T1D9B63347D9778DF0CA330A3890D2196B3305980E485BF4C9F609277ADAF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552755, "uuid": "1460c404-fba1-4872-bd9e-56342b6aabfd", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552755, "uuid": "4a0c8724-c9c0-482e-9e10-b34796f98199", "value": "196608:caZk+wyP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2z:un9mzZFw5S9pE7Asjp29qIT0jarlZr87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772552755, "uuid": "29c1c1a4-d391-46cf-82c9-b173bb5db169", "value": 11056120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772552755, "uuid": "5e3f586f-eaae-43df-b97f-805bbc0c6215", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552755, "uuid": "c8471b07-15b7-43f4-b43e-9e9ff81b2967", "value": "Organizer2025TaxReturn9164.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3491775-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772548706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548706, "uuid": "0192728f-f747-4575-9bcd-2f6d63d274df", "comment": "Malware payload (AgentTesla)", "value": "fcd10d78f0d376d994657201f233e293", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548706, "uuid": "dce45ad7-2d3e-4b75-8e46-18408d905d23", "comment": "Malware payload (AgentTesla)", "value": "25bdb2dc3676dd5f01f15a86415bb180a711b78258e783d7a4917b1b2cd72c2b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548706, "uuid": "78af4980-0d2f-4f56-a06c-b5814ed379e7", "comment": "Malware payload (AgentTesla)", "value": "6d616e2f0c081693de0e4f9d00cdcc54be924815", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548706, "uuid": "64600ddc-e1e6-4734-9618-40541f88ef81", "comment": "Malware payload (AgentTesla)", "value": "0eb64d62c19c3ebf85c1e1e4ffe6f74a7bf4d4f8c6f8e46fd0c410a340bb39026a64114cb022adccfd1dc52fe366bb42", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548706, "uuid": "ce241120-7556-4f9a-930b-a84262b24d9d", "value": "T1FF162844ED4497D42E23CE223B64B1E141C3654B7E4BC682F41BDDB1FEA3986AD21E72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548706, "uuid": "ef358d28-4ca2-4623-93b1-30a5d120ba07", "value": "98304:S+QVARdERn5OslBnGONFcyENteivtmq02df7tqYu1GVw2+8/gqcEkJk9r9auggze:7wkYnE0DcyQtp3uGVHKEkJk9r9KyTgvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548706, "uuid": "76e69b35-37ad-4816-9da3-9a6505a32f10", "value": 4279762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548706, "uuid": "61179c7c-de56-4b16-a8e6-e929adcb125a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548706, "uuid": "22c8329f-3a07-424b-b497-0e4e93d5e46c", "value": "New Order.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f628969-1741-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772570603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570603, "uuid": "1ab56d52-6026-49f8-a8b0-1e1e99c3cfef", "comment": "Malware payload", "value": "93b0a194bb587f853cff32c8c64ff38e", "object_relation": "md5", "Tag": [ { "name": "Air-Gapped", "colour": "#528C43", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570603, "uuid": "e4be4545-6b45-4054-806a-845dc85b6e40", "comment": "Malware payload", "value": "25ee511f9a45725b23cb049d55d2c42f5796418bd596adafb523c679d3a3b523", "object_relation": "sha256", "Tag": [ { "name": "Air-Gapped", "colour": "#528C43", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570603, "uuid": "f641362f-2b83-4b87-9633-d0caa3318161", "comment": "Malware payload", "value": "e4d3cc7c58062fafe1500219a3ca80340533da97", "object_relation": "sha1", "Tag": [ { "name": "Air-Gapped", "colour": "#528C43", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570603, "uuid": "79e2305a-cf15-447e-a736-84e293c47e50", "comment": "Malware payload", "value": "8bdd85f14729c110242ebc3b021df6f499a14a393f0f580ee038f0d3c35b700e6a2ee316ff5d57a193fbccd2bdf1bcdc", "object_relation": "sha3-384", "Tag": [ { "name": "Air-Gapped", "colour": "#528C43", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570603, "uuid": "e3a1bb47-5bad-46d8-9e91-e4ff1965b652", "value": "T18AF31250129C9495CD20CBF8CAC2961AA9C75B02EB64DA1B16F4EE83B3DFC49D106DF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570603, "uuid": "f4466d1f-22cc-4b18-880d-535c4499ba2c", "value": "3072:C3IPKPm/S/h7x8ybw2SNqp/7W0p7MxygrSPmpp1HaiR8tW/kohSJBakSW6Z:MIPS/h7x8ybAUpDW0p7QhmPS1dRiEkTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772570603, "uuid": "a87ba8da-4b94-4f5e-9581-e606976ac22f", "value": 162768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772570603, "uuid": "22c90720-9a65-4d2c-b0ea-5764d8ff61bd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570603, "uuid": "0a624274-9afd-41a4-9ec9-9777e03ff24a", "value": "c61c679eec1c1b43bbd01727fdfb6a69b11485931eb8569e6b20ada30bfe84af.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39fd614-16f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772537969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772537969, "uuid": "3531d539-7acf-4a76-896a-55ca506056f7", "comment": "Malware payload", "value": "db5a302fa7255a3b88873e7979555f32", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772537969, "uuid": "c89d1425-c918-4456-b468-ff95dd56dcbc", "comment": "Malware payload", "value": "2671e1f43b2e5911310c5b3f124c076055eec5dee4e596854332ffcf791fd740", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772537969, "uuid": "1aead95a-fb58-484c-b46b-ff7795f43fab", "comment": "Malware payload", "value": "b14b6e374e04af4ec98f003cae40b5ee6c42913f", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772537969, "uuid": "8f27537f-042c-4fef-8aba-92dd3b1e0461", "comment": "Malware payload", "value": "b7eefba48f3e538ac4cdeebb6eb53a2657e5dd123628f0f53b4c51df40347451c4c0fe171f691e44313081c6ac969bad", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772537969, "uuid": "72f1b311-a13b-4895-89ab-0ee0073d1ef9", "value": "T1E4219D1422F10718D7B24EB9BCBAE3218633F825EE52878D1290A2854874224E53BF2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772537969, "uuid": "a00346bd-af71-4287-afef-24ef998cab5e", "value": "24:8hwWa5y5LEnXKPiW2lxAtWF+/CWw+//fIP24I0aho+Z5:8HVZEMfCnPJI0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772537969, "uuid": "3caee6c0-18ac-4f98-9704-f6671fad9727", "value": 1371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772537969, "uuid": "1db81c7d-66cb-4904-a16b-b3cd2d0f499d", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772537969, "uuid": "f8ac3b22-a0b0-4b79-bddb-28d29fe6733d", "value": "2671e1f43b2e5911310c5b3f124c076055eec5dee4e596854332ffcf791fd740", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ef1fc78-16a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772505078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772505078, "uuid": "97d080df-9ea7-4ad5-bc48-78cfe8b319e7", "comment": "Malware payload", "value": "2b05fed96c04b3006c617ba2523602e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772505078, "uuid": "912c765c-ae32-4705-9763-7e9eafcc9cb3", "comment": "Malware payload", "value": "2689f19a4b6e8004044410f150ecc13546b50b6a38bd35e7d1709440b2d139fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772505078, "uuid": "1ab380a7-783a-4fef-9d03-362b32b9ab9f", "comment": "Malware payload", "value": "9b2e57a973d49eb72c3172af8f37ecb50034d341", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772505078, "uuid": "b6d23278-5dfd-43b9-be13-bc1b04653dc9", "comment": "Malware payload", "value": "9d84e30b347df49ce2eefaec70eb1fbc64f398cbab6411cb1bad3824598ed8b06e97b593a1506edb2444c6b699f99c59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772505078, "uuid": "f01dbe31-3eab-4ea1-9e2c-08d8cb870231", "value": "T1E3C63A97B8924A42C5E43A37F8BD80C433630EB99B8756566D15FE3C3ABE5E90E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772505078, "uuid": "820e281a-fb17-419a-ab4b-8983c689134a", "value": "98304:Z/Oc1K4ycEhD+kk7QwroUXMhWxv9FzAOzSCZ2SPE:ZRKZw7QwHXMhczAOeCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772505078, "uuid": "f403cbe3-f2a0-4658-b322-aa115ffd500d", "value": 12540800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772505078, "uuid": "e55a26b1-a46c-4a64-b77d-c537913cb27b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772505078, "uuid": "c8a5f4ff-a22a-458c-bca1-d86de7c445d5", "value": "rolf_unpacked", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bec1e29-16da-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772526225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772526225, "uuid": "1ef1b215-277b-4028-a7fe-f6337b3494b8", "comment": "Malware payload (Mirai)", "value": "5b9bf094cb3228356875aef4c2c7d4bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772526225, "uuid": "bbca6ef5-d4e8-4478-88b0-667d9364b5d3", "comment": "Malware payload (Mirai)", "value": "2694786c0c215fd283d00d61c8d54e995cd200aac62940e676a106c64d7b463d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772526225, "uuid": "b1fffe2e-4b79-436d-b3dc-8a9f2b2e848c", "comment": "Malware payload (Mirai)", "value": "6524e2c7d0f9d42f8ab9cf9920c83c40bf1552cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772526225, "uuid": "077a1869-c95d-403b-b783-c1cc05f8caf2", "comment": "Malware payload (Mirai)", "value": "8274d8cada1f536a588033520a3be52aa1175d733727e623d3c62b5f57f92a10ba632734102c0c9c0d8d8d3e90475a10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772526225, "uuid": "8fabce28-3f98-40a4-a935-ef492fec2d1e", "value": "T159634BC5A693FCF5EC090A713133FF758676E23F2169DC87D3A499B2A842202D5162ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772526225, "uuid": "443efc58-2140-4e51-a3a9-e16b45ee460e", "value": "1536:8nK11LHBef9vAL8mY9BGTr5GnSzckY2iHvqDRkuF7cgto:j11TBe1wF2BG/5G4c/bvq6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772526225, "uuid": "dfbc0a24-804d-48a2-b7cc-f341f80684ed", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772526225, "uuid": "f663c5b4-0916-4336-ad18-84c4af6725b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772526225, "uuid": "a49d1ce9-e6e2-438a-b6b4-da5b850a72a6", "value": "nullnet_load.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "934c02f5-1700-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772542666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542666, "uuid": "d34b03b9-74fb-4cb9-bd19-dd6a40c62830", "comment": "Malware payload (AsyncRAT)", "value": "ac2d535606ca9c278bbc85180ba02b78", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542666, "uuid": "f595006a-b984-4b4e-9048-7f35fbda93b0", "comment": "Malware payload (AsyncRAT)", "value": "26e8b9f0f7b345449b4b5cf8bf5b3237a2a78e3559ca28ab6a3fe623a83dd076", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542666, "uuid": "ab4c5f02-dbbf-4f08-9d3b-9882154bbebe", "comment": "Malware payload (AsyncRAT)", "value": "d85d7467198795e450284531efa2c6bb6cdf464e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542666, "uuid": "4e4fb938-7ac7-4fc4-a049-238115c7a575", "comment": "Malware payload (AsyncRAT)", "value": "c62d5cf09e8dd92780cb46eb443f27ae9b8627e3900362bbacb9c14daf55ffd7841faa0f93272f5811af201a23444376", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542666, "uuid": "f20b2c4a-419a-487e-b14c-23f28ed9032c", "value": "T1BB931E7A93D4F221C06E567CC463B2FA41796DCADC06851FFDC43D863632AF450B2AA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542666, "uuid": "e1b2ae5d-0915-4b0f-b652-4c6e1083fb15", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542666, "uuid": "e742fb14-c0c2-4ad6-9a20-5a77b0340c98", "value": "1536:WXcml4gxJzNogARPq/SbJlhvaIbOCW3q4:WMixPhwRPtbJJbO93q4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772542666, "uuid": "684521ba-5d24-438d-8d10-2be6e286f1b5", "value": 96768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772542666, "uuid": "08a9ffae-6710-4091-82ad-f8dd0791a87f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542666, "uuid": "9dbf7aa4-1ecc-4a01-95f3-a6160312933a", "value": "26e8b9f0f7b345449b4b5cf8bf5b3237a2a78e3559ca28ab6a3fe623a83dd076.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e34d4b1-173d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772568642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568642, "uuid": "bce1499a-7f01-41e1-85b7-de0b6bd582a2", "comment": "Malware payload", "value": "90c67104c7e18aa0a7a9f8d4e824cc4b", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568642, "uuid": "64fb0279-3b7c-4396-81c6-d8b2b0349238", "comment": "Malware payload", "value": "26f7c34675ba7a4e68a8fedf7b1ec903ff55b07ac0344d8ba8c689510a965bfd", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568642, "uuid": "bfa1c306-1a8c-4a5c-8b7b-09b92e2b6835", "comment": "Malware payload", "value": "fa4c968b1bb6e3d5df6548404f53e77dc683f7bf", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568642, "uuid": "2f72c62d-0343-4ee4-953d-89e353726ac3", "comment": "Malware payload", "value": "c9033231cb161ab2a361b7b17dc530d9bfd7aa0f12a41d5b6a5f798648eddf882c12f14d85cf95f661b7125304da67e1", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772568642, "uuid": "153f7b7d-8ee7-4428-88cb-226694305de6", "value": "T13466AD18A3C85594D176DA78CF15E233CB72BCA31666829F4AEFD6160FB7B100F2E905", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772568642, "uuid": "56a719fa-71c2-41d5-973b-dad38546bc95", "value": "0b343470fd96a4060bc286b2942cafd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772568642, "uuid": "fefdc950-f4af-4d23-80fb-d6d23c3ef5d1", "value": "196608:+VZO/WcYyq+C491F8sqBN3MdQzmG23A3W8rC7:++WcfFIMA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772568642, "uuid": "b328636e-5e99-4508-ba3b-6026cc1c02c3", "value": 7007232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772568642, "uuid": "1047a412-38bc-4a8f-9c51-10c66cdf7dd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772568642, "uuid": "195804ee-b71e-4eea-a35c-49ef6f56ce94", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eef723e-16db-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772526579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772526579, "uuid": "9471aa79-fd5c-4ca1-9e22-6bc17f418257", "comment": "Malware payload", "value": "cbff06525776d9ef660e58254d25400d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772526579, "uuid": "e7d63dad-3562-466e-9656-aded3fdb5663", "comment": "Malware payload", "value": "273fea99829bf43a4601b716c1bdd5a8bfe4d3645cc9d265cf565377c6edcfc2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772526579, "uuid": "8ea962fd-980d-46a5-82a9-b95ed4223f2a", "comment": "Malware payload", "value": "a6139bdc4bf394408cb700424307a4ebf84b5b63", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772526579, "uuid": "ba3b711e-01c2-43e3-af46-44917202c131", "comment": "Malware payload", "value": "7e91e29a4fb538b589849a6485d98de5a44d5f20370caaf40034d2d2989ed551fa842444d3bb5eb8103aa19c9ebd7bd5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772526579, "uuid": "8d1fd189-1e01-48f6-a3cb-eef8f43e5115", "value": "T13F924CB512896C79FBD0CE399F3C6F4DADE8C2C42124E3ADBA0F39215A1166DC70535A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772526579, "uuid": "ba53ed10-bfad-4adf-afe9-2442453d618d", "value": "384:1icuQpWx+BL0SWL0gOzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:1i8i+BL0SI05zsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772526579, "uuid": "7621f835-7590-4665-99ec-a978ce050307", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772526579, "uuid": "e7f87563-d039-40af-851a-c3edc25680a1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772526579, "uuid": "17c96a0f-c849-414e-849d-84bd40bdb258", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553e7159-1704-11f1-a769-42010a9c0008", "comment": "Malware payload (Mercurial)", "timestamp": 1772544280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544280, "uuid": "7cbf90e9-ae26-4530-b51f-38c47ef63dd8", "comment": "Malware payload (Mercurial)", "value": "5baf6d050a33e6cac14267979baed1b1", "object_relation": "md5", "Tag": [ { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544280, "uuid": "3e6def31-4e16-40d6-95b7-5c91beb8e81b", "comment": "Malware payload (Mercurial)", "value": "27a5b90f604f0a1bd24b163771ce1d0bc87a6c72f939e57e42520d17e4263838", "object_relation": "sha256", "Tag": [ { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544280, "uuid": "d72f3a4a-629e-424f-90b4-71a4163bbfad", "comment": "Malware payload (Mercurial)", "value": "8684680f5b47bdd375b0547c14a2cf0a4b4f222d", "object_relation": "sha1", "Tag": [ { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544280, "uuid": "398c5b47-9492-4a53-a01f-87ac262d3388", "comment": "Malware payload (Mercurial)", "value": "aff99229345e316e6fa334057dc2db2efcf4a4aaf8aee8027db4fb639b92e0d12c540dc0295f04452962e02786f9d57a", "object_relation": "sha3-384", "Tag": [ { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544280, "uuid": "61a63e42-96f3-4360-815f-b990ab70aacc", "value": "T169131848B7ED4708F2FF4ABA5CB2516447B6B866AC32EB0E1D885C5D0877B808950F77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544280, "uuid": "d7296175-1bda-4e87-ad2c-a9e701e37e82", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544280, "uuid": "ec9581f9-3e6e-4570-b661-989d4c7c852b", "value": "768:4scaIiI5bYcrSwWuZIeRWTjY4KZKfgm3EhvU:fc1DjKeRWTHF7EpU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772544280, "uuid": "ed6ec36f-615c-466d-8850-bdf23dbcb5bf", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772544280, "uuid": "f89433e1-9575-490f-85eb-5600962420db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544280, "uuid": "49d9c181-9778-4969-861d-1285d12af7a4", "value": "27a5b90f604f0a1bd24b163771ce1d0bc87a6c72f939e57e42520d17e4263838.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ec9fb7-16ed-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772534273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772534273, "uuid": "c5f47401-a5ec-4229-8508-6393e926343f", "comment": "Malware payload", "value": "c73c308a137ff7805577042cc9e923e1", "object_relation": "md5", "Tag": [ { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772534273, "uuid": "eca9cc69-9aea-4b5c-81d3-4745cca556db", "comment": "Malware payload", "value": "27d7a398a58c12093bc49f7144dac2f079232768096d0558c226ea5c53782e29", "object_relation": "sha256", "Tag": [ { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772534273, "uuid": "3ff1e2df-6c70-4d5a-ac26-66e6e76469ca", "comment": "Malware payload", "value": "6bfcddd912e6d87311eed5ae77fb53e1fdb5b184", "object_relation": "sha1", "Tag": [ { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772534273, "uuid": "9f052a38-2488-4db3-a8e5-e7688193249e", "comment": "Malware payload", "value": "0d03c945a10adbff691ececec9b192d1c86a61dc508eb5ddaf57a7f5f598dc2772afab5339adbd614bf898392bd09d21", "object_relation": "sha3-384", "Tag": [ { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772534273, "uuid": "02e79ae7-6de5-4037-98e8-e7c8d1399eaf", "value": "T144530223ADB764B67C5159FB4FCC3C914D8D2582706727786038B8229F12A0B7D5A3BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772534273, "uuid": "506276f6-330d-4801-9dd5-753e376b39ce", "value": "1536:2QuaFPFizi08jxJ8e+OQh7YcrpoQMeiFSZsEhgBSwDnub7tISsQXHif:LF+ibxJ8bOceneSmUuCIif", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772534273, "uuid": "3705a2b0-57de-4c18-a800-64671e5f3b09", "value": 65740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772534273, "uuid": "573a24a6-d6c8-4c69-ba9b-5045e3b2935b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772534273, "uuid": "04c79f04-6ace-4a1b-b63b-7ea8f8ec6e54", "value": "Algerian Ukrainian proposals for cooperation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5909f031-16f7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772538703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538703, "uuid": "0f7bf977-b571-463f-9e3a-e4812cda37bc", "comment": "Malware payload", "value": "376884baaa4b9505792afc81cdedda42", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538703, "uuid": "872f60b9-f971-4ddb-bb6f-cf9277628071", "comment": "Malware payload", "value": "2902cdee050a60c3129b4bb84e74ddda7b129c3473556f689d83609d9a5981a7", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538703, "uuid": "9e547175-06bd-49c3-bc07-04823de2f648", "comment": "Malware payload", "value": "9a9944ee1c996875f5fac74b999034a53488a047", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538703, "uuid": "510caefc-33f8-4cdb-a973-6bb5fa406eca", "comment": "Malware payload", "value": "36a04d1c5edf8efc1099794de6363b482a4320ab1be3509952bbd5b293e7219600d64f5d1f7e0d9aceeb4c79b435f59b", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538703, "uuid": "2a150d48-3ff5-4b2c-a0f5-05d85f9a2568", "value": "T1D9217C1026F54718D7B34EB9BCBAE3218633F825EE5787CD1250A68548A4224E57BF2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538703, "uuid": "1c207432-1008-4d64-b978-62504de4aea1", "value": "24:8hwWa5y5LEnXKPiW2lxAtWmV+/CWw+//fIPQJ4I0aho+Z5:8HVZEMfTnPQWI0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772538703, "uuid": "a046846f-db93-41e1-b0f4-676b7643690b", "value": 1365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772538703, "uuid": "9bcd7c88-44b0-47f2-9716-949d52bc98a6", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538703, "uuid": "d677bce3-900d-4924-a8cf-eb03f7d916ac", "value": "2902cdee050a60c3129b4bb84e74ddda7b129c3473556f689d83609d9a5981a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5dcc438-16fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772540684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540684, "uuid": "6ab42035-2bc2-4501-b6ae-f503339c6b0b", "comment": "Malware payload (Mirai)", "value": "f59cc7d4f9de1383aefc63633ab1aeea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540684, "uuid": "2a2004b1-e3f4-4e0f-8613-b0d9425a294e", "comment": "Malware payload (Mirai)", "value": "294cbe17f1f05693c7b9b53c9bc26f63f82976d2db8241619644be58b4a45fd9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540684, "uuid": "4a7ae985-fa7f-4f4a-9679-d6f3c0d1c503", "comment": "Malware payload (Mirai)", "value": "42ff6c1db8c805f26dccd541366566e59bf015b1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540684, "uuid": "fc1cd4fa-59df-4aab-8c94-1790d05137f8", "comment": "Malware payload (Mirai)", "value": "dfa5fab45d4e2e50f0fe9795064c6dd5a57ed56be122a83a909883190382c520dfd78aa3af033357bb4a5a9b4789f387", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540684, "uuid": "565824c9-1d89-4213-ba6c-02ec56ea0fb7", "value": "T17D6302E01AB11B8C5676E8753ADE305F8124522B32DA29142DA651CEF80B20399B3EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540684, "uuid": "022afdfb-015a-4115-8629-fd25d082b60f", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZ6:8D+CAXFYQChaAUk5ljnQs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772540684, "uuid": "9b5ebab0-53ad-4bde-a641-bf3da3b0ad09", "value": 67600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772540684, "uuid": "e5567a9c-7165-4059-9241-7ae7931c12b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540684, "uuid": "b5c8835d-6fda-464c-9601-b4598cf91d3f", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec2e190-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (a310Logger)", "timestamp": 1772548671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548671, "uuid": "02bca760-6800-44c0-b4be-7f4600dfcd03", "comment": "Malware payload (a310Logger)", "value": "d233e188c2014516060aecaf2d5d1775", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548671, "uuid": "ade7e8ae-f3cd-438a-a9d6-5fa7bd9b38ed", "comment": "Malware payload (a310Logger)", "value": "299bdee15c3f9918e08b2e84e9763ce0cd482b4e95610bab9aa77707359215b6", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548671, "uuid": "813a93e1-2a71-4e3e-bc42-853dcbb45b2c", "comment": "Malware payload (a310Logger)", "value": "0bd407775f49ee5f8d96334896a0dbd5e33a2afe", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548671, "uuid": "a8875592-2fbf-4a9a-ae63-614d7b1c380e", "comment": "Malware payload (a310Logger)", "value": "12e303d044deba0ce29a8636b11630baed4c03bf0151229608c395bee11fcdda0cc148e3c6e1854c987a0887c2a5a96b", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548671, "uuid": "933afff4-ec74-4879-a29c-cbbad6b3314e", "value": "T1C8D58F500B48FF38895ED31A80BC3B0C8BE17ED2E53F7E164A6B58735A6B717617A094", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548671, "uuid": "de424e7a-d8c0-4513-8035-4dd9ca3cefd3", "value": "24576:/wCiUUrGtPPm6ypd3UgD7WJ7SEUUU3Jjx9RJy84M1uYQPdBLtaV4MfWBWx1rOND9:B1eJKQ763ri9jRJrTfIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548671, "uuid": "e7e7b4f5-d03e-4af9-bdf7-8abca12a4ea0", "value": 2784388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548671, "uuid": "952b4dff-a413-45c6-950b-51187543c241", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548671, "uuid": "f26280a5-3e4c-419c-91d1-919a7e7a4c1e", "value": "d233e188c2014516060aecaf2d5d1775.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb6a572-16f8-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772539244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772539244, "uuid": "285c474d-b19d-4d79-a824-cb11e3fb8496", "comment": "Malware payload (Formbook)", "value": "73b15d9195453be47404b18f3b17fdc2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772539244, "uuid": "365216bb-4d5b-4fa5-9bfb-c0899fe2ccf1", "comment": "Malware payload (Formbook)", "value": "2a045bbc471a99cecdc8ab5d7a7697455bc722a13b9cc3526c723744dd510811", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772539244, "uuid": "54740269-1e4d-44bf-b106-0d3d27076313", "comment": "Malware payload (Formbook)", "value": "af8ad1d29a187df94e89a80b87a95474d1189f32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772539244, "uuid": "b75a0fdf-13f5-43ab-b5e7-210568358301", "comment": "Malware payload (Formbook)", "value": "2b86dfa622a3bd567d4333d2b4c680241fb84a470daa767767e417e5be7afa98a4a8525db0ab3006db602e3106647ce2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772539244, "uuid": "86a11a0c-8820-4221-91bf-870dca7831eb", "value": "T169F4BFB976047CE6E67F863BCA965CD813723A638B87A4CE416467D30D633B1EF16804", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772539244, "uuid": "cd51f9b0-cb58-4aa8-92e6-cebcffd89636", "value": "79c2877b90f1bfb58c906f4d9155285f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772539244, "uuid": "cb5cdb3e-8207-4d91-8407-ae5a5d8cf878", "value": "12288:1/XHaQ0m9/r6B+IwtOMtY6W1bjBjqw5LZ1CL8buy5eKULZKdGMXsovUUn0:1/XR2wtOMtYIw5l1q8bukHUVuiUn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772539244, "uuid": "db03a977-c9e4-4278-8a50-c5000f149e2e", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772539244, "uuid": "1b68c036-18e7-42bc-bd56-a5ec8bbaef76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772539244, "uuid": "7113de31-7aa6-416f-aec9-b114d542e4f9", "value": "Documents_Ref099583940pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d01264d-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772518899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518899, "uuid": "ba828a47-399c-4af0-9afc-96030edf4636", "comment": "Malware payload (Gafgyt)", "value": "476927aa7b6017f202e694ded8a07742", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518899, "uuid": "4a86ea6c-9d04-4990-a709-2e38ef706109", "comment": "Malware payload (Gafgyt)", "value": "2a4af033280a81db09ac0157130f700cebcb41d16b4f2f6c27f4c2b27c468f88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518899, "uuid": "a77d290b-ded1-4931-8466-96cae32f4cf8", "comment": "Malware payload (Gafgyt)", "value": "88a7285098e65a6e9a8e2e7b2b34baa57cd8ae67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518899, "uuid": "2183032e-4cb4-41e2-b822-776c43efb40d", "comment": "Malware payload (Gafgyt)", "value": "fb40c24d22f1888c163569fd9dbadd6caf29bf7d185487f9d5972d2973c7df798b65f112ea74bce9c390d5b48d050d91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518899, "uuid": "64962f01-5115-4d5f-b12a-b79c8f91227d", "value": "T1F8C3955AA761CEB7E84ECE3B069A450110CD9D4A02DD6F2F72B0F61CE7AB88E45D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518899, "uuid": "57434436-da6e-4724-bf0c-85d5adb3c778", "value": "1536:umSoeTABpDae/NfeKOpyzLZ3UX1y6wo7I/wbXj+vg8:uMvfeKOp4LrKqwbT8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772518899, "uuid": "e08158dc-4922-4df2-bc4c-d1f5c95a8955", "value": 119167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772518899, "uuid": "542b130f-682f-4e31-a279-80deb04aa864", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518899, "uuid": "1965531d-7ab5-4e09-a5e0-15db3f928a76", "value": "sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7a1b7f-16ee-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772534840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772534840, "uuid": "8e614c2e-b472-4d76-a01f-9367ed3bd4d7", "comment": "Malware payload", "value": "0f15b0ba2f7b915085576f8abeaa277a", "object_relation": "md5", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772534840, "uuid": "7179fc28-601b-494e-ab0e-2d77ea12a3d1", "comment": "Malware payload", "value": "2d018036c7d6ae9b2ee1e9cf63e5c31bc76b90fe93f6faf2485e0115e43f4316", "object_relation": "sha256", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772534840, "uuid": "c5628451-6579-42aa-9e8a-ab8e1259f9d8", "comment": "Malware payload", "value": "257d1cafa392a6a9bcb60a7510bf868c6f202725", "object_relation": "sha1", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772534840, "uuid": "1df5fe71-af27-4b2f-ac32-c11bcf66c0a3", "comment": "Malware payload", "value": "37a5041759aa545e4341e11f3145e8b0d5dbf0f1258b6aec8cad4c4d7f614eebf9b8f499ef461bf06998b69e4da6b8b9", "object_relation": "sha3-384", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772534840, "uuid": "07f0570d-92dc-4bdd-b779-f93e66d5aa4d", "value": "T18C1523157B444212C79437FDCBFFE2C5CAAB6C4E2C0B5C94E576F28BA071791239914A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772534840, "uuid": "73d51ad9-f1ed-4b95-a6be-f8e4d7aade21", "value": "24576:KbBPQGLub7tNJ0zenqpvWLALclMrRNib+GNq:+9ib7tNJ4enqpvn79G+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772534840, "uuid": "5962a7a3-fb54-4f4d-a6c0-6370d8449862", "value": 893679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772534840, "uuid": "e937b56f-89d6-42ad-8cb3-3ebe90d382c8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772534840, "uuid": "316f414a-a2b5-4960-8caa-9a1ab46b2b20", "value": "IMG_20260301_0001.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fa2446-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772548683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548683, "uuid": "bdfcd186-0b10-477c-84ca-d65e6bd670da", "comment": "Malware payload (AgentTesla)", "value": "8f871265a82f2338d9d431b22e5d3766", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548683, "uuid": "dd6f02d8-00f7-47e8-879f-ec9b8511c674", "comment": "Malware payload (AgentTesla)", "value": "2d60868369eae0addce18641553ecdeb39b3c8658d2e6dab535af93eb45a671e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548683, "uuid": "2b1aa2f3-c32b-42ee-9aad-2eea09f0d186", "comment": "Malware payload (AgentTesla)", "value": "10e85ae9d74d3797578270e9c6bc56c4e6e8a550", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548683, "uuid": "d4297405-413a-44a9-b500-a77523ff510b", "comment": "Malware payload (AgentTesla)", "value": "973618695f03f77d066959be6abdaa28304331202a952ca7d5f72df359846ffa5db6d5b741679f1712703a9e096daa60", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548683, "uuid": "659b63ae-4448-45f9-933e-918b1b4ea70a", "value": "T1A7559D80D82A6FC81E35087EB5FB54598373ADE4F58FF381F62AEE114779664304E4A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548683, "uuid": "d4f7221d-1daa-4cf1-998a-811df617da6f", "value": "24576:/3NfvIzAAnB4VR31XIMBL5jX20OQcupztVOO32ocJpuzAY9nxB240shvinWzEkSs:/d3uFyM61J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548683, "uuid": "bc45cbc2-be84-4950-b262-83d92791196a", "value": 1359444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548683, "uuid": "9fdb4416-f230-426e-9111-fc8db1b09742", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548683, "uuid": "c054e7c1-1298-40fd-92a2-424d1cf4acbb", "value": "8f871265a82f2338d9d431b22e5d3766.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1e187b-16cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772520486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520486, "uuid": "0ddbefb4-d61a-43d0-ae60-8c347bb4b233", "comment": "Malware payload", "value": "37e870345827c7e8f4d4c962e99cdf25", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520486, "uuid": "60ed32d8-eab4-40ef-a888-1ff650f604e0", "comment": "Malware payload", "value": "2edae586dea8b030446cb55e2408e3620a272eb2a0158b31693703e2d8e33df3", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520486, "uuid": "373cf3a9-aedc-4f8b-8c4f-d160e6adcc01", "comment": "Malware payload", "value": "51dbe8087f13b2e27d1e9a03c4117971cd61ea0b", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520486, "uuid": "30ad19db-3f93-4bf2-bcab-ce26ac2770d2", "comment": "Malware payload", "value": "79d77ec97c711a1041b5cf37ada5fdc16058538375b363304abdae8337117acef33d2df33675a2e372bfcc7fc8cb1d15", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520486, "uuid": "41f10968-92a2-4f21-a2c8-9bbc4f9a87da", "value": "T13725230B79C48603C162967C58C2D8A161199CADDA60CDAFAE037E3F71FEAF5DC9211D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520486, "uuid": "1e51ecfd-321c-48e7-acfe-0dff39d6190b", "value": "24576:jt8gBRkZAxd8I0xC6NRXDaDwtJeoepRO68Qg:+gBeZ2R0sQFDO+0oevtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520486, "uuid": "7d6b56bb-1ee0-4791-b5fa-67484c404160", "value": 991232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520486, "uuid": "0f1ca0bc-cfb4-42bc-a74c-6ad9342bad66", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520486, "uuid": "b929314b-7964-4131-81c0-a2c4bc9a65c1", "value": "2edae586dea8b030446cb55e2408e3620a272eb2a0158b31693703e2d8e33df3.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e07192d8-16f3-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1772537212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772537212, "uuid": "001295d0-d14e-4a37-88d7-b043c29ac863", "comment": "Malware payload (ValleyRAT)", "value": "d7a1faeb8330ceeaa253de59308717a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772537212, "uuid": "2456c9e3-69e2-4482-b24a-d0d8ba5d6f6c", "comment": "Malware payload (ValleyRAT)", "value": "2f0c2610f4d617f8a29d0538de4d6792a439fafad8476fada0df369f56d5f5c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772537212, "uuid": "0acaaa0a-fb4a-4a31-8058-6997ae274730", "comment": "Malware payload (ValleyRAT)", "value": "5908be47e3da6ab88435239410e11d1e0372ae3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772537212, "uuid": "50caaf0e-ecf4-4844-9e73-6fab7625b14e", "comment": "Malware payload (ValleyRAT)", "value": "d0129dd3ab29529e58380d30639a34e9c9692f71863f2c59212092cb2d6219a7f3699e98af3f7f9eda555e54df9523e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Malgent", "colour": "#5EC72B", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan:Win32/Malgent!MSR", "colour": "#662DFA", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772537212, "uuid": "7366f041-9959-418a-a1e5-d59f3f7be78e", "value": "T10C4733D241486E8FED288E7DE9D3621A2E3539373A12617F75C14A81BA7210DE37BD31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772537212, "uuid": "d29643eb-ff0a-4bbd-8da3-246a60591342", "value": "d221b1dc8c3a08622f6512e7876527c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772537212, "uuid": "5b1bbd4e-776c-43f8-82cb-14def3d8f906", "value": "786432:vbHKihJcVbnXhIeevfqcMOWmeLnaVQ5fZb5A/:L2rr0fqhtGQ5fZbC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772537212, "uuid": "3a697a10-1ea3-466c-9e3f-e9f68538c3b7", "value": 26408477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772537212, "uuid": "c7bb0d00-d1ea-4ea8-8893-7788e5076681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772537212, "uuid": "41fcc8d6-5078-4e70-a9a8-a4bc9a2901af", "value": "Clnrome64d0-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a4d137c-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772519028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519028, "uuid": "d8a3e45a-d5db-46ec-a63c-3c928d6adf24", "comment": "Malware payload (Mirai)", "value": "50654fe404d9837cf92e9ffa94123e52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519028, "uuid": "a50eab3c-6967-4e13-9a5c-275f9c5ae58a", "comment": "Malware payload (Mirai)", "value": "303376546493b57fdd9b988c9fd2051e2abf67f6f46c4ac860be93ac21380d21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519028, "uuid": "1cc0cbde-088f-4064-8e61-62821d26c283", "comment": "Malware payload (Mirai)", "value": "4aac67d69b024ddfe2662d005c7861acef2f62be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519028, "uuid": "e7e0220d-a923-4cb9-8a0e-f7e6d16e89ec", "comment": "Malware payload (Mirai)", "value": "c5271819978688bcbfd005ecc8259c983ff5f82becba63f40d92cde1b889705a43ac6d6ebcad9b42731b0ebdb98f2577", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519028, "uuid": "8ea43c5c-1bdb-4298-88f9-7dc7e4cb19bd", "value": "T12D932A82BC409A11C6C51777FA2F118E3312679DE2EEB262CD141F747BCB91B0E2B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519028, "uuid": "6d3788d9-a580-4ece-b445-4b71c55055d1", "value": "1536:epnyYWbIRBBAizE66vxa+5QWlTotWXJ70qZdiL1kzvIqiwCrPmHa4:lYQ0BBvY66vxVVbZYqZI8CrPmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772519028, "uuid": "fe774ff5-41ef-4d76-a340-009fcb8d7ca9", "value": 92728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772519028, "uuid": "98638ea9-6ff7-47fb-ad15-e1a75a0063b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519028, "uuid": "eff589fb-d0c6-466f-a1d3-f68ef600d135", "value": "nullnet_load.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d0e661-16f7-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772538769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538769, "uuid": "05fcfd5e-72c7-40a1-aacb-05a18f267f88", "comment": "Malware payload (ConnectWise)", "value": "b27f8f4b32e859f156eedb9c813e9404", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538769, "uuid": "be67c3fa-6780-4e68-83db-b3a8a4d0b704", "comment": "Malware payload (ConnectWise)", "value": "304b7be7acdbae7d8073d41e5540b4078cb61a8558fcfe5253c2fe5b715f77da", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538769, "uuid": "62063075-5eed-4a6c-920d-0bdf4ba65e59", "comment": "Malware payload (ConnectWise)", "value": "46288514cabe50d51a99315d0c54f7fd475d37fb", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538769, "uuid": "4969e05b-f562-49ad-89d6-1a8ff49c8707", "comment": "Malware payload (ConnectWise)", "value": "45604f72705a581ba1c6ecbdf32137bcb3f948d171628058f03f7591cef878be69a34217097cfc02d756f525a670482e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538769, "uuid": "8ea03676-c595-4ca1-8d37-bc45f4d02e98", "value": "T1B6A6237127F88429F1A75B39EE3A89E229387C64DA26C05F17B43D0E1971E509B72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538769, "uuid": "386bd9b6-886d-4db9-95ce-3257a4b96083", "value": "196608:/KaLNkbgci4QSKaLNkbgRKaLNkbg7KaLNkbg:XWgciHkWg1WgzWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772538769, "uuid": "d7bc7406-05b6-4741-9da0-c3eb5f034200", "value": 10072064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772538769, "uuid": "47dab52e-58b2-4670-afc6-23941dc20244", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538769, "uuid": "30d04436-10e7-4cf8-a567-a5178c0fd6ef", "value": "ZoomWorkspace.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14e5942-1716-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772552192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552192, "uuid": "1ce4be46-bb8f-46c0-8f19-fdd8a50249df", "comment": "Malware payload (SalatStealer)", "value": "14fa427264a590c1814babef08fcca5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552192, "uuid": "0edff2c6-7392-4db2-a969-741c1a2ec3fc", "comment": "Malware payload (SalatStealer)", "value": "30a50cc0f7b317c9734e6792e7e4ec174035d92031bdcc87a80ad8826adc60b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552192, "uuid": "5f460659-fec3-4aa1-a3ba-ac900efbcbcb", "comment": "Malware payload (SalatStealer)", "value": "ecb23ae5b6751012a8d37ca8c026ca77ab628fba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552192, "uuid": "4fe43d4b-4533-4cdf-a1b4-28d5fa10a308", "comment": "Malware payload (SalatStealer)", "value": "24ffca701555beb636406b5a4c808d91c5e22ee3c68144f0cc1a1713dce1873c983cbc975669e8a16cbc05bc13197be3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552192, "uuid": "aec84ee8-a0d3-40ae-a181-0f2ed75bc0e9", "value": "T1C5E53369BE16C6ABC6CB187B21E17FA6D63B00240DDFB35D885960E84F75DC29293370", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552192, "uuid": "d95d50be-d59f-4dad-a228-4046cda401b5", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552192, "uuid": "1d990621-7211-4de9-aeb8-0f50c00200a6", "value": "98304:zj4uSUTxE/+s4ipMQc7YzoLZYX7hOIjKOm:zjdSME/+s4AMQA0oCwIjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772552192, "uuid": "9b947bcd-df7d-4071-a115-fd6e438d3689", "value": 3296768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772552192, "uuid": "324c956a-f1e9-4ffa-8f41-e970a31f99e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552192, "uuid": "edeb0cf9-4d61-41b6-a9c3-8d044c0a223d", "value": "SecuriteInfo.com.Trojan.PWS.Salat.332.17424.12534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697570d0-1708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772546032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546032, "uuid": "386642e5-31db-4af5-99f2-d56d7c728b41", "comment": "Malware payload (Mirai)", "value": "dbedda31dc042aca3494eab950850112", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546032, "uuid": "99da5255-7e5f-41da-a22f-89a49cdb9833", "comment": "Malware payload (Mirai)", "value": "30b6c452c689d164cc2218b695a8af272c0aede9e7ad382ba3ab20ae88799f4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546032, "uuid": "a1643e3a-84ba-4165-a043-189deeed32fe", "comment": "Malware payload (Mirai)", "value": "8e244f03d1b8869e847d5f6da6eb4758231eba79", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546032, "uuid": "0f588c3d-6ad2-4d66-9e73-198e41cb4530", "comment": "Malware payload (Mirai)", "value": "e27c6079c9e5a6ebbe5a9eec63f8f16dccb0445c857ee54995062317dbfca172ba984e22edea85b2926cd615ba4f1558", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546032, "uuid": "48ee9e7d-8ac6-45ee-af9d-4654a5b25c27", "value": "T108834A97B401CD7EF80AEB7740230916F131E7A60A831F36675B7967BE361A44923F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546032, "uuid": "be82e807-fa58-4fad-9166-c8bb6409c71c", "value": "1536:a3GEkCXk/4r/CuVeflSyIpQ+9xA8A3kIyNRsffZK8RbYXuGPSaQ5623FjoXG2+1W:WBref+RsffZ++AQI2VjhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546032, "uuid": "ae7d078e-7d08-4a5d-a490-98bfa61cfabe", "value": 85508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546032, "uuid": "662096b2-40fa-4bbb-97f0-681d77f5643b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546032, "uuid": "7e2ac6a2-1cf3-465e-adcb-13023ab85827", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3c271b-1708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772546087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546087, "uuid": "d3201f40-4903-49ac-ae16-96aba262232d", "comment": "Malware payload (Mirai)", "value": "ab41ebe3f78fcb74190621212da9baae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546087, "uuid": "cc72689b-5c4c-4f4f-9634-c6e299106fc7", "comment": "Malware payload (Mirai)", "value": "30fba906543e3f79e3e679e31c6bbf7a8666fe31ed1c8cd9b360bd95848355e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546087, "uuid": "af340037-470e-4c95-8257-934154720ec5", "comment": "Malware payload (Mirai)", "value": "330cc75d25aac896e4edd075a1bd7db06d259771", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546087, "uuid": "75d6fab0-96c0-40c3-a9d9-bdef6bacc086", "comment": "Malware payload (Mirai)", "value": "611a1e53a31d6aa8f414cdde3407e49ea38117328279dbb7add4ede9ca56e4cc7f61047aaaefec478d38ba7920ba81b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546087, "uuid": "97a3bd8a-5144-4831-9bbb-2086d92fb223", "value": "T1397329C1FA4B80F5D80388704167F23FDB32D9798065C79EDF9AEF65DA336429216289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546087, "uuid": "ed4fe39d-79c2-4b22-8eeb-eb311eef637b", "value": "1536:R8/8+3TJdnDkLlptsYgkMFWbIb6NSiDU0hMU2:9lpts8LEb6NSiDRF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546087, "uuid": "80f6c9a3-a167-41f3-aaf7-c6a50d5ecf51", "value": 75248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546087, "uuid": "be7264f2-85c5-4f30-a0bb-6138c29bcb61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546087, "uuid": "97191caf-752a-44a7-8091-6f61fc71c42f", "value": "titanjr.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1d04bb-170c-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1772547915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547915, "uuid": "d5248172-953d-429e-bb12-178109872021", "comment": "Malware payload (CryptOne)", "value": "0126c1e09a61f4f15fab1f1129a94666", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547915, "uuid": "83e92607-fa7a-499b-b36e-59cf3c621d95", "comment": "Malware payload (CryptOne)", "value": "31858f64c2588f554b33d7b8389fb214945ec08190cb1ceabd144939d769409e", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547915, "uuid": "307224ed-0d7e-44ff-89cf-5a7079ffa20c", "comment": "Malware payload (CryptOne)", "value": "ff01814d027e37655d80a4bee28f06cb7efece74", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547915, "uuid": "0e193fad-d499-48b7-8a2b-d006c97a5b16", "comment": "Malware payload (CryptOne)", "value": "ec8e39944ac3ccaa3e1f98fff3eb1282b7a48d564adf7390550a05022f6cec19924a35dc3933e08ee3c7f2a31272da79", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547915, "uuid": "b06ebc97-604a-466b-8b59-c526fbf43c2c", "value": "T11456F170FAACD439E06EDB794A2BB36C16DE35C27E15AC4A03950EC327342959DCE187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547915, "uuid": "7f74617d-45fb-427b-8076-19515816184e", "value": "ed160f57a556f205db44503c0c7d19fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547915, "uuid": "f906c457-f67d-4041-971a-4d56542ff91a", "value": "98304:X94IRmc1ViJ+GwcnAYv3R+aDeNvJvg7d4:X94IEc1IttAq3LyNvhg7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772547915, "uuid": "ee621ddc-fb90-46a6-aa04-ddabf0a1e759", "value": 6076416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772547915, "uuid": "312c0524-f56e-4d95-b563-5a5f7cd14400", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547915, "uuid": "1bbac946-0852-4082-b110-e5f723bb89a3", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a841dc7-16f7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772538786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538786, "uuid": "2be9828d-7a80-4fa9-a5ef-acd3d40f7f28", "comment": "Malware payload", "value": "32f747c1a4a9aff1b4cea7f35f2f5111", "object_relation": "md5", "Tag": [ { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538786, "uuid": "4332a336-c791-47fb-8e97-a0646a3b2e26", "comment": "Malware payload", "value": "31f1a97c72f596162f0946df74838d3bef89289ce630adba8791c0f3220980ee", "object_relation": "sha256", "Tag": [ { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538786, "uuid": "b29cebda-5e46-4136-b99d-10209a0bb42f", "comment": "Malware payload", "value": "de32d402e6e883a86bee83911d00e4307a4c26e7", "object_relation": "sha1", "Tag": [ { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538786, "uuid": "e8b782ae-af67-44af-b14e-245486ec8f26", "comment": "Malware payload", "value": "72538ed1334455b438884b236dcaa72dea1ecd602a97f1b3401d505200675c2710aff7e71d5abae56cc49427b9896f1b", "object_relation": "sha3-384", "Tag": [ { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538786, "uuid": "d7ff6a02-03b0-49e9-91a4-aac161900761", "value": "T1FA5302239DB7A0B67C5149FB4ECC3C914D8E3942746727782034B822AF12A0B795E37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538786, "uuid": "cc830187-b344-473f-ad14-517f88fb92f9", "value": "1536:9QuaFPFizi08jxJ8e+OQh7YcrpoQMeiFSZsEhgBSwDnub7tISsQXHiOm:KF+ibxJ8bOceneSmUuCIiOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772538786, "uuid": "5ea69d6f-c3fb-4773-a1f6-33db9c916089", "value": 65804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772538786, "uuid": "6734f803-0a91-4e1d-ae3e-d3934d5925ef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538786, "uuid": "103d42af-c64b-4a6b-b65d-c46afb922f74", "value": "31f1a97c72f596162f0946df74838d3bef89289ce630adba8791c0f3220980ee(1).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8761a869-1708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772546082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546082, "uuid": "a205f306-79a8-4639-8a95-64e50f59c853", "comment": "Malware payload (Mirai)", "value": "c2db0216e6209b64480c329f6ac58752", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546082, "uuid": "8e9213ef-1896-42b0-bcec-7782e3a63a66", "comment": "Malware payload (Mirai)", "value": "33b7e7d4c76afddba14fed64d5f1c65ff2a36c15bc3304108d10bc9c2c729312", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546082, "uuid": "c7da0c3e-e12e-4c7b-b5c4-3d8ee724707c", "comment": "Malware payload (Mirai)", "value": "af7d1be661fa6896c6c575648cacd7cae0825e61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546082, "uuid": "da985091-9f29-463d-a27e-4f7a627c390d", "comment": "Malware payload (Mirai)", "value": "6195db67fecd48324de5967e10a552b51910effb2c6c7382fdf677ad36080b07d798e2604ec81b18383ac91902525c69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546082, "uuid": "797fca5f-a5c4-444f-9b52-952cbccb53bc", "value": "T18E638C23C93A0D94E54844F070A08F39A763ED19C1576EFB559ACA79A047EDCF209BF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546082, "uuid": "39c9f833-29ac-4386-8fef-c24fe5fa4910", "value": "768:+wHV4jfdc4daDUenJCnxyCNUquN0KR+3CvIPawof8zn5Cmc7xzfAZuFxnezVI:+wgdcwekxycUIKR+3EffW5CmvZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546082, "uuid": "54f0f6d3-2748-485c-a37a-a4c54f642a15", "value": 71948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546082, "uuid": "27ad6ae2-8e8b-4107-9f14-845622405df6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546082, "uuid": "fe8d8340-9a03-4c7c-a536-5de80a99eab4", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b3e8db-1747-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772572926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572926, "uuid": "17083949-231f-4136-b847-96495c781c90", "comment": "Malware payload", "value": "907c0f2518a158099ce20302140c595c", "object_relation": "md5", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572926, "uuid": "f6298dcb-dcde-4d49-ac75-0577fdc6d8d6", "comment": "Malware payload", "value": "35ce510e8d30b62854de2ff431ca364ccfddd8cfea09658c2b3901a3731c0e6f", "object_relation": "sha256", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572926, "uuid": "2de5667f-4c63-48ba-b9e8-9e1e7fda150f", "comment": "Malware payload", "value": "e115ed9a8180896b242155ce33376c6db1a65d47", "object_relation": "sha1", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572926, "uuid": "32812ef7-cd86-470b-8d58-08e87bb80707", "comment": "Malware payload", "value": "3795b59e8a10d2c995ba3fdb548d661e954ff14c64386c07719cc43c7896bb353ca65ede5c1fc38a0c7de39b4734ce84", "object_relation": "sha3-384", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772572926, "uuid": "84cf55dd-3770-4763-88a1-da6011279552", "value": "T117210F271788A27B5A14C45D8B2C9F10EE01A1E6F41456DF3734DB5A0A944F7C1F5845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772572926, "uuid": "8b47cd69-6ee3-453b-8c54-c2194a19293c", "value": "24:LI2rUbD4euW3CCMDZ8En1Yw5ACLAC4UJsk+25HuVMiz+u5WNzj5WwCa5WN412:CD4rNPVn1jyBKQ2xuuuK/fCaK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772572926, "uuid": "426a5d14-c0ee-447a-aea1-b57e964ff76b", "value": 1367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772572926, "uuid": "6fadcde7-0b10-4dc4-ad63-516cfcd6d094", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772572926, "uuid": "306da5f6-9f98-44da-ba3e-d37da5115f55", "value": "axqgcwj.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f9553e-170e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772548574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548574, "uuid": "372e2214-e3d0-43aa-a635-d4e24b791318", "comment": "Malware payload", "value": "867bd67e480ecaa244d66d11661c97af", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548574, "uuid": "f59fbf6a-8b6b-49b4-897b-b94e55ed5ec4", "comment": "Malware payload", "value": "3718f306c8358569ccc3c1ce9df4162f87f10158243188b8faea8992545dfd3b", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548574, "uuid": "04c0a118-b548-49a0-8941-5e3dd90dde38", "comment": "Malware payload", "value": "5bce0fd2b50ede900e3fcec0b745fce8634b2aca", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548574, "uuid": "36ea212b-52d3-4ae7-84fe-e344ff8a5b12", "comment": "Malware payload", "value": "029cf7d02cb493180a10fdd87a18b5d1cf4253cb57cb79be5084c991c9f9315ffd530bdbfc65eed42444ee0b690be192", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548574, "uuid": "0cfafdb2-c454-45c8-bfc3-7e25b60a2c57", "value": "T1B382952A8D09EFF4163E3151A5AB6826A5100362F539395C7D4FC4ED3F3AA14CBE01ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548574, "uuid": "8780b086-049e-436b-87e0-0b6c62fc66cf", "value": "384:KSd/ZoWXqCW8saDaGrzObpMMH6ovVuwtCh3I0SHGhTkb6SF76XTBSoo:KSRvosOHvJtYFBOuBSoo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548574, "uuid": "1b75d46a-a1ed-4999-b399-fd73f388fab5", "value": 17834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548574, "uuid": "56211b36-bce5-4248-8348-0dca4122ed06", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548574, "uuid": "ccd15289-b2fd-4d51-9d3a-7a05f26734c1", "value": "867bd67e480ecaa244d66d11661c97af.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771eeaa5-1708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772546055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546055, "uuid": "10c33c0e-7504-41aa-b361-847f6bee2bea", "comment": "Malware payload (Mirai)", "value": "ac6fda7bb0add7c2ad481c4464ac2595", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546055, "uuid": "18cbfc3d-b38e-4c4b-828c-bd38a920c74f", "comment": "Malware payload (Mirai)", "value": "37f948633ddc2f57265c48103a72e30b31ac096381e31a4ec8f846fceefd3d08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546055, "uuid": "897ea38a-8a58-4142-8256-02b7c25eacc7", "comment": "Malware payload (Mirai)", "value": "d6017206a0681e9e03aaf69bfb44cfb38a69899f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546055, "uuid": "65dac348-fce5-4f99-81b5-504589886e36", "comment": "Malware payload (Mirai)", "value": "47374d4e3c3256ab6e630ddb837b27452c2932939954862d23d77e2c1039d25a46f746408d3aca929ad5a8b8978e663f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546055, "uuid": "2a5ac901-5cd0-4631-b4da-28a3092e4560", "value": "T194935CC0F783E5F1EC5701B5A137E3339732E039502EDA56C369AA27ECA2550DA1A76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546055, "uuid": "60495de6-1fe9-4bee-97cc-c7fa65929ab8", "value": "1536:tr6dfMqjhWebH868H0lAeVq/Lv/EL6c4eW+JIptgv49SQflbsg:trifMqtWebH98UlAeVq/bC6YW9tD0Qll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546055, "uuid": "bddda10e-d36e-46c2-bf60-4533dd36f163", "value": 92812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546055, "uuid": "2e41d6cf-fd8e-4b55-89ca-bd11d73b96b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546055, "uuid": "f0d60be0-b56e-4375-b573-0ea48232229f", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c93c13-1758-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772580496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580496, "uuid": "0856cbd2-f588-46af-962c-9f335c770a51", "comment": "Malware payload (SalatStealer)", "value": "2e4ef197012c34595ef3e95aa5ff0f85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580496, "uuid": "fc01d7ea-b672-4836-8732-34cc00b9f0da", "comment": "Malware payload (SalatStealer)", "value": "3884cf9dfe11ab6cd52f29b7963efd87220535a3b5a7bf1d751ec1992a976fa0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580496, "uuid": "46df6ca8-01d8-4347-8f6d-91d401b3c549", "comment": "Malware payload (SalatStealer)", "value": "e61b643c41c548390f3dea8f2aec172c54b27223", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580496, "uuid": "b85fe13a-c2ea-4ccf-b60f-f82d4579fdf1", "comment": "Malware payload (SalatStealer)", "value": "a383e38076332c5c5cb5f0d3b77e4a21a8f9ad7ca2265babda851dba8bc839e44f71442e9c8fb91399f510aa9048f126", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580496, "uuid": "785116b8-e6d5-42d9-a4de-fca1df15d8aa", "value": "T193C65A51FA8B54F5E9031831415BB23F73355E048B28DBABFB147F6AFC7B682192A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580496, "uuid": "32dab703-4b32-479a-a943-af1ec9567c19", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580496, "uuid": "7196ec43-31c4-4e93-862a-db810ff96f01", "value": "49152:sDtbe52JPoEkeW2pqfaUi7rPmOe7x061NtU4ccIbEgNs+lNEYFoaP6ojjImUuspz:Kle52YeL9rcIb0+lKsj0XN3AVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772580496, "uuid": "ae737a75-881b-4205-bb24-3a7de34f6e72", "value": 11671552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772580496, "uuid": "902b810b-496e-47f7-9055-f1cbeb6bb354", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580496, "uuid": "ba16a04f-a087-4448-9a28-99fdc2409e46", "value": "FlowHelper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9098f133-1708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772546097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546097, "uuid": "e8a7895a-eff4-4723-b4a9-6ba07b446236", "comment": "Malware payload (Mirai)", "value": "e0af743c60d17abd266f1541d027de13", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546097, "uuid": "3f758bf9-3e36-43a9-8e22-262e53569ba4", "comment": "Malware payload (Mirai)", "value": "39022ca617427980136f400ec6af4af23f5d24b0f2c95e2818bccff916a8d339", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546097, "uuid": "eeaa497e-6c0d-414a-b71a-a14b9ce644a6", "comment": "Malware payload (Mirai)", "value": "5d56ce3d0ebe654ffedacb9253def49a5bab7564", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546097, "uuid": "b5e0d920-4d69-4d1a-8d29-fb0919db21e5", "comment": "Malware payload (Mirai)", "value": "fec5d2a25868080e7319429d530c29c98a08adb9d6d6f97654d3364bde65ff4e275950d2ae2e89e5cfcd0b87e6af81b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546097, "uuid": "ce64a81e-7f06-44ff-9bde-f5297cce13c4", "value": "T109E30A46B8819B12D5D111BEFE1E128E33231B78E2DF72029D246F64778A9BF0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546097, "uuid": "8453ec02-1a6f-4467-b018-bcc4ef88d9db", "value": "3072:b8S5cURgw/PXuxMte/aSyuBwSQm9T+cDmbtZ:bj5cKZPXmMtwa9uBwnLcDmbtZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546097, "uuid": "d49d8c8f-b147-4abd-a423-6db0a4e48272", "value": 146268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546097, "uuid": "36dbd328-27cf-4985-b040-31139e1ded1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546097, "uuid": "de71f046-1256-4a91-8025-829e9ae5bd3f", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5ced39-172a-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772560779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560779, "uuid": "b749c82d-2fdb-44e1-94a9-ad95146345ad", "comment": "Malware payload (Vidar)", "value": "d453eb6a113715307ed4c1e67e8f13d0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560779, "uuid": "51812b9d-cd31-440b-8349-5c6ebf9225f3", "comment": "Malware payload (Vidar)", "value": "39aed692398bc47c6e6e9dc2be3f113cd1cd7fc7ef12f0235fed301fdd719634", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560779, "uuid": "ab59dd04-bd7f-4c97-a427-7b5e8bd378ac", "comment": "Malware payload (Vidar)", "value": "227de39d2a33b8ca25bdcd6426d562b2ef7dd935", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560779, "uuid": "97c1901a-5344-409c-941a-68edc5a995e4", "comment": "Malware payload (Vidar)", "value": "dd852f40dcab4a99aaa88699c2650d332e73a67294ea0896562581d3c420d2761b66cd18eea1e8659ff985c244dfacf4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560779, "uuid": "578eda22-f0e4-4ff7-98ca-4c19d6a2a2a1", "value": "T18096F52B22A1B568D12B813AC19ABF4CD5F374F4073A82EB56A4136D4F159F14E3A733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560779, "uuid": "5b6eca16-e839-4979-979e-fa2d04e299b2", "value": "9fa09a64686909db97ebc147f2f0d1cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560779, "uuid": "2017f233-3023-43ae-8813-021dbd9fdaee", "value": "49152:aSC0G9vUq/7AVxLk77pe9wueSuTgF/VWfHOjOoeouBunDfFTTP4qSFnBDAvCB7Jj:W7b2OoeoSKFqRvnk7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772560779, "uuid": "4bd9bb22-21b3-465c-a9a9-e2a653bbc4e9", "value": 9077248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772560779, "uuid": "d4e782e3-557f-4c62-af2b-9ce44596bca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560779, "uuid": "31148e6b-d2b8-4ecc-a6fc-eb14e4d68887", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983ffbde-1741-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772570591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570591, "uuid": "a911dc1e-6125-469f-b4cb-07e692356093", "comment": "Malware payload (Mirai)", "value": "ae21c3c2e2f6de0454ffe8ada413b0b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570591, "uuid": "bffac0a0-251f-43f8-b814-9110367b760e", "comment": "Malware payload (Mirai)", "value": "3a4b22f5b96ea6e175e0d0210070258921354c66643263d1da13e572be781cc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570591, "uuid": "92adb1cf-5601-45de-90cb-270494d87976", "comment": "Malware payload (Mirai)", "value": "f6c85cf8e9f71ad6d433ad444f58599819d66728", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570591, "uuid": "a820cfb8-289d-485e-9812-f3c5ec1d13d4", "comment": "Malware payload (Mirai)", "value": "fe32faf60edac30e3341041874d1e9af2af59ae43cd1f58b3dbd808b2952744a94431250a31a9958e6e62946886d7be6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570591, "uuid": "ba9b6654-b53d-4653-9524-caf1b56adfc6", "value": "T1AFE2F1F6E25A5513E1CE103F14A22DCB0410A3BFD0C9C76A63E41DAAF8A7790AC5856A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570591, "uuid": "5a483a2e-ed38-4ffb-bf93-100820557b64", "value": "768:cdaQJCBHaMD96X8vyRdjgp3RgQKEnz8CVDzJtNnbcuyD7UpUcJ:6rmaMDqIyRCpCEnzRVDlnouy8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772570591, "uuid": "ee68fa0c-4659-409a-9066-1bc8e51cdf03", "value": 32752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772570591, "uuid": "4da0419e-9e5a-470b-bb70-7306449264ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570591, "uuid": "ffc5c2af-3d8f-4929-b7f0-60774ffda55b", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67e50d5-16c4-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772517063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772517063, "uuid": "71d28a12-9678-4fde-a2b4-3c1369fac137", "comment": "Malware payload", "value": "95eb254d7e6b1d493a9cc35329030bd9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772517063, "uuid": "24a90c88-763c-4da5-886e-afa873fff9d6", "comment": "Malware payload", "value": "3a502646c40efb5c72617803722fc2e5476f980cbb580fa28b8dc2da0cb48c49", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772517063, "uuid": "b0659a87-7c4c-4f8d-ba8a-317d8765a7f9", "comment": "Malware payload", "value": "aece0a45123c78cc5f345a802cccd459bcb8d89a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772517063, "uuid": "13e23449-0f27-42e9-865c-274046dd9fd0", "comment": "Malware payload", "value": "d85c17f4e5e3dd4bf02d3ae1df16873d5153b5f8846b552f3ecc6364b9af0cc76a284a1e37202af0a9b25acb4b4b5cb3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772517063, "uuid": "64c16b42-5662-4f0a-bc97-be49a3560771", "value": "T1DE5533AFB25351AA1E49D9243D9C35E6F1DB74648B9F1BDF32BCAC0271158C9E007C2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772517063, "uuid": "c535967d-ab15-4872-ae96-b830af140030", "value": "24576:FB89Gu8tSJ6dUamySVmE2Fv2/0Iy/+zZox0/bFJZqJXG4wSyhFYywu:3lu8IwUDVb2SzrZqVBwS9ywu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772517063, "uuid": "7f2203cc-3a58-4024-a451-fd854726e96b", "value": 1347796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772517063, "uuid": "0726ab37-e356-4c01-a55d-16026f0aa21f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772517063, "uuid": "364036e9-00c5-444a-8b77-4ce2ec1d44be", "value": "EInvoice_20260303.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72a9ab61-170c-11f1-a769-42010a9c0008", "comment": "Malware payload (ShadowSniff)", "timestamp": 1772547765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547765, "uuid": "e6da87f7-3163-42b8-b38b-a1be1242f5d7", "comment": "Malware payload (ShadowSniff)", "value": "2591d145ff510f7fc4d6290d3bfcb130", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SHADOWSNIFF", "colour": "#DAF034", "exportable": true, "hide_tag": false }, { "name": "UAC-0252", "colour": "#63B372", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547765, "uuid": "d8cffe4a-5633-452e-97af-0f3a49536d75", "comment": "Malware payload (ShadowSniff)", "value": "3abf295b79992532b03261a81643124d134fa7e86fb901b3bfc74ad0f192dc7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SHADOWSNIFF", "colour": "#DAF034", "exportable": true, "hide_tag": false }, { "name": "UAC-0252", "colour": "#63B372", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547765, "uuid": "06a961ad-50dd-4f5d-88ad-1ff273dba336", "comment": "Malware payload (ShadowSniff)", "value": "5025845b23f7aec4072e02686e183729acf8d511", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SHADOWSNIFF", "colour": "#DAF034", "exportable": true, "hide_tag": false }, { "name": "UAC-0252", "colour": "#63B372", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547765, "uuid": "891ae464-59de-46d9-b11f-b7686413de86", "comment": "Malware payload (ShadowSniff)", "value": "619c792127d7b8412b2f9d681e2d18b6a79060fcd3cc7d4998d068f30fee25789a5046d97b5e8956648b352321075575", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SHADOWSNIFF", "colour": "#DAF034", "exportable": true, "hide_tag": false }, { "name": "UAC-0252", "colour": "#63B372", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547765, "uuid": "7467b667-f393-4d3e-a422-08749481f377", "value": "T11E058D07F3A980E8D0AAC274C7569627FFB2B44A2234B65B97E04E562F13F706B1D314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547765, "uuid": "7ca095f5-bcd6-444d-a43c-ddf18aa4b9e9", "value": "72928cdd42fbdcaf7b481de4e440a0a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547765, "uuid": "d783c3ef-3643-4162-b542-8313394089c6", "value": "12288:xnjKBHRJfDfd3dcBYNBmrOn2F1lV0F9ouNGno/faYd+:NjK9fhdcmMOW1luF9P8nmf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772547765, "uuid": "01c403c4-8b8f-4cfb-9fff-d7dd45443e3f", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772547765, "uuid": "63ed9a37-88c6-403d-a612-d741e20a10d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547765, "uuid": "04377210-a57b-4cd9-b167-6ae1902d6fbd", "value": "updateV3.23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea3d998-1720-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772556241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772556241, "uuid": "56093c41-e69e-41ba-ac04-ee58e23d19fc", "comment": "Malware payload", "value": "53cf9bacc49c034e9e947d75ffab9224", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772556241, "uuid": "660cdd57-4894-4ed2-be86-c2164940f68b", "comment": "Malware payload", "value": "3b214fd9774c6d96332e50a501c5e467671b8b504070bbb17e497083b7e282c3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772556241, "uuid": "0940dbae-d8cd-4bd5-a87e-fb99c0a34201", "comment": "Malware payload", "value": "7db940c68d5d351e4948f26425cd9aee09b49b3f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772556241, "uuid": "cd6eb8ca-a9be-486d-b124-df5525f3f453", "comment": "Malware payload", "value": "3784896c9e5d9d00474527c45b22bef1753da9f9efa4f9cd41659485d31f88eaba304ad7ae5b20d7fc14f30b5dc68d24", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772556241, "uuid": "4fdd70b4-f92d-4793-a8cf-ba4babbfaf5d", "value": "T1D6E59F06A3FA06ADE0FBD278C956D903E77A7C090270A75F069055A72FBB360DE79311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772556241, "uuid": "7ffc4c29-6afb-4fba-b579-7dbdbd0a860d", "value": "e68fe2e4fe4b72ddbc24bfd21ac99075", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772556241, "uuid": "f5dc90a8-f92c-4d58-94b7-34ca7c414c71", "value": "49152:olh7WxDi+U/pcCz7PZTZlzdOZlUkJLF1Uac+3+fESa6HYlGBzNwui0hBdH3XK:oMgZeD+hBBquTBpnK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772556241, "uuid": "5beefc5c-069f-4a1a-acbc-406af63e8680", "value": 3286680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772556241, "uuid": "2cf05411-121b-4001-9855-fb83b351b5c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772556241, "uuid": "3ae13a4f-23d3-4b64-b944-a663a93e6a6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd11e831-170b-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772547487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547487, "uuid": "b101d872-7ff4-4332-baca-3a8620b99309", "comment": "Malware payload (AmateraStealer)", "value": "d02660b21a83096b9944f37ef0ddffd6", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547487, "uuid": "1a859175-c0c7-4a6a-9da8-9508134d3ecd", "comment": "Malware payload (AmateraStealer)", "value": "3b2b3cb791b20905a0e59bb7d1bad17d32576932b184cb61c4daa0e9b6b61d38", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547487, "uuid": "f985f29b-93ab-4207-80ea-3e29d0f41692", "comment": "Malware payload (AmateraStealer)", "value": "feab9c264d15ea81270a4cb70b19b37f89df0668", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547487, "uuid": "4be54b08-8d83-4f65-81cd-9b06ff7fa65f", "comment": "Malware payload (AmateraStealer)", "value": "4072846e3edc5b6496c33ba93b88d7cf4d6bc3e646443843089fdbd8f03c38d6e7c7b134b0a77c6d0341969347b2d6d4", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547487, "uuid": "991dadce-15b8-4c49-887f-bdac138e8eec", "value": "T126A0228B800CE8FAB0E03200030EB082C3032B030000C00032300300BA20B0FA308083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547487, "uuid": "f1345883-691b-4412-99f5-4d220b6e1416", "value": "3:I5SMAn2yVOYKElKy+/KdJEZn:I3qOYKKzyKdJEZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772547487, "uuid": "01053c31-d8e5-4f19-aae7-6f89f1010f44", "value": 70, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772547487, "uuid": "d7bf7cde-13dd-48db-ab14-e25f2d8a3d41", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547487, "uuid": "a27ecdec-e8dc-46dc-9747-baec5ccd986a", "value": "Claude.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3df31672-16cd-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772520618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520618, "uuid": "3367f664-3060-4bfb-9599-2648ae7bd249", "comment": "Malware payload (RemcosRAT)", "value": "43c77eee51413a35c515122cd0faf206", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520618, "uuid": "d2918b48-b0b8-4a1a-a5b3-e48fe3f66e3c", "comment": "Malware payload (RemcosRAT)", "value": "3b77ad9aca70f8d722320218c8e6d6422409cda9f51e2b222e351d0125504260", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520618, "uuid": "6dec9418-68b2-429f-9902-c9878a120493", "comment": "Malware payload (RemcosRAT)", "value": "85b462e08440428da13c3f73d4f22933684d0ae9", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520618, "uuid": "eb664aab-f10c-490b-af23-2a6a143563b7", "comment": "Malware payload (RemcosRAT)", "value": "cca5c4fd71163b925514fdcd3120dadb3425362a716e2674037d6e3214a4dcc78195a156cff27d50f5059d9a7a99c9ac", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520618, "uuid": "0c31a424-0ded-433b-a674-9f10d4e03048", "value": "T129D41215B2A5BEABEC0293375CD401D65615AD13C72EE01B3DCA331A487EBE0E097A7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520618, "uuid": "eba404de-dafc-4c69-aeb9-605a4d6a770a", "value": "12288:oGtl1z3amCtSPgZGe3GhUY3CCh8eQaV/PJE/JsrIxR:VX3UegvHYy48eQaVHJE/JsrI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520618, "uuid": "77171d3b-3a5f-429f-915b-8f7965cc2b79", "value": 603136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520618, "uuid": "3c4ed7f7-6a73-4053-bf80-f7a62d4251a6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520618, "uuid": "d216e571-981a-4752-81d8-a91f3157b63a", "value": "3b77ad9aca70f8d722320218c8e6d6422409cda9f51e2b222e351d0125504260.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea9ea6a-16e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772529907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529907, "uuid": "6d7d4f59-49c6-4b20-b7da-40cf5168a24f", "comment": "Malware payload", "value": "c32fa1fc57014b47e74b3b41db4ba5c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529907, "uuid": "6df6518e-eb0c-4231-8de8-69a633642708", "comment": "Malware payload", "value": "3bbb2d79727ef8bbb433f420bb34a3170b179064d8f61c8cc9c37771fed821e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529907, "uuid": "cadac09a-7f86-4ed9-8de6-4448e45917ba", "comment": "Malware payload", "value": "9b5db465a86803d5b900391ec734f788b04ce1c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529907, "uuid": "08a4911b-bc2a-4fd3-987c-2e324bb81a6d", "comment": "Malware payload", "value": "1b784020a2c1d645c7044863e246d65d9d4b8f95bbd4097723957d122645c750699a4807a98fc38d08c5434efe5b3928", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529907, "uuid": "cf2ee187-aada-423e-a2a7-12ec0a50337d", "value": "T1A9569D07B3D00CF5D02A82B441265332D263FCB92FA4DDA75E95FA564E3A7918D3BE21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529907, "uuid": "95dfafaa-4d72-4fb3-92d0-c133e0ecbb37", "value": "3ebc6615ee6e83e349ea34fde3fe4d03", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529907, "uuid": "87684ca5-f438-4204-a7d4-933b2bd8b96b", "value": "98304:HEScnXsCLXTMRcd7lMjFa6tvRAybK+lOgng7pIgYOhk7DIWpdPFVxlhoAVOjnr:kScnLTgg7lIFNtOMKIOg7g7hk7DIWpds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772529907, "uuid": "8e7e970f-97f0-4a33-a280-5b6b9fab7076", "value": 6259712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772529907, "uuid": "5885f7e3-6ad6-4b7b-8d0a-aaf3b58cd891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529907, "uuid": "b6fcca3c-24ac-4057-9cf2-f50778333f7e", "value": "jli.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6354369-16d1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772522511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522511, "uuid": "98ead584-5ed9-4626-8b3e-4cad4da22718", "comment": "Malware payload", "value": "41c837e83e08cc10ef53fb1bace79da6", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522511, "uuid": "5e99c377-2fcb-4cd7-8dd5-5dd90f76213c", "comment": "Malware payload", "value": "3c55187e77bbda70d5b8054104397756c8c1a6d3c95c6f471be37f1c2d321f58", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522511, "uuid": "0d340cbf-9c64-4522-82ea-701a0158c830", "comment": "Malware payload", "value": "d1c58d207c65bf2cb1545d62f9f8bf95f071f8cc", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522511, "uuid": "246e8ffc-6da5-484c-9d18-e50fef303ca5", "comment": "Malware payload", "value": "a6197603c5a5d89cfaef1ec39a5da1b34681eb5209f7fae2106239832941f2b72ec116166bcf025a176a3c3895509349", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522511, "uuid": "53bdac3c-e21c-4294-9b03-47ddde2c4b10", "value": "T1B8A69E19F3984594C176D578CA16E232E6B278A25B3682CB56EED71A0F73BD04F3E700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522511, "uuid": "bccaa8f7-ed3f-4220-85c5-008173da5e2f", "value": "196608:6h8zoSQ29TeRSj25pQI7DlNdX5msO6vmKmEZTtB:6h8cSbySj2AaNZvm1ET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772522511, "uuid": "f4076769-9889-42bf-8a9d-696c4c239c10", "value": 10293248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772522511, "uuid": "458d2638-4e2e-4bfe-a504-b407f33494a1", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522511, "uuid": "bb4500a5-37dd-44e2-abf1-61806d5bf168", "value": "Beolvasott_20260114.pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ecec44-1728-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772559900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559900, "uuid": "4a456221-6835-4813-92e4-651e94e0db76", "comment": "Malware payload", "value": "d2689800e3f2fe44f3c62007d067ba30", "object_relation": "md5", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559900, "uuid": "991c5e82-fe00-4e7a-bb58-5cd1c1a734f0", "comment": "Malware payload", "value": "3c837760004f3a79cec08058b07ca365178c451a2356cfbf362114168bb6e79d", "object_relation": "sha256", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559900, "uuid": "b2db1baf-e7ab-4c84-b70e-95f1fc055d38", "comment": "Malware payload", "value": "f0f4a58709d78e15e28e18454ac15b16a3752255", "object_relation": "sha1", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559900, "uuid": "e864ac97-77c6-468a-ab8e-237c155a98dc", "comment": "Malware payload", "value": "4b6fbb245bbd2e9fb17bb6c12f6df8b8126aa2b9394c6a965c996babfa1c6fc72ac41dfc97ad7515edd828377fd8dceb", "object_relation": "sha3-384", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559900, "uuid": "6f4fcd34-7440-4c81-8575-7a016080044b", "value": "T159B01206D68AC1EB9402311D8154D570B883A4CEC053D5FDA782C71F61D28E1458D19D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559900, "uuid": "8eedcccd-e113-44a3-8b79-30fceaa53730", "value": "3:HRAbABGQYm+KXOCRIPGETJL18PKgwHgaD:HRYFVmM7+IJL2ygyg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772559900, "uuid": "873f5659-3357-4c4e-b063-e95b3793ce7b", "value": 102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772559900, "uuid": "cad46d43-ab25-4223-981e-a7df5311e033", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559900, "uuid": "a15becce-298c-4dcb-a301-bbc2c1e9ac05", "value": "Fac_2026_3781026626.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39f07ff-1722-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772557323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557323, "uuid": "77c3cde3-fe9d-49cb-8e69-dc4f1f603e9b", "comment": "Malware payload", "value": "c58a54ba17b4eb2af60968d862a3fe4d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557323, "uuid": "6d80d9a9-91ca-4345-bddd-0e30f9297e42", "comment": "Malware payload", "value": "3cdead4bcd4e7e030d32ad8ebd960f3a8a1731316c8ec00e544cf4d5812e97d2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557323, "uuid": "9765418d-958c-46db-b398-37c8217f21ea", "comment": "Malware payload", "value": "58bc1281669cdf81ec72133b249e551da917f367", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557323, "uuid": "f42478c4-55af-4c5d-9a36-a22ad1bc987c", "comment": "Malware payload", "value": "ad596bc61b5f2375162a9f668a93b39c09816565e47675718f11a06137ec2a11ab9ca068e2c854c610d2daea43ad46c4", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557323, "uuid": "af317b01-cfd4-4ea4-988f-06aae16d02f2", "value": "T16BF31219E3175564427F7EA4EBE9BEBC39E10266A17D908F21C43E0F1F1892DB15D882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557323, "uuid": "dcbab7d3-b9cb-498a-8b2b-4743e50be8c4", "value": "3072:ER9/O/HoAE/R8pEPpMrftclyEGqNNe7CPuq/HmJPMBKLUvJF9ItpRXOq5QVGI4GP:YCHoAEepEOftccDqNHPu+HnQQRUOqeLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772557323, "uuid": "7fd6306a-4857-40d4-a541-7997cf9efd3b", "value": 159474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772557323, "uuid": "ee5ec15a-a748-4073-8df9-7641ba82d845", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557323, "uuid": "95e3627d-755c-4dd8-a96c-9d621e6d52c3", "value": "Wishlist_Response_001639774.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45085c45-16d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772525355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525355, "uuid": "b8ca947d-a340-4ac3-b817-fac57ee7fd36", "comment": "Malware payload (Mirai)", "value": "8b1fee9b23cb12206adde476e283fe16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525355, "uuid": "e2e6a304-ada1-4ef5-85b1-463bff27c5f6", "comment": "Malware payload (Mirai)", "value": "3eb5b92e68f86b7be50f6bbbf9d679333edf9ba4b0d2e7e4bec5e70fbf527955", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525355, "uuid": "4f9b3427-47c7-41c2-a8d2-d340517021f2", "comment": "Malware payload (Mirai)", "value": "7d3c17dcc0f612f9f8c86e6b8f13abe8b5615ebd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525355, "uuid": "00cfd82d-a4f4-40d9-845e-48eef51550e1", "comment": "Malware payload (Mirai)", "value": "32ab61c1bbb565ea1218c07a26f34280ac8e20b119baf89ba7c9382f275ef86b0a075666e55b9dd8664db2bed0978a8b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525355, "uuid": "ee749d42-2bf7-4148-8601-4ed8f3ea2825", "value": "T120632803BD8184EDC149D138537F757AC56635BE1238B1DB27E4FE2B6C06EA00B2D99A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525355, "uuid": "41e42875-f6f7-4371-892a-8e3511d6e9e4", "value": "1536:IyMDrYi9/Y7kvIpFY7dl4kgKkOMQPEGaIjzCx17MA9:99A/Y4vIpFY7MOMAEGDzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772525355, "uuid": "6fb6c576-6b11-4d75-84e6-faadd01dab6e", "value": 72832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772525355, "uuid": "a59a6ad2-c4fa-4d76-ac46-5b5c4ad22ec4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525355, "uuid": "d9c5ad1c-119a-4016-99c6-470bc0d2d9b4", "value": "nullnet_load.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775496d3-16db-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772526728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772526728, "uuid": "c0ef4e36-207b-4ac1-97ab-f00fcee2d904", "comment": "Malware payload (Mirai)", "value": "9923810ec1a2aacb9ed96cd8e022c9a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772526728, "uuid": "84ba4b72-9028-4499-b1de-39b358796830", "comment": "Malware payload (Mirai)", "value": "3eefbb511d87b67d9afc982a39a7aef9ea4fbb47a0995fc3178d3c7e86b2c84f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772526728, "uuid": "04cff94b-3b33-451b-8110-3fc887fa7f92", "comment": "Malware payload (Mirai)", "value": "ade58a4517ba595c762d64835be3d995589ea0df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772526728, "uuid": "4090000f-257c-456d-bf18-344180249333", "comment": "Malware payload (Mirai)", "value": "1272dbc94dfc2216e8adc2c985de4e3a4f71c43e211b8dc2ef9a8940e0223a2acc838866e8824829dd0368ce9ff80363", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772526728, "uuid": "b6bef181-f2a5-4809-83d9-405dfc8fba59", "value": "T1E2634B0237684E03C1A659F9283F27D483FFEE9111F4F5842A4F9A1A8275E37156AFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772526728, "uuid": "47b130d3-29ab-4a28-80f5-5aa1c4c18289", "value": "768:AOlkHZX67R2cARuuRqT6wzRAbaAdgwiYf7td+9jLR4EWlznz/4gamthNYJ3HVlYa:AB7d5qLxwieCSNLzQV1HVlY7tQ7PF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772526728, "uuid": "c5e01062-757b-42cb-8318-38e9a75112a7", "value": 70928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772526728, "uuid": "3bceaa29-151b-4405-b98d-f119e0b6868a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772526728, "uuid": "7cf27075-e5ae-4cf1-8ff7-c51f03a156ad", "value": "nullnet_load.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ccd8ce4-1741-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772570599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570599, "uuid": "73c7f504-0dab-4dac-bf82-0520c6ec994f", "comment": "Malware payload (Mirai)", "value": "3ec2cc231bae9e8d6d745467ee147cfe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570599, "uuid": "f1498da1-eb1c-4078-bd44-43228bcedc03", "comment": "Malware payload (Mirai)", "value": "3f36dbe20a5077f5aad71c43c6db81b116ce69a07eb8897ad5c9f4ac6ddd360f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570599, "uuid": "67c57926-3645-43fb-b419-b6f30232df3f", "comment": "Malware payload (Mirai)", "value": "778f91a9d97e09141e9d6f3f2ae218020e62a2fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570599, "uuid": "2c7b72ea-e3ec-4641-abad-941a6477ae54", "comment": "Malware payload (Mirai)", "value": "a50bab7da099e2197ed6c5c6632732823c8b58fd1882d82787bee6e2da15d8ae1279c78b54d3d5aab6d5cc7a0423c724", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570599, "uuid": "28da43a8-2689-4325-997f-37a6b691a2d6", "value": "T193437CC4AA83E4F5FD9701751033A73B5A72F4351069DA87C369D83BBC52A11EA2B39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570599, "uuid": "dd099ef3-e636-4180-9afd-b460d7689f78", "value": "1536:ZyN5z8bAOpvnd02e98v2POtI7ivBD2wJSz0RZ17+v2nzhNKSM:0N5wUOpvnReO2Wtowgz0r1K+nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772570599, "uuid": "42dddda3-4411-4fa3-8036-559df209ea1b", "value": 59152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772570599, "uuid": "f2f3b706-20c2-4dc6-8361-1c152752b152", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570599, "uuid": "7de68d29-943a-4685-9194-59a7a15f9e1b", "value": "px86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0606ef8e-1709-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772546294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546294, "uuid": "1e248b9a-91cb-4e5e-8c3c-f9a753f7b790", "comment": "Malware payload (Mirai)", "value": "903252dc968b68c15caef28b0b7d0c47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546294, "uuid": "92f823f6-84e4-4d70-acc9-176d57e53439", "comment": "Malware payload (Mirai)", "value": "3f68dd7c465f58ef49a99639ac853830492642ce1e904620b8b57e5a917a5ea0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546294, "uuid": "cbd235cf-2ac8-4fbe-ad81-875308167ec1", "comment": "Malware payload (Mirai)", "value": "d5153cf2f0c42b44e0cb80e43dc7f54f7a89b485", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546294, "uuid": "92b83eca-c2bf-4278-b8fd-afef36dfc592", "comment": "Malware payload (Mirai)", "value": "a187aaecb25ea84054b522d989b9f367e7609b2a651959756207f2f8733700eee0ec36adc60093b25df1ec6b4825ebd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546294, "uuid": "d3ad6a51-070b-4aaf-929c-cca0e03a8c68", "value": "T1A3332C85BCA29A6AC6C0477A762E968B335767B4C2CF7353D8481B10768BB0F0E77D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546294, "uuid": "f0486c21-3ff4-4a40-9916-9a02a0620349", "value": "768:cY9Q7eU0k4T3tuHN/1RIGxy2Iq/Jr+MKKrDZZ4ulzMGzFTnWz:rAeU0k0duHfjxy25xr+MVrDZJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546294, "uuid": "ef2f0827-da77-4ac0-ae01-5b40b18d96eb", "value": 51048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546294, "uuid": "ddbb4488-0769-4155-bb86-2e0622880bed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546294, "uuid": "375d735a-60cb-4c95-8fe5-093b7a2af4e5", "value": "titanjr.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce2e105-1704-11f1-a769-42010a9c0008", "comment": "Malware payload (Snojan)", "timestamp": 1772544293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544293, "uuid": "f2d4f652-c8e7-4fbd-850b-013a2179e6fd", "comment": "Malware payload (Snojan)", "value": "2838d2fc55d455dbf1ec068673a8d6bc", "object_relation": "md5", "Tag": [ { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544293, "uuid": "09e93fc6-fc9c-4307-b046-3213c6818dea", "comment": "Malware payload (Snojan)", "value": "40b25e0433d882b8e6027565717fceebf73111b0c5aa22b6f8e90b15e516cbc8", "object_relation": "sha256", "Tag": [ { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544293, "uuid": "9ba90a7b-367e-43a2-ab46-fe86c8f2caf3", "comment": "Malware payload (Snojan)", "value": "2f4c3365faf595cfb3215ec1cb97541a5d8279ad", "object_relation": "sha1", "Tag": [ { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544293, "uuid": "32408856-db63-40cd-a2d5-d9e4a4cf97d8", "comment": "Malware payload (Snojan)", "value": "a246fdd9df17a8141c4d2d7864dd1cca12104b8d451515b09a848acd073cde369a2a641637778f0ab36b2ae44c20a928", "object_relation": "sha3-384", "Tag": [ { "name": "Snojan", "colour": "#E1A447", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544293, "uuid": "15db25f8-70fc-46a1-a31c-a4e58a4ec42e", "value": "T19784F12071C0C1B2D4BB113544EACA769A76707207B9D5DBBBDC27BAAE113E163352CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544293, "uuid": "7ced4ff6-b724-4fbc-9c68-488fdaa065ba", "value": "2dd2758f0793bdb29ce229a2432eb81b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544293, "uuid": "39a3dad5-96b1-4f63-b126-ea8283e93ed9", "value": "6144:NrFZaaZmEJu4DKW1Lgbdl0TBBvjc/YVM66dAFlJTSRUYzLY6hOfvb2wh:/bE+ueh1Lk70TnvjcsMxdABSnLHOr26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772544293, "uuid": "0072261b-a464-45e3-823b-cac5dfc1881f", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772544293, "uuid": "de35b877-48cd-4b54-aab5-6665ce73a269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544293, "uuid": "c14b58cb-8f18-4339-b98b-335a93bcb003", "value": "40b25e0433d882b8e6027565717fceebf73111b0c5aa22b6f8e90b15e516cbc8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73940d5f-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772548626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548626, "uuid": "09d8a29d-614b-43dc-98c6-388aac70680c", "comment": "Malware payload (AgentTesla)", "value": "12f4ea73c92f2de359cdc83912e7efc7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548626, "uuid": "b98598a6-71cb-469d-944c-d64c2010cb00", "comment": "Malware payload (AgentTesla)", "value": "41bc695c958d26d08cefd846ef83d671ea2fa3fc0bea9cde725d85b9b655d253", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548626, "uuid": "0f95c057-ac04-4cb2-9662-f95591c846d5", "comment": "Malware payload (AgentTesla)", "value": "e83519535ceed9c7b63c35389c99782de04fe60a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548626, "uuid": "583dfabb-9aba-43c1-98ae-3b5871d23461", "comment": "Malware payload (AgentTesla)", "value": "27825bfd40c0d09ee7661a15c62e038bb7b0173a82b4c5d84bec70e0465992a273e5126bb3b2ea6b6452e080f1bbae3f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548626, "uuid": "d72fcb23-1f33-4bd1-bd27-8f8f762a1af5", "value": "T155659F9688B01FD30A3C6E3045187F3873E5C7491A0DB65B8DF175AD2BFE2B54E26286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548626, "uuid": "99283190-70c5-45eb-8e94-fbd3f39aa62d", "value": "24576:pDRa4gxuutnC6JN17icOxFoJrBF5Au/b3M1K2FX2AxKWJa4k/w0GwLZJZHJGedK5:ba5qi7e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548626, "uuid": "529ad389-b77b-45c7-80ab-09ca87d669d1", "value": 1449625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548626, "uuid": "8016ec35-ef49-4f78-8550-6c478fddf053", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548626, "uuid": "862f4c2f-90dc-4441-979d-2d0b4821bfa4", "value": "12f4ea73c92f2de359cdc83912e7efc7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b32057-1708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772546051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546051, "uuid": "a0fb1dcb-957c-457a-aed3-5d63dccb5cfa", "comment": "Malware payload (Mirai)", "value": "14da8b2dc1236f3ce260999972454ec5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546051, "uuid": "2d3e63e3-b823-4685-82bc-a377bcd1590a", "comment": "Malware payload (Mirai)", "value": "428f5e0e69e275aa7cbb1d5be1effe6f0683cf695de6ac693f767446f64ae297", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546051, "uuid": "688f2c06-11e7-454d-8071-0cf006a271fd", "comment": "Malware payload (Mirai)", "value": "282942b6c72790b2225e323d28625acdb09ec466", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546051, "uuid": "e05895a0-b06e-4638-ab7e-0069cbd9dad1", "comment": "Malware payload (Mirai)", "value": "0780d81f67dc2580eda2a67b55e132e35bb3b676bb0e7a2ef26df7c059d31dd0091e5cd8eac54f271b31b0af6698efbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546051, "uuid": "f704cede-d40f-4a32-95bb-563bb8f886fd", "value": "T144D34B06731C0947D2632EF43A3F27E193EFDA8121E4F644355FAA8A9671E321586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546051, "uuid": "699dae51-fcf7-4966-ac42-dc8250e52df5", "value": "1536:fRkySkzFFQSI2YIVxfjI1EPF1IQYVA7ikr4trvArjrE2+N/NuqNnRsI0:fNzbYIVxeE/v7Xr4erEt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546051, "uuid": "3641cb58-7380-4f1e-b7a6-82a420f21385", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546051, "uuid": "8f0bcbab-9b39-4da2-8746-e9314e209e2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546051, "uuid": "0904a7f2-08ca-4cbc-8623-ee60382e717c", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe627fbd-16f8-11f1-a769-42010a9c0008", "comment": "Malware payload (Ladvix)", "timestamp": 1772539410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772539410, "uuid": "079bffd0-e217-45e1-83e3-aba7226ea819", "comment": "Malware payload (Ladvix)", "value": "0c3a095822348d8350dff95152cc356a", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772539410, "uuid": "b5e29a3a-5e26-497c-afc5-d5e5f1e5e970", "comment": "Malware payload (Ladvix)", "value": "44161dc432e7d19fc4a4ab4883d3935c79c6e6d76d7ec05280f5d774346b41fd", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772539410, "uuid": "c7a6dea1-06ca-4168-bc17-13b66348afcf", "comment": "Malware payload (Ladvix)", "value": "d4970c477af2ccd2cdfba7e0eafe8c75ad9562ef", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772539410, "uuid": "a8e454cb-b589-4742-ad83-e4e4220a8786", "comment": "Malware payload (Ladvix)", "value": "099f5cfe9c0bcb981450b057b1f62daec739ead10b3feed0388fcb1d30e18cbe9aeb179cd4df2368e5b0eb27ee667112", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Ladvix", "colour": "#45ECE4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772539410, "uuid": "63729262-2549-45f2-98f0-4517921296c4", "value": "T1BA1733C383AD8D270251EA09997E6471BCCD383F7D6B7A99B40692B827146C4714FFB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772539410, "uuid": "cb2c5907-c995-4a13-97d4-9764b437a666", "value": "393216:orhspagMbXad9DuDJfdwq6a4Qk5wVPLnEUu5+x4IfnBFuttZPeHrnFeZE:orypHdFu9fd14Qk5AEt+x4IfnBktl6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772539410, "uuid": "6d3d3793-bf64-4196-99ae-6af63e591782", "value": 19988594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772539410, "uuid": "d09abe38-2284-4091-b3a3-d31dcbf877b5", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772539410, "uuid": "85f1784e-9676-4550-9015-61679f8e98c3", "value": "int3.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04c126c4-16cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772520093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520093, "uuid": "f9d2994c-4b64-4501-9874-6c970ad4f113", "comment": "Malware payload", "value": "588ebd61101369c6747231b0cfd69315", "object_relation": "md5", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520093, "uuid": "d5825f2e-de87-4bc5-be1c-b78c6df3d4a8", "comment": "Malware payload", "value": "44a300d869bbe0da77b00c4b37f8ef7f2560181c6f0b621cee342181a113419c", "object_relation": "sha256", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520093, "uuid": "3c6a702b-43d1-4d63-8bcc-88801a7feb64", "comment": "Malware payload", "value": "a017e58c1d98d743709707e79c5a7c6c00c21bb0", "object_relation": "sha1", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520093, "uuid": "c0909a10-ea7d-4f3e-a1ca-e6960bf437ca", "comment": "Malware payload", "value": "f8cfe0f1ebdd594b208b087a4c7a69b71e661b2e726f75874c8ecc3977898305923707ab5f0adae985d4b46a810d9c8f", "object_relation": "sha3-384", "Tag": [ { "name": "jerrymac2008-duckdns-org", "colour": "#DE2ACF", "exportable": true, "hide_tag": false }, { "name": "MSI-STEGO", "colour": "#C529E0", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520093, "uuid": "f22b7fee-c3ed-488c-a877-8de75364f0a4", "value": "T1029533EA740E84A9CF1847F312656692C6BF1EB4DC16E07BD6FA89769130FC58487382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520093, "uuid": "73b6d434-1d55-4d7a-a57b-7918d19288f9", "value": "49152:tKqJqEvc1uEm8SGyyQq35335s8/LEVRzbgdW81R0+szX:tFvcsEm8xd5H5QjD87Na", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520093, "uuid": "7ce574d8-4e1a-42cc-8963-550f34d12814", "value": 1974140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520093, "uuid": "699fe3e2-13a0-4223-ac37-37bf566ef47c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520093, "uuid": "aedea8e0-a50d-45d5-b2a9-0dce4dd2bdc0", "value": "optimized_MSI.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc91e07-170e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772548802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548802, "uuid": "f3f6a325-5d1d-4edb-bdf9-2d67009c0e01", "comment": "Malware payload", "value": "fa90bfd7ed3eebe5b988e0271e648881", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548802, "uuid": "61e9906f-6d84-42d1-b682-e993d84750e2", "comment": "Malware payload", "value": "457eb6d6f758d8e69bf1e587421c064f6f1361352e9d828ff493db8221c77962", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548802, "uuid": "267c87de-18cb-4bb1-8824-0db1079211c5", "comment": "Malware payload", "value": "427deddc23a63a22ef1e183d9ff3d8766abf2515", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548802, "uuid": "a8abc5ed-8b9c-4c9c-a54f-336c39e6e520", "comment": "Malware payload", "value": "ea6931a1305db42e0295349b2c290ead956d938f5a538fd583634131c5bd6314d5a3eb8a8e4e006ec7196780435c3b4a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548802, "uuid": "dc87cfa6-d1ef-4228-ad61-8744f0cfbea7", "value": "T1C64512E2973E8FCD82C0271789BFFEC1AC95D4C3541806BB6DA491F926B3E2554218ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548802, "uuid": "8b0c012d-47dd-421e-9644-06beccf1c1f1", "value": "192:OEkELFuFtTVkAc7mrYoxsqJpJ9Tv9yD34Ir0wXsi0Bc3dbzHS14/N8iFvZClEn/U:OnCUbwD+IPGfHjbqvEvoy9cCFUsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548802, "uuid": "04477979-20f6-4716-bdd9-cef7fd9721f0", "value": 1213941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548802, "uuid": "d6d649bc-99fa-418a-a8fe-0928b7430323", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548802, "uuid": "376e629f-12ea-448f-aa36-7496421562c0", "value": "fa90bfd7ed3eebe5b988e0271e648881.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09cf8108-1730-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772563051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772563051, "uuid": "0521ec67-fec2-454d-a312-49c749af2625", "comment": "Malware payload", "value": "d291180b50006502bd41f4dee525c7a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772563051, "uuid": "1d1eb9d1-c32e-4eae-83e7-d0e72c513fdd", "comment": "Malware payload", "value": "4641f0242e99e7e4874316cba6e77512e86e58d045c0dc146055674d386dad80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772563051, "uuid": "02120099-6584-4d0f-80a4-61b02f8c0d37", "comment": "Malware payload", "value": "6de9c86d58b40716cc08adddee63a5eb0a44abf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772563051, "uuid": "8a9a8172-fc0d-4ec7-ac57-508cd82d77a5", "comment": "Malware payload", "value": "839246d7d45309ea63f624b3b766afa1df9410a0ee7b84748e2b8d859b6fd0be6ad4227238119eec958737dba7751e01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772563051, "uuid": "c5d74ed1-9edc-49a6-85e0-ce9892e65429", "value": "T10DA68C2932E90295D1AAC038DD0BC757CD71704A133D91FFA2859DD4AFA13E8AE7CB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772563051, "uuid": "c1ffd3f5-513e-4a3d-8150-69efed472944", "value": "ccab169c89afd2849c7d5db2ec317cdd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772563051, "uuid": "31775890-357b-46f4-8b5d-f9ae1cf9b758", "value": "98304:vvbnNRP7C5vj/hGeapWt5flxS2fBJXhoFXxo2xenWkK4AOJb94qGpt59DMbJcioY:JRk/hGeapWt5flkB3enWkKMkpted", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772563051, "uuid": "b7a9b967-6c68-48d0-9dc9-ddd4d02beffd", "value": 10270720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772563051, "uuid": "ed69f717-56c4-4d1c-81ca-19757b060aa8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772563051, "uuid": "9f102f61-a7aa-4114-8c68-042dacbb38a3", "value": "4641f0242e99e7e4874316cba6e77512e86e58d045c0dc146055674d386dad80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02694018-172a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772560462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560462, "uuid": "4d8dfefa-9d05-40f3-bffb-d9160f4a4e9a", "comment": "Malware payload", "value": "d5cbf5d78b28258590df56041d78e951", "object_relation": "md5", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560462, "uuid": "6135d057-74d9-476e-b113-16db5ab9c416", "comment": "Malware payload", "value": "46a8495916e6eaab403943d740c290cf95696f045cd61b9e7dfab550a3a8b4d0", "object_relation": "sha256", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560462, "uuid": "dfd6f8b7-873e-458a-90dc-48930f4462eb", "comment": "Malware payload", "value": "a1c1ee56edeb865323f72b4937755d151eadf791", "object_relation": "sha1", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560462, "uuid": "dfca4c98-b0e8-4629-a93b-921aa3226573", "comment": "Malware payload", "value": "ca0a5edd747bf6cc7256e15ff956fc1a8cc6b40ab6f6a9fd956b5579aae93c006a8d3465786f855b74de8904065fe2da", "object_relation": "sha3-384", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560462, "uuid": "68658c39-433b-4992-b75c-83e21216c0ad", "value": "T1B821ED270784A27B9A24C05D8B2C9F10EA02A0A6F44455DF37349B5A0A850F7C1E5845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560462, "uuid": "dc3df3c8-4c81-41b4-b580-31b27673ff77", "value": "24:LI2rUbD4euW39CMDZ8En1Yw5ACLAC4UJsk+fa5HuVMeBz+u5WNzj5WwCa5WN412:CD4riPVn1jyBKQfaxuNouK/fCaK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772560462, "uuid": "b78cfeb8-28e1-4c6c-a2cc-552212f19892", "value": 1367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772560462, "uuid": "4fb359fc-21a3-45d1-afc0-4570a360cc10", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560462, "uuid": "8463a199-68d2-4f53-80d9-0dfde8380c15", "value": "46a8495916e6eaab403943d740c290cf95696f045cd61b9e7dfab550a3a8b4d0.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e27d324-16fc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772540725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540725, "uuid": "2ef79206-be9e-4cb1-adb3-2a9f332b6961", "comment": "Malware payload", "value": "4692034cd157c417c3868b5033d0e0d7", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540725, "uuid": "1e93e80a-b624-4da4-9b57-cd7c540c123d", "comment": "Malware payload", "value": "47cc83176cd36abf0b5624f33bcf044b8f880cf521689981f891e52fbb3dbfa3", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540725, "uuid": "a0effcab-0190-4942-a2d2-5478da3fddc1", "comment": "Malware payload", "value": "037b234a805df96a7e0e60f110f55f715a3f5da1", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540725, "uuid": "60f3c7cc-01b8-4aed-85fd-c9453f1d06bf", "comment": "Malware payload", "value": "0cfea77ef6294ef8539a7c02ea5e7e8adb9646f51792792b073358ee0b961a8d51fefb58cd34e3d67e233ec32b21a965", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540725, "uuid": "a4276280-7942-48cc-90da-5a3a46fde3ce", "value": "T14BB3F12D077C8744FAB36EA6B45F46D1066BEB16453D600D064DC0A8EFB3B91C8BBB19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540725, "uuid": "2dea8522-a9f6-4aad-b19c-932f1c35520c", "value": "3072:+N6vhwOK0aOVpgVDI9Zyno0EIbtIfgadW:HuOK07V6VDW3eb8gadW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772540725, "uuid": "57d57df8-715c-4916-9fde-2a1291d1a540", "value": 112473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772540725, "uuid": "7b4ad3b1-917d-4f09-a974-609e82dd1c07", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540725, "uuid": "5357778a-49d1-41e5-9bbd-363dbbc44b12", "value": "Investor Profile (Korea-based) - JiHoon Jeong_pdf.lnk.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9f2dea-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772548590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548590, "uuid": "0455c8ac-00b4-4e3f-b2b9-2eb902555898", "comment": "Malware payload (AgentTesla)", "value": "73f7c181479bd34f90fff69ff979a7b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548590, "uuid": "5f71e175-5545-4e7a-bc90-f4f81b0bfd28", "comment": "Malware payload (AgentTesla)", "value": "47eea98b53f463c4b71964e8c66bfcd2f37cbbab005dd5bf26035fefca0b5d98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548590, "uuid": "575bc917-7980-4dbb-9936-c9d00583f765", "comment": "Malware payload (AgentTesla)", "value": "5601c08f341f7f8fdca2cbf55d242c2c95351d4b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548590, "uuid": "20f9b941-87b4-4bfe-8273-49c91feac32d", "comment": "Malware payload (AgentTesla)", "value": "bb1be6c5b55db9759e8402a3f138c8a4303572b8944a6dc32a98d74cf684789916ddac604cd9b5c6d74da0294bd84121", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548590, "uuid": "1bb6989c-e6cd-495c-8e65-5fd4befc1258", "value": "T1F1658E0252C52DE4DBB68BE11DB805E9EFB0AB472067C5AF28D073597FA2053434B6BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548590, "uuid": "0d44919f-68d8-4d2d-acef-0ef64f6c9473", "value": "24576:y3bJw4ZZBjQQriZJ2i9ODaZOxUTZU9WycD90kinn/M88BLNc3Ay7V7Fj:wdZBjQyiZJ2i9ODaZOxUTZU9WycD90XJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548590, "uuid": "60b14eb0-3770-44e6-a6cb-4d20db411e72", "value": 1410629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548590, "uuid": "78df3bb2-728e-4a8f-bf0c-98100e787c5c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548590, "uuid": "e9e6b36b-b883-4b03-bc57-cdb53369ee3b", "value": "73f7c181479bd34f90fff69ff979a7b0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a35834ee-16a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772504897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772504897, "uuid": "81e42b3c-612e-48a0-b254-6deaf9d81cd7", "comment": "Malware payload", "value": "8b85ac2b85ef29354adbb4eb3e7bbcaf", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772504897, "uuid": "4a5a2c6e-bbd4-4729-995e-252107d8f745", "comment": "Malware payload", "value": "4926ba2f47a3d7b8db14b3396b03cf2fb81efa4620cf4a23a9240e443c406bb8", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772504897, "uuid": "9ab26c57-7d21-44af-84c2-1b9dda1a1015", "comment": "Malware payload", "value": "b0f5e0513e02b95fe0094c97c019c62cefcf9026", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772504897, "uuid": "d55d8054-cfd6-4ef6-9ad6-43f8651ef449", "comment": "Malware payload", "value": "c4aa06cb785133b09a627de69fd8f879dfa44c4b7d21765d7ee4eed000c93e80fdea4d3ba6b48a04c7b373558951c7b6", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772504897, "uuid": "03927c67-17cd-4862-ab3a-f0a7274b6656", "value": "T10757231AEB0DE82FCDD7B07C8EAB0262612B749C5641C3676911D21DBEC76D58F1ABC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772504897, "uuid": "2256f6b8-fc10-44ab-bc41-21ad384964a0", "value": "786432:5LVxzUIRkpxnG0J3cS4oTJAnuKZ3zFzYcRS16:lVlUxpxPJ4oTOnzZ3xccRO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772504897, "uuid": "2058d3d7-ffc5-4be5-bf89-518df38c0bbd", "value": 29420729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772504897, "uuid": "1a337909-d363-4ad6-867d-40eaf31cff73", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772504897, "uuid": "839ff3c2-8773-48a9-8c34-bbf1785d0ab8", "value": "com.quick.entitling.sulcus_1.98.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7d3e4c-16f7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772538794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538794, "uuid": "f759504b-57d4-4f1a-9820-3359f402a0b9", "comment": "Malware payload", "value": "8cecabbb0f7555afaa302e89e5fcbf5e", "object_relation": "md5", "Tag": [ { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538794, "uuid": "2ae6d783-795d-4b71-af78-2c5195925422", "comment": "Malware payload", "value": "4a0e2649f89e11121ffe55546ee081ac07472db650d094314414ebf26fcb7a8e", "object_relation": "sha256", "Tag": [ { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538794, "uuid": "98bfe740-798b-43ef-a514-18847dc7cde2", "comment": "Malware payload", "value": "b9729934cc92f0b1ff9a87f70637e6adfaf416b2", "object_relation": "sha1", "Tag": [ { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538794, "uuid": "dcfc2163-610b-407f-8408-e952ce42bdc4", "comment": "Malware payload", "value": "1e9df6db118477b2e5d4a5d491f63d5eb6c3073e4625253ec59acdc1e3d4ac106011cfe4502c35fa8b2ff75ccf94fd3d", "object_relation": "sha3-384", "Tag": [ { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538794, "uuid": "2ce18b6e-c8b6-4e15-8e71-a62d5c1a1df5", "value": "T1D5E31239F9C13357EDC508CA13D194D6592C7899702B62139CFAE54E9D3E8AA38B4C4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538794, "uuid": "7580df06-496b-491c-86c2-0a77d69e44f5", "value": "3072:s+mII23WU02AvjKmaqnQgjzIrrhlLAKleh7l3vP9FRcHC:s+lAKePIrHWhB339Ff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772538794, "uuid": "1649f0f8-3cd5-4db5-afe0-c12c4b1056b0", "value": 152023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772538794, "uuid": "d887b9e7-b871-46cd-b466-7880a7cc0f35", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538794, "uuid": "18248a23-0889-422a-8729-56ea64739143", "value": "4a0e2649f89e11121ffe55546ee081ac07472db650d094314414ebf26fcb7a8e.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e20c187-173e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772569232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772569232, "uuid": "e1425b74-7469-4c8f-84bf-f06714cce94b", "comment": "Malware payload (Mirai)", "value": "0ab2acc213d0c0632151944d27b4df9e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772569232, "uuid": "15cac819-2525-42eb-826b-6bcceaa2f14e", "comment": "Malware payload (Mirai)", "value": "4a18e1f9a63d207db19ab8fd473ed3b2ee8736f868a01f8c722541511eba17e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772569232, "uuid": "84d4b931-34cc-4aa9-978d-10f1ae1c2247", "comment": "Malware payload (Mirai)", "value": "dbc2342be4eccbbb7ceb1e467593f7fdd77632fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772569232, "uuid": "915a95e4-d465-415c-800b-551720b333f2", "comment": "Malware payload (Mirai)", "value": "3243c85b394b9e51a9b8875093349f84178b4f61cf9d3b8633b3b778e67361aa8af0a9897219b54e097021a3567021f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772569232, "uuid": "a75ff949-9451-4dd0-833c-fb90c4f9bb64", "value": "T18193B81E6E219FADF769C73047B78A21A75833C627E1D685E25CD6002F6034D642FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772569232, "uuid": "646441cc-e164-4b61-afb5-b08bc010c49d", "value": "1536:KloXJI3TfgvW0rTqX6gLAHw3AGh6zeglH08kYf:KkJIDovVrAPLH3AGka89f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772569232, "uuid": "cda69311-b7d5-4cfa-b2c2-c83528ea4cc1", "value": 93352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772569232, "uuid": "b917d146-24be-4317-8fad-48cae804f282", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772569232, "uuid": "b2b4eae4-1111-468e-9152-637baea0783d", "value": "pmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8145aa08-1726-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772558957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772558957, "uuid": "96a68cb2-50d5-4d7c-ab18-cf44e21bfa8b", "comment": "Malware payload (Vidar)", "value": "3ba9c93b9e9916278ecb286905d26346", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772558957, "uuid": "e0a2fa13-842e-4860-a6bc-bb71b220c08e", "comment": "Malware payload (Vidar)", "value": "4a5b3dc14f23ab437ca097e0187cc207d17fe7eca78911e2935e2a5aa1700bb9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772558957, "uuid": "1af85052-c43d-48de-9c33-eafe8b53ff15", "comment": "Malware payload (Vidar)", "value": "3101b04c56bb13dfd8b433fb5e3083d3d6ea6d2c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772558957, "uuid": "9b5f4144-e0de-4298-b1e3-fc7e368c9bba", "comment": "Malware payload (Vidar)", "value": "1936de41502a1b85c78c17221c27b0e135aca7e5cb6b3886e1648bf7de1e419c43f2f1818232d4a97075db3de7c9ac85", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772558957, "uuid": "d90b97e0-cf66-47c3-bc06-fc3993f7f385", "value": "T16696D42F2EB171FAC12AC13AC0928F4CD7F2F5770726D5E713E203695A129D15DBAA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772558957, "uuid": "d5d9bc5c-bcd2-4623-a034-9a15224e5b90", "value": "9fa09a64686909db97ebc147f2f0d1cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772558957, "uuid": "ab0277ff-f2ec-4b31-8b2d-af71ee05ab3b", "value": "49152:aSC0G9vUq/7AVxLk77pe9wueSuTgF/VWfHOjOoeouBunDfpTTP4qSFnBfAvCB7Je:W7b2OoeoSKpqVyCrpaDug3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772558957, "uuid": "088b8543-4fef-442e-a05a-d8e4062785d0", "value": 8905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772558957, "uuid": "c238cc8e-b8c4-489a-81f0-d0f98e752ac1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772558957, "uuid": "1ba7024e-e4ca-43d0-90fa-36a26597003e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c2b8e8-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772519014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519014, "uuid": "195e6dae-b266-4804-ab5a-281b7d9892b8", "comment": "Malware payload (Mirai)", "value": "44e56716e55e537e879509aa63a4427c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519014, "uuid": "3d3dee62-855d-42b3-ad75-76a27d453a16", "comment": "Malware payload (Mirai)", "value": "4ce9f9d401a169be18632de7084373386b33ed833d3c183a92224db7f1950e67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519014, "uuid": "931a4dbb-30c8-450e-a80a-12532c378569", "comment": "Malware payload (Mirai)", "value": "1c28f3159dd21352574dad8a845e70626527a61c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519014, "uuid": "c8817658-fdb9-467d-b9d8-93e4009bce6c", "comment": "Malware payload (Mirai)", "value": "6ea0c4735d7bc51f219cffa1524e80e393f796fc57bfb9c801d0e6f432dfd763baf24396661c0b22fe74ab955fff55e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519014, "uuid": "2f49dfb5-d3be-402e-8970-bb3c38002bb8", "value": "T17F734C42B98485FDC189E47902BF757AC426F1BD1239B1E737C4BF1B2C09E601B1E96A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519014, "uuid": "18dec0bd-b198-4347-9dc7-98c032911b7e", "value": "1536:wM1FaL5wJ6x2oYIsJNbmtY+Oqe4e14PW0MPTV/3cEN/CMAA96:fYG6x3YIsJNQPOqC2PW0M7V/3D/CT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772519014, "uuid": "0dd0969b-d129-46bc-b829-56d5c45f1078", "value": 79520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772519014, "uuid": "3a2c470d-3c85-47d8-94c6-6de910ba4eb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519014, "uuid": "67b0b8c0-641a-4e72-ad07-0d308e3af1bf", "value": "nullnet_load.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad20442-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772518895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518895, "uuid": "be2c8ff9-fca1-4095-8072-c672697d02ed", "comment": "Malware payload (Mirai)", "value": "2c195ab625ec3d54ca2ed8eedcf702d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518895, "uuid": "c0a83cc5-8a13-4ac0-bae5-55c0f052794b", "comment": "Malware payload (Mirai)", "value": "4edbe7ce0233fdd7d7f50bc3d3a9176c7d16b4ecd88d37b16e9fa98123c02a6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518895, "uuid": "829e3010-dd1a-4c48-98db-3946c8cf583e", "comment": "Malware payload (Mirai)", "value": "10b86c76b5871fe6a5043194479a20735d8ff7c3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518895, "uuid": "30f2e9e3-7671-42f3-9a66-9e26758cecd3", "comment": "Malware payload (Mirai)", "value": "c22bda640e31d2e4eee893b2e681eb73c413000c67c8948c0b920af01156dbf181c29ea7d425dd340d73d8fda9a8845d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518895, "uuid": "37b32b5d-391d-42e6-9a04-44d47a769bc1", "value": "T13FB3830A7F600EF7ECABDC374ADA2749249D141A21997F75BD34D818F24A24F19E78B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518895, "uuid": "7cc0403a-923e-4d94-ba0c-1a12c12bf2e9", "value": "1536:0+pemFCYvbD+jr8CferP8w1GIokryrSxp8NMTRZKmACFH+:0KemFCYvbD+jNfK1GQTTRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772518895, "uuid": "2fc8d3dc-8930-4050-b469-8bbfe28a7f16", "value": 108704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772518895, "uuid": "34b0250f-c801-43a0-8545-5f5151fd0c38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518895, "uuid": "698d528b-cb73-4479-a860-7aeb7a0fe796", "value": "nullnet_load.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97832c4b-171a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772553840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553840, "uuid": "c2bf6954-b05c-41b3-9cf4-ad70e594ccdf", "comment": "Malware payload", "value": "64dc12354752becd35b281bebe6e1710", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553840, "uuid": "18057c08-8a75-4610-b7c1-58207c3a3429", "comment": "Malware payload", "value": "4f97c2202f87a03a5f4fc656355d43e3a7dfe752ba73ede19e11c8d967b2a96b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553840, "uuid": "b27fc216-5ae9-4e49-97f1-c85553261a85", "comment": "Malware payload", "value": "ae44fbeb710a6ffc529ff6d697f9e70feb524f8d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553840, "uuid": "251ce4fc-70e0-46b8-b8f1-1b903f499596", "comment": "Malware payload", "value": "5afa0d221ba5b5972dfb1a8fa74209ddc602c0180707acb41ed7ef22ff19e9c4a33c5ba64fe15e992ed393001219f285", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553840, "uuid": "5e4cd06b-1c9f-42fe-8d80-00aae6fc0b7e", "value": "T1B2E2941E8739CF48F57C8A20950B0784349CD45601E2BF67964C7FDAAF5A5B32A7ACE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553840, "uuid": "5f5b2850-1ac4-4cf4-a9b6-ce4ab3e9b403", "value": "192:acDU7+jmKsTp1WDIlzkPwzCXIFPc7I5g2FhQnz2h3wTCG/YcZSNk9SEeCQDpyxhy:aZMUlsN4F+ULua1+ob2Jz77xFL3g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772553840, "uuid": "9c881479-278d-4cf3-a80e-945cff2f9d1f", "value": 33475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772553840, "uuid": "cea379d8-468c-4ded-b625-6321b8b636c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553840, "uuid": "90f03e03-407e-4c24-af8e-52e2df8c0a57", "value": "sleaked.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db383e0a-16d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772523459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523459, "uuid": "f0e15a16-a56a-43d4-889f-f2b5dfb47ba1", "comment": "Malware payload (Mirai)", "value": "133b4769464c0427ac534a86c2f6cf24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523459, "uuid": "d912f77f-65a9-4ec4-b9d4-e8ff68c1ea60", "comment": "Malware payload (Mirai)", "value": "5072a1c51d5944cda12ab3aa04bc2df03f50883046b49753dca3ea8fab6cba63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523459, "uuid": "931a0e55-8666-444e-8587-fbcdcd0d175e", "comment": "Malware payload (Mirai)", "value": "375151ce2153771df8d50a9cac5f8f127966c7bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523459, "uuid": "3178d4cc-dde0-4c3e-b78b-0343399c752d", "comment": "Malware payload (Mirai)", "value": "ed67eef976c826736c57703efa9c3de9937083e19ba49df0b5688aaca89835de230de72bdf99eb4ab358420014387a20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772523459, "uuid": "be8fe68f-e51c-43c4-b625-311c3d23dc25", "value": "T1AD830A82BC818D11C5C813B5BA2E118E33162769F2EFB253DE115F2477CA92F0E7B596", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772523459, "uuid": "f98e4a0f-bbb6-4da5-97e7-edb9e6433d7d", "value": "1536:Hcn9r73E900YnM19dUVuujSLh9PdbvWFCwxvR/z0Ilqil+B3N0fhn7P:SruJYn8PKuujUhRNuwO+B3N0fh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772523459, "uuid": "4cd83423-309e-4786-9b0c-f7975128c312", "value": 84520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772523459, "uuid": "d06db913-4c4a-4edd-a3b8-5c31c484f433", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772523459, "uuid": "94bfb000-03f1-4260-8fdb-f9ef565dc219", "value": "nullnet_load.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7a7af58-170e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772548847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548847, "uuid": "2ebb3aae-c80e-44b2-9e16-f2cf169f5e7c", "comment": "Malware payload", "value": "6298da4a07b6af3d71ec9ce58ea372a8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548847, "uuid": "d9ed2a1b-cb0c-41a3-b446-e31cd0fe5b94", "comment": "Malware payload", "value": "51474993906ab6e8f5ccbdc124716a88d9a7a36ba50675d3456443e9292e5076", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548847, "uuid": "ac189bbd-1772-47a7-bcc0-30c1d53147af", "comment": "Malware payload", "value": "0a96d6ff9d8fe078bb22d94d9fffbebe8e24736d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548847, "uuid": "95225e66-7398-4a9d-b50c-3412cdeae978", "comment": "Malware payload", "value": "3b03047320af48b4e23f5388853667a5c7327ba295de49560bf0ac377348d71b36b1f85028b64373298ba10521032324", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548847, "uuid": "69952a15-5d6c-49df-9804-d95c59925b8e", "value": "T1D6330A4F7B16C96287C26FCAA5C9A8F9B33ED02585002153646CE7FCD5FCEC67422698", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548847, "uuid": "64bb0527-334f-4c49-ade1-27a00b056cc1", "value": "192:E77777777777777777777777777777777777777777777777777777777777777A:fAaY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548847, "uuid": "1f193b76-bd4d-443a-9250-c57a29208192", "value": 54219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548847, "uuid": "ac015c7f-cdc2-401b-b67d-8332288cde99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548847, "uuid": "a913fdef-c0a1-4a54-b70a-e538ed696ec9", "value": "PL10-03-2026L.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41ecf890-170d-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772548113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548113, "uuid": "f2739c95-07fd-4974-a23d-108dd3235932", "comment": "Malware payload (SalatStealer)", "value": "beda47788772a49f1416365068016768", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548113, "uuid": "6a544b8a-d519-4da7-b389-49b8ba5fe60d", "comment": "Malware payload (SalatStealer)", "value": "534678938cfe5f0d0e70ca96d1549a3aee73c631bfcff500acfcf1659939c314", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548113, "uuid": "2047efdb-1a7e-4b8e-96df-d40d27f1d141", "comment": "Malware payload (SalatStealer)", "value": "c386178aec9b57f316b488002cb2e5e26d0c76d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548113, "uuid": "a684d353-d379-4379-bcc8-2fff9f1b91d3", "comment": "Malware payload (SalatStealer)", "value": "931e2b6d44d0afae07694a5bd54fe43e38b1fa9fd300cc91df2bf40ab4c299b8709cbfe24b0f92037c09456eb6bf680a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548113, "uuid": "64147884-c1d8-4c4e-8483-b063afe39f51", "value": "T138C65B51FA8B58F5E9031831405BB23F63355E048B28DBEBFB547F6AFC7B681192A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548113, "uuid": "707cdb42-d62f-4718-a720-d323f50af63b", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548113, "uuid": "78d1558a-025e-4548-a8fc-2e8ee855ed34", "value": "49152:Grs1ZxEjv5fUcE3N7p7XURa+uzDBDkiglCXGqdsFzUN5+RHoktINEsk8sF/pUqVF:gCZxEDDEHiIsFw+RnGc8snJCjDHZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548113, "uuid": "b01cf26d-720b-4bf5-a4a4-4e1f6c58226e", "value": 11671040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548113, "uuid": "7727db67-b1fd-4235-9be9-f087eef2e069", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548113, "uuid": "e9b29f61-4be9-49b2-888c-f0736a17688b", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "500902ba-16df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772528380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528380, "uuid": "a3d07d59-047a-4141-91a6-769d31d69d36", "comment": "Malware payload", "value": "d1274ecfcb47c9d5f4e6fe3f74433ba0", "object_relation": "md5", "Tag": [ { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528380, "uuid": "3f02791a-5884-4f8b-8a06-82b6d0b389f3", "comment": "Malware payload", "value": "53b8f3de59efb906577f0e7368b7d006081b2911cec421fd91ac9684460030f3", "object_relation": "sha256", "Tag": [ { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528380, "uuid": "59502bbe-caf0-4f6e-9a70-be2b3f1ac1e8", "comment": "Malware payload", "value": "039754be1d9206a83df91c6cf7f15c384720ff10", "object_relation": "sha1", "Tag": [ { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528380, "uuid": "769449de-6ce6-45ce-b214-8534b0f6cb99", "comment": "Malware payload", "value": "8cdb9e2deb5363d3c52c77fbe1b78c8284ab95457f0320ee5d92a807a31eb27346dfa0f404be4e473b3281c1d4db4af6", "object_relation": "sha3-384", "Tag": [ { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772528380, "uuid": "d01e3f27-30e7-4a69-8171-e5bc2c8ae5a3", "value": "T13115237B2DBB451ACE0313A4910D21088721EA7F8D0ED1939E607CED1DF569BBD7E688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772528380, "uuid": "c3570548-c269-4a93-925d-4bc289b235e3", "value": "12288:hutavJ8mx+GDIP0c9ovNlvmDz5TPJWPgOrz6sRWNIRGKzTGWeUDvpf+h2q2Bp00e:hucN/cimDz59ACkWa+UteAp00A+T3RoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772528380, "uuid": "245e64c5-a7fa-4259-b9d2-06b10d4a7d04", "value": 891316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772528380, "uuid": "7e14fe22-4710-4452-be4e-f9cf278028ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772528380, "uuid": "32eb30dd-25fb-4ed4-93f3-fa1dccdf47b6", "value": "53b8f3de59efb906577f0e7368b7d006081b2911cec421fd91ac9684460030f3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cfe4e35-1729-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772560292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560292, "uuid": "252a6503-77ba-4a1a-9926-2d799ad65b60", "comment": "Malware payload (Vidar)", "value": "341ac208fbab876d9b9ea06560678647", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560292, "uuid": "456b75c1-6ca9-435e-8e3a-7d70a3fbb6ae", "comment": "Malware payload (Vidar)", "value": "5405a531944aec054ac3fdfe36adc35957208e57dba1bdb7db479cf9668b8a43", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560292, "uuid": "8ebd1bd0-3134-4cfb-a11d-fb7128d5de5b", "comment": "Malware payload (Vidar)", "value": "e8ad12d069ff3f6f529e7c7e64356f421827d48f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560292, "uuid": "a9054720-71a8-4fb8-abc3-1cc3602b5d21", "comment": "Malware payload (Vidar)", "value": "3d4c31ec5b419907543f80ca0451406a0b2f0cb2bed7d26025ec573b8d8771d78c98c3b625bf952aed368a325ac2e368", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560292, "uuid": "1177d55d-fa8e-4ace-870c-876b4657838a", "value": "T1D496D66F21A6C168D13A813ACDA28B4499F2F7753B77C1E712510F59CE11EC2CE7A632", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560292, "uuid": "b67db3f3-9856-46e8-a86d-7f5f2b9717c8", "value": "9fa09a64686909db97ebc147f2f0d1cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560292, "uuid": "2ae7159c-4c0c-459f-978e-1f4306ee1ddc", "value": "49152:lSC0G9vUq/7AVxLk77pe9wueSuTgF/VWfHOjOoeouBunDfDTTP4qSFnBNAvCB7JP:b7b2OoeoSKDqnnAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772560292, "uuid": "6390940f-a558-40ac-9717-d7e044eafccd", "value": 9224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772560292, "uuid": "705a27c6-35aa-4980-9e78-33afabfdf575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560292, "uuid": "c108080b-114d-4c71-b35c-a9a271f23b26", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5fcda8-1751-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772577470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772577470, "uuid": "38cc3db9-3d8d-4f90-ba9c-6931b44d8e9e", "comment": "Malware payload", "value": "a3d2bb7a2cdd846043f519a24ac38f54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772577470, "uuid": "a5b30a48-93eb-4cbe-b7c2-2e4efe392ef4", "comment": "Malware payload", "value": "5462277bbc426f715ee14b01d5d5a70e5bce0a6d7bc608e8db2dcf8716df0971", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772577470, "uuid": "49ee8861-92c1-49e9-8756-3dd720d3cb30", "comment": "Malware payload", "value": "732062f0be50480a58d460a3b329e6970edeb886", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772577470, "uuid": "9b2f0f8f-0add-40fc-abe2-7caa3c235b91", "comment": "Malware payload", "value": "bedf57ef3079034ede36e894e69e181731626e7db08ef9c08471c24374d6ce92aa9f27cd29a956fa5eac2f8f3fdcaae3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772577470, "uuid": "4bc90620-9af1-4ba3-a785-50a8b1d56eea", "value": "T183169E17F388613ED05A1A392937D251583BBE70763A8C565BEC3A8C8F361486E3B747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772577470, "uuid": "83a80fcd-b607-4a9d-8854-0879a58efa73", "value": "d6ea28a9f4da0730c2562f3beec87130", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772577470, "uuid": "e5377b42-fc25-44a0-9ef0-c593a9fa1546", "value": "98304:fCYVM+LtVt3P/KuG2ONG9iqmRQj333s1pFHlNsiE0xh:9VL/tnHGYiqe7pFHXtxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772577470, "uuid": "410b0c72-67b4-4e81-b927-410880147bea", "value": 4252151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772577470, "uuid": "c182d7f9-bbd1-4cd3-9dda-0a87470d89cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772577470, "uuid": "0c4a2a42-654b-4d38-a4a4-05293fef1b70", "value": "SecuriteInfo.com.Trojan.Win32.Shelma.chov.26162.11919", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df67246c-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772548807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548807, "uuid": "a15197ef-f856-4666-995b-da34239a8bbb", "comment": "Malware payload (XWorm)", "value": "ce28182a3a0b95852f1b2bbada964dd0", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548807, "uuid": "80eededa-2868-4262-927b-685bdc5067ff", "comment": "Malware payload (XWorm)", "value": "546cbf3de415b83aa06283b2a6b9ba9fcf999d6a2e816ff44ee976f2f3ad9549", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548807, "uuid": "d564fed5-8e3f-4ccb-8813-ea30ee0b1a0a", "comment": "Malware payload (XWorm)", "value": "0ff252ccb6136278ecbeb6235e7bc51a8acd6138", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548807, "uuid": "62232e9a-924b-426b-874e-d1650540eea7", "comment": "Malware payload (XWorm)", "value": "00bcf7f697069e3c784552131e2e389228eab5c040158013f61d6ff153475249bfe1eee9ef55b2a3ea328688c188b365", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548807, "uuid": "aab6fedf-c28f-4d00-b00d-06e0a1ed389f", "value": "T11472B42A8D19CFF4093E3191A6AB6816A5600362F538395D3D4FC5AD3F3AA14CFE11ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548807, "uuid": "b85c0950-b31e-4eb5-9f2b-9c948fb65c44", "value": "384:KuDBI4+nQLaa/8RyoMAchz+h8PZkh11Qn5PNSflfu:KuVIo52VVCz+mBCFu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548807, "uuid": "3f7efc2a-1c0c-4df7-8e69-c5b7a3e30a24", "value": 17333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548807, "uuid": "29dbc0d2-e936-410e-8b92-de1df5900d73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548807, "uuid": "aba76281-18a4-43d6-9f9f-637d4f218293", "value": "ce28182a3a0b95852f1b2bbada964dd0.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a6af2f0-170e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772548664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548664, "uuid": "a22f92e0-d039-4829-9c90-5ee79d39a700", "comment": "Malware payload", "value": "52edb5988590731952e3388d43a05056", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548664, "uuid": "9b1223f6-d2ab-4bee-9ae9-f7216cad9fac", "comment": "Malware payload", "value": "55a9fb6098f0e5ca2358ac7e07e279a1ba312e7896efd80281b381c67e1e7cda", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548664, "uuid": "c329e9d0-01b8-47e5-be34-0e947d94727c", "comment": "Malware payload", "value": "1ab823d77b5a064150e8d7e126437ec8d4ae9946", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548664, "uuid": "c12f691b-bb41-4b57-984f-8efb8db74fde", "comment": "Malware payload", "value": "7ddb07527c0a987d7a6f675dae7fe0701b4bbef7706c07aef1754cb5499f5dcded025ea9ac055402849f57ed96af8d2f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548664, "uuid": "3f331f6e-dbe5-4ee7-84ab-49dc64c7ccaf", "value": "T1DB45F45D4A71B4B4CA7BCED21009EA825F061CD61335158CE211FBCAA91EBDFE5AC0F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548664, "uuid": "6b33fbc1-5125-4098-b9d5-555d6fc0ad72", "value": "192:6hVMFm0CBqkhAkjmzloyJjVdQ295qVqi5noeRhkAolRT8p4ZBSblZ2N+JdCIf:BI/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548664, "uuid": "26e2f310-b98d-4019-8832-001968477823", "value": 1191908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548664, "uuid": "24f92e76-6fd8-42cf-96b4-5680d337a630", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548664, "uuid": "2c0deeae-91c8-42aa-a2c5-04943ab4b9fe", "value": "Adobe375019.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b0b136-1742-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772570834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570834, "uuid": "b07469ef-b10f-4dcb-a76b-8a559a1113c6", "comment": "Malware payload (Mirai)", "value": "032e8cbfe1fc6c226d5da4dc88b4b97f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570834, "uuid": "a6fdb230-1551-4515-a90e-8e3d5c3c4164", "comment": "Malware payload (Mirai)", "value": "57f4f0a8c25707329a405959b033a2d3e9b2e5c25c0bfa2d93562462ce1bae69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570834, "uuid": "c0981489-18e5-4fa8-b6a1-50aab0a8aa08", "comment": "Malware payload (Mirai)", "value": "cdd9dffba23cfbac97a5737de79609534dd59488", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570834, "uuid": "e88bc353-712a-4628-815f-2b8cd3024d54", "comment": "Malware payload (Mirai)", "value": "156327f8e45933ccec0ccc3e1df4d482de8b04a961a98705c09ba583ae8d7d5f43677915c844ed7fec6a000f81fd9611", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570834, "uuid": "31150136-959a-463d-a91e-a8ea0ac52b84", "value": "T13CF2D05DD758A4AEEBFC8EBC002E175F9950B0C4727E0F5903E9C904D9AAE4368CD869", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570834, "uuid": "4df386d9-48bf-44b1-aa88-3139e8a715ad", "value": "768:3cic7wjLhClrezicUpIMNcBtUitXynLdDbn/3jBqPaWmHAEF:sqIJezicuAveb91gEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772570834, "uuid": "8d67e9e5-b475-41dd-af43-fe0ef5c35a8c", "value": 37412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772570834, "uuid": "bf1831ba-a847-4a83-b0b2-59e3dcfbbab8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570834, "uuid": "3850bbb4-9ca0-4f79-a1f3-bc16585a1b5e", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f273b687-16fb-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772540678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540678, "uuid": "265692b4-a6ee-449d-bcee-941912d63d7f", "comment": "Malware payload", "value": "3ca7ea7023e48454c79028a0e20d4e70", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540678, "uuid": "47d13bea-ce07-4986-bb50-addd776f2c19", "comment": "Malware payload", "value": "58beef38e1f178d62d2cad832ab6c96181e590f3d90228bc89cc8eed208b1357", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540678, "uuid": "344234f3-dacb-43df-92e6-8f582c5139af", "comment": "Malware payload", "value": "f08b88ff07782c2ff582edb928376ca8f6ddb9bf", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540678, "uuid": "dc228efc-8a81-4e0e-8c28-094821ad9936", "comment": "Malware payload", "value": "59491173a14d2b611eb653f4e9222a19ec155e2d7723cdd996ce4b2c0d58160575adaf5b2a6aeeed82a9fae407f2b7a0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540678, "uuid": "ae098089-c640-469c-86d0-76ef75f77dd8", "value": "T12DE2F1A113522648D762CAB93D7E301EC47C512732AA0E402DD2A19FE90FF1448B6DFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540678, "uuid": "4b58722b-b674-48b1-baa7-d1e48f2a7272", "value": "768:/kAKuobq1rduMGAXSEYEYv6DjbChaAUK2:87vbq1lGAXSEYQjbChaAUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772540678, "uuid": "2e461731-d0d3-4bb3-a5bc-fcd3c717a48e", "value": 32224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772540678, "uuid": "97267e7e-2476-4704-938b-e0da4db78ccc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540678, "uuid": "17451a25-3161-4d3f-b2c6-d82c80a98354", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8b2b4b-16d3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772523458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523458, "uuid": "588b2928-ce8e-4b31-9a91-35c1432c76fc", "comment": "Malware payload (Mirai)", "value": "c11a181b82d7752e2f4279a3f1ae499d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523458, "uuid": "451682ed-5eaf-4efc-a8f9-ec74ae5accb8", "comment": "Malware payload (Mirai)", "value": "58e1a7510261151f4cf95b51aa40bc33bcd29fbbb2ff568a7227588c81d72dc4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523458, "uuid": "557f3a13-81ec-4f73-917d-95081ee807da", "comment": "Malware payload (Mirai)", "value": "6661cf1155deeffa8e55283cbe530c5010995628", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523458, "uuid": "42d848ff-4f14-4326-8c83-90aea3ef8d8c", "comment": "Malware payload (Mirai)", "value": "c7fb8dba28339b7112149c1e99b4c741064e4c5f2d452d06a299ea10d1704b7f8c641b5e1fb3ad46d6909a46875244b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772523458, "uuid": "b41905fc-cc89-4fb3-b027-860c0387f6dc", "value": "T1C5E36B42EA408E03C4D51775BAAF414E3322A755E3DB73078E18AFB43FC6A6E4E67146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772523458, "uuid": "c5ccf8a1-2b5d-469b-8b3e-c3fe1bf41357", "value": "3072:sv0+fbnpjbyQ4eTcwDDb0NbqKfl/bnRB/N5r+BKM/94Qxh:s9bnZyQ4eTcwDENqKfl/bRBjr+oM/93D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772523458, "uuid": "6a617126-db02-4c71-b4af-2a53c603dae9", "value": 149278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772523458, "uuid": "42709c1c-638d-4776-ba25-0f3e5926b5be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772523458, "uuid": "fb23eedd-0b0d-4f86-8a79-7c827c07da72", "value": "nullnet_load.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478d12f2-16d2-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772522782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522782, "uuid": "13efc802-08f5-48b3-92c5-30a05a76150d", "comment": "Malware payload (AmateraStealer)", "value": "2ebd76c7d0c0ca119817183dae7c6260", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522782, "uuid": "ee918dee-6282-4b39-8341-99823f74f2b8", "comment": "Malware payload (AmateraStealer)", "value": "5921b72b0b87c50ff2058c28b504276e1b0086a75d2bbd82d2ddf7f0e55457be", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522782, "uuid": "5ed9b541-f487-4e52-bc75-7499911f80a2", "comment": "Malware payload (AmateraStealer)", "value": "0b434c181133a53e1da83891b88efef6041bc9e8", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522782, "uuid": "8c6023a7-2459-408e-b83e-0963015dc6f1", "comment": "Malware payload (AmateraStealer)", "value": "5aa5f70b8ee7f98f8f4575404d7aecebfd05e72e2cb4da2cdd4c7b0ea37aff26b1ba7b147859dcccf7017a7ebc1f2050", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522782, "uuid": "f4c121f1-04e3-4d02-a526-859d5f5d61c1", "value": "T1F7262902A3E95109F9F3B7707F748142AA75BD466B38D58E328C148C0B79A78D5B27B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522782, "uuid": "c06121b7-8c5f-401a-bcdf-f79d8d0dcfb2", "value": "62848721a0fe32270ffbda7abe4e1f5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522782, "uuid": "71c984f7-5588-4772-910c-ea3b555c73ce", "value": "49152:r1beL/xJTc6M5AhmGpLSAzqx9lBt/KrkZ3XGCziPs75xF7kwl75FZ5ShCxFP+j15:rNeNJdY6l6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772522782, "uuid": "9699d6f0-15a8-4f98-aacf-1cbcaf2b6366", "value": 4723256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772522782, "uuid": "9ea64883-8bfb-4181-9c16-3236ce7057d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522782, "uuid": "3bbe6b90-5825-4dcc-b1ff-e2afac9c37d5", "value": "QuickAccessPopup-32-bit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9288aa6-16c8-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772518785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518785, "uuid": "d7f8a919-796a-4ee5-81ff-0e3f4e0d26e3", "comment": "Malware payload (AsyncRAT)", "value": "29f352c9449534d38212375258517a45", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518785, "uuid": "250832c5-16b5-4991-b8b8-94e33ef7e5c8", "comment": "Malware payload (AsyncRAT)", "value": "5956f2eb705589549010d0bc2061369363791018e312eea2bdf2d5ef905d153e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518785, "uuid": "3728c327-e74e-4cd8-a5f1-e30d12478e5e", "comment": "Malware payload (AsyncRAT)", "value": "2997be7d3009e304b07f16639133ed9c6620d83d", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518785, "uuid": "69118af5-3044-448d-a332-5b512d28ddec", "comment": "Malware payload (AsyncRAT)", "value": "5ed9c51e0e39de51e97655a6d4fafe354bc6c65dd8e15a5cede759e420bd7e67f560428f95bb2520ba90932df1fb1969", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518785, "uuid": "9b3b51d5-475c-4512-9f48-c5bca49385e6", "value": "T1EDD23B08B3D48562E1FD57B94D7292048771EE5B9973DB9E1FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518785, "uuid": "9840d180-3fce-46ea-b237-f5c1a153c42a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518785, "uuid": "95587719-ad5c-4493-a10f-4373023ae54a", "value": "768:o0oRXxvJ/qymYg/cIRGqou/Rb7fB/dTY/+:PoRXD/qymB1igRbN/C/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772518785, "uuid": "7e7905d0-e088-4554-8ea5-5a593ad2623d", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772518785, "uuid": "be723b52-788d-4f1a-a426-cbef2ad7f881", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518785, "uuid": "57bf198b-17dd-49c2-b040-e919b118538b", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed442b6-16cb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772520056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520056, "uuid": "68fd9934-7866-47eb-82e5-a84940533880", "comment": "Malware payload (AsyncRAT)", "value": "29987b88fb00a52d81762dc97ff7796b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exer", "colour": "#1EA99A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520056, "uuid": "0da4b669-8013-4d65-979a-018fb2791122", "comment": "Malware payload (AsyncRAT)", "value": "59793e1235186b86147e8b28a1044362f028df7b6fe0ef5d3aca2a3042a71cfd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exer", "colour": "#1EA99A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520056, "uuid": "f0b30db8-27af-4f93-9be8-c7dba2847994", "comment": "Malware payload (AsyncRAT)", "value": "70d68edf1728c69826f8ccf0705b118b7ff64ecf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exer", "colour": "#1EA99A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520056, "uuid": "9bf5cfe9-9e39-4ce9-8641-531df2653292", "comment": "Malware payload (AsyncRAT)", "value": "7d9aaa34e48f4edf980267d7bcbd6a34a428b7bb7d37e2a907ec2d42ac9dc8d475f85120ea72f86e74dfb0b6a89d08c3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "exer", "colour": "#1EA99A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520056, "uuid": "d3ec807a-8ab4-4b60-bfc9-a4993fb4c2ed", "value": "T191D23A08B3D88561E1FD57B94C7293048771EA4BA973DB9E1FC445AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520056, "uuid": "e9ef833b-dec2-4d0e-b8d4-e39a13ccc086", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520056, "uuid": "c106e467-f518-4cf9-90eb-4b3e7b95b2a0", "value": "768:iIjQRX55TOmqsg/cIRGqou/Rb7fB/dTa/+:5jQRXHTOmqN1igRbN/A/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520056, "uuid": "341e9380-8a2d-4914-8995-367e3b4613fa", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520056, "uuid": "d4224c69-9552-4fc6-82f9-bd4843865f0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520056, "uuid": "fd74b5c9-2a51-4f8c-9515-4d07cab0fe5a", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e82fd0b2-16a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772505013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772505013, "uuid": "6e428881-5fb1-40b9-86d6-cb2f2b77ba7b", "comment": "Malware payload", "value": "ed091c4561a0c6c27dbeed1dbcfc17f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772505013, "uuid": "468552ec-53f3-4d87-9b6a-653783c41cd0", "comment": "Malware payload", "value": "5a8f2f0033c797847167a2d26ae9a238bebbf7bd26214209b038d8f67f49dd62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772505013, "uuid": "d7c249ff-ce5c-4e8e-ae6a-27ee78f535bf", "comment": "Malware payload", "value": "f4c74571f0b42fb44634f0587dca635f31bcafe0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772505013, "uuid": "b75af126-c32f-4797-98df-2152db969e98", "comment": "Malware payload", "value": "50b25fa5ea2f564dac8c7b8a71db888056806e5070929fd346f4c210376480ca9bad2fe904ad300e4eaf238afdc61b89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772505013, "uuid": "cc9769f4-e38b-4458-9930-77ec4edc3fc6", "value": "T131F533C3873F1A67203BE04E0676F7025F15146650BED8BD5AA4E983C5323AF2B5673A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772505013, "uuid": "90f3d0d1-b0d1-472d-b718-7d85d616f3d4", "value": "49152:tALCNdlIDSQRCCevG11jHxLPBqFmIBuNyfCl1015NQ4Iq9oA0Xj2+m9BxpF5pkfn:NflIDL6S18m9Dqf4qD0TF+xNifKsdTj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772505013, "uuid": "6d8b0ded-f72a-46df-832f-0f50e793276c", "value": 3410632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772505013, "uuid": "d9a2dedf-a300-4d2e-9c03-c22824bcc327", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772505013, "uuid": "aedc03c3-db00-475f-b6b2-dcc68d4d0e06", "value": "libdevice.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39565bae-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772518893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518893, "uuid": "fc6c9ec8-5ad0-410f-8971-afe3be5c971f", "comment": "Malware payload (Gafgyt)", "value": "f04ab173af5af1648a27f8744997b65e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518893, "uuid": "d518c313-08d8-4d77-9b18-592d73fd72df", "comment": "Malware payload (Gafgyt)", "value": "5d0e949ce323f26d40a25711fb0bffe130bdc3aa6b5258db30066ec6bc8d97cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518893, "uuid": "22090e37-7a3c-4604-9e75-c3a087f878e6", "comment": "Malware payload (Gafgyt)", "value": "1703d30e194ffffd15a5058226502050b073d85d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518893, "uuid": "296ef6f8-bb0f-4b32-9641-f16c0e5802e2", "comment": "Malware payload (Gafgyt)", "value": "d10a230870e858e9843e0be35ed8b0eafa5b73eeb2749170e9b2ef0aabed35ac7d9f0d5790f9c3207ec24543e49afc88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518893, "uuid": "6c7169ec-9284-44f3-88eb-d4b5abe172cd", "value": "T1D783182B9251C1BEC08346B12ADF9961AC73BC390B3662067395BE6D3F35CDC5E99342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518893, "uuid": "dd81ad84-59e7-47a4-a974-cf5b7dde4c87", "value": "1536:qMu1g7rMtjWqtgI6kev6mJgyPyp6z7m4fkr6iLHzE1wOCkIpHqJRU:qt1gFqWLDv6gPyu7zCDLHzE1wOVIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772518893, "uuid": "e27eaa7f-63cf-4c59-9a5b-e453ec4c30ee", "value": 88523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772518893, "uuid": "8c7246f2-3138-4f75-99c4-1a7d93ae95a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518893, "uuid": "3008bd7a-4681-4452-a694-733d26a6d06a", "value": "bash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39dcab9-16cb-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772520037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520037, "uuid": "4650d82b-bba3-412f-99c8-b48ee364c766", "comment": "Malware payload (XWorm)", "value": "0a2aa79d2df06c7a42fa5f7192c82991", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520037, "uuid": "f14c33d2-c2b6-4940-a4de-42c9372e50c3", "comment": "Malware payload (XWorm)", "value": "5e8edf04dadf4eb20f73c1fc35acd2f44f9c8a0da49d5dc2b0b44b37fdb90741", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520037, "uuid": "4301d3c2-719f-47ba-bba5-e892db417c66", "comment": "Malware payload (XWorm)", "value": "3fb58e85fffd7cc97ff27f56ef9c6e4abfa390fc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520037, "uuid": "22572de3-cba2-44fd-b37f-45fda330e518", "comment": "Malware payload (XWorm)", "value": "7d706915149b6ace7484371623b041573953b61671bbe8207c0faae67603fffd714744750957cdda53946b65d7675300", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520037, "uuid": "9734aa12-9c6a-4636-9715-6ff991fa00a7", "value": "T18B25028F35FEE0809425610E9FD19EF4DEA838DBE2A35038621E4BE79905CC98B91D34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520037, "uuid": "a1632b19-240b-4824-8d41-4e99b106890d", "value": "96:hyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy0:DYuBYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520037, "uuid": "abddaedf-b424-4685-9459-e82e31fe9419", "value": 1017888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520037, "uuid": "61d53448-4ddf-45fc-a06f-ec8cf1a94d2c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520037, "uuid": "e09065cc-ec88-44be-8d2b-ec1efd4a597f", "value": "Order P-010026.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec91fb7d-16d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772524777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524777, "uuid": "258cda87-0b1d-4e07-ad01-bf1507267cc4", "comment": "Malware payload (Mirai)", "value": "ce4e7d6840328dd5aed069c6ca6bab4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524777, "uuid": "b9ddc3a7-bc56-4561-907e-de90355b009c", "comment": "Malware payload (Mirai)", "value": "5f07344e1374ea935af3d6041ae1185f172500aacc65949c553389f0bdcc086f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524777, "uuid": "93828b54-e6ea-4c4c-966e-b0490560f63b", "comment": "Malware payload (Mirai)", "value": "04c644cff33c30512530be14c0126ffcc0e7bdb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524777, "uuid": "eb46a3a2-0e4f-46f9-8265-7695867988dc", "comment": "Malware payload (Mirai)", "value": "f57e58f3831a390a08a883382eee5c4989409e340e78dc293c39970997fa8d0c2c5a09d709645b1759404091a0650fc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524777, "uuid": "ae4cc6d0-b6bc-42d5-9b59-e6c284c141b1", "value": "T1DF733A792585F6BCEEE180B8F45320D518A20A1C37DCE0E37493947AEF74B49722DE69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524777, "uuid": "610062ae-1775-4c56-98f9-38d8c382da28", "value": "768:2oEMqpCawCB0yOOe11If9TUpO7ANZFYJgWszrsYE/6wor4BVOWKci677B:2tMqgawCCyOxi1goURQgHrsHpL977B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772524777, "uuid": "b711d1a9-69b6-4a9e-aadc-cbdf61e89288", "value": 75152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772524777, "uuid": "2a3ebb7a-aab0-4cf9-b147-fc8fc02439c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524777, "uuid": "7501d14e-1bd7-4521-b5ee-fc9ff5340251", "value": "nullnet_load.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9561d72a-16e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772531073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531073, "uuid": "50d6518d-98cc-4ed4-bcf2-2c030000e8fd", "comment": "Malware payload", "value": "7a50af4cef2ca7a2e8297383d2105440", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531073, "uuid": "e885632d-9547-4a76-8a74-df118b680344", "comment": "Malware payload", "value": "5f897f545d8826862fdfc4cf6cff38c43ce1e13da27d48f276aa497e64959be8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531073, "uuid": "23eb8fd0-7f97-4c21-8f7f-ef45c6869886", "comment": "Malware payload", "value": "a6381ece72ce192477734fe25fdc0fe085426e92", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531073, "uuid": "6e3da11c-aca5-4c1c-9fde-0e56ffa9bf16", "comment": "Malware payload", "value": "6d3b49f579a1b1e45ae727bc216cba81eb6dc8433a25ebffe27ca882c78078d94406c8b7c0e1e86faaa92fcb47857214", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531073, "uuid": "86377e31-20f8-4a8f-8677-82d8f76af124", "value": "T1128612C6F7A85D2FC8B75032896A177266574D028E83AF437848371C2977AD80F9DBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531073, "uuid": "e4fd1096-6cd6-402a-b9cf-fb217734dd99", "value": "196608:FyOa1/A2LaxBXqD4AZkH6XT0vkKU5vE4u51o3:F6hAOax0DTYtHU5M4z3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772531073, "uuid": "b91abb45-e19d-444d-9bd1-888d77f391a2", "value": 7879275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772531073, "uuid": "eb0b81b3-1a38-48c1-ad1c-0681ba08e1b8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531073, "uuid": "de035fd8-f5a3-4140-9cd1-4158691f8a69", "value": "RepayApp_v2.2.6.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c312140-174a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772574464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772574464, "uuid": "710e21ed-a4f1-4df2-bd7a-59b0b5e67211", "comment": "Malware payload", "value": "152731cb743bd2551e14a20a05e4034f", "object_relation": "md5", "Tag": [ { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772574464, "uuid": "ba0d34ed-e42d-4aa7-b466-23ee2add4d7e", "comment": "Malware payload", "value": "5ff7d0a514ddddb00d0f95301637d0448aab6fb7bc57a3a7baa030ee3dbd3ebc", "object_relation": "sha256", "Tag": [ { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772574464, "uuid": "6a586f09-943d-4307-bcef-cd62072dfada", "comment": "Malware payload", "value": "44a10c0d055eb55d2d80ab55fdfeb023118c67f6", "object_relation": "sha1", "Tag": [ { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772574464, "uuid": "f3447963-3e18-4e47-aa1d-f8196f9db5ce", "comment": "Malware payload", "value": "c44f6e48f68de6f696cf48b91ab473f762ef48571b65f7356bea0002b8f4643fc7edc2574ffa035aa2570d470fb43ee5", "object_relation": "sha3-384", "Tag": [ { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772574464, "uuid": "623ff16b-de7e-4e57-ae21-dcb6dfb7438e", "value": "T1C44423D7D62DAD8F8837414E0D96C9DC3CA20A8A530E644D3A499E3893E38D178F17B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772574464, "uuid": "73e4b5ad-342a-439a-a26f-296a5b8eea15", "value": "6144:uPzMlpOdVi6SyrIUnkEpXxZfATqie9u/DQgFkEQEGG:czuQ6yNXxZaqVsGEgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772574464, "uuid": "b5f67a18-c317-4a22-b886-4aa01b1215b4", "value": 256963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772574464, "uuid": "36f4d2e4-b03d-4f9a-b0ef-f1f623332b1c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772574464, "uuid": "55fb3305-f729-4c2c-80bf-75010ecc7f67", "value": "February Statement.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b74705b-1700-11f1-a769-42010a9c0008", "comment": "Malware payload (Systex)", "timestamp": 1772542680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542680, "uuid": "4c864a71-52c4-4389-a003-0254ce8bc59f", "comment": "Malware payload (Systex)", "value": "239a24dbb50b3314e98a7f8c15bfe2ff", "object_relation": "md5", "Tag": [ { "name": "Systex", "colour": "#D7F762", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542680, "uuid": "23406d5a-0da9-4ff6-964e-919b3fbaaefd", "comment": "Malware payload (Systex)", "value": "600433eb22bb7e5a33c190688063dd9417d6b45cdd8e7e3ba93c9d37ce7b0946", "object_relation": "sha256", "Tag": [ { "name": "Systex", "colour": "#D7F762", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542680, "uuid": "4975d560-273c-4759-90fe-266c19d7feeb", "comment": "Malware payload (Systex)", "value": "b6bce7791e0210fd5703df06475cc778740b1795", "object_relation": "sha1", "Tag": [ { "name": "Systex", "colour": "#D7F762", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542680, "uuid": "0c4ce1e9-e5df-4ef1-b5b8-ad33aa4960ef", "comment": "Malware payload (Systex)", "value": "6a697cf8b49464ad6c3b1337c9734588333d29ef4ead05b7ef63a93c62f7cdcbfa1cfbd40bb8411fd9ea6981e224bb42", "object_relation": "sha3-384", "Tag": [ { "name": "Systex", "colour": "#D7F762", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542680, "uuid": "59c543e1-6817-4707-a16a-f6ec55736d05", "value": "T109847C04BAA4F0F6D995043800DBAF36967EB4281726CBC7E394CE5D9E113C3A93569F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542680, "uuid": "ec2dc95d-e778-4c2e-adb4-206a3d65dee7", "value": "52a948b5de7cc38ae8e6110ce48389ff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542680, "uuid": "6ef18e8c-0820-4843-bc1f-af5c13a56f12", "value": "3072:zoCL/8aML4yLtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:zoCLoVIJjiJcbI03GBc3ucY5DCSjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772542680, "uuid": "231433b7-8b93-433e-b980-e63ac119329b", "value": 385484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772542680, "uuid": "83d71268-a527-41d7-b725-024d5569e3d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542680, "uuid": "c64db3bb-3f9b-4f18-9e33-452ea7a89c24", "value": "600433eb22bb7e5a33c190688063dd9417d6b45cdd8e7e3ba93c9d37ce7b0946.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905ede14-1721-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772556834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772556834, "uuid": "70193061-f17b-4032-a91e-4711309d3d07", "comment": "Malware payload", "value": "ab56563f3817e31568e487edc232a7ee", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772556834, "uuid": "d4cf985e-9878-47cc-96fd-204804eae2fd", "comment": "Malware payload", "value": "601ae63ee59288a2e36f0b0d4f7bc0bfb40f0489995343c955db7d9ded469478", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772556834, "uuid": "3808eb74-7ce5-4206-9a5d-397a08023a12", "comment": "Malware payload", "value": "4142b2d89afec1b5b2379219af3b5a2fabe53a8b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772556834, "uuid": "fb1e7da0-9a33-45e5-8e6c-2734fff1f3ec", "comment": "Malware payload", "value": "e71ef2245b2a04b7d92b1cc08eaacde4d9d7d629edf9cf11cd8376b36c7606e52beca2d9e297a899720fb7f6015396f1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "MustangPanda", "colour": "#7BBD51", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772556834, "uuid": "7dbc659b-9192-4012-a032-1e7ba524bda0", "value": "T16F1523157B444212C79437FDCBFFE2C5CAAB6C4E2C0B5C94E57AF28BA071791239914A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772556834, "uuid": "7175de9f-666b-4375-9463-c07663ad22b0", "value": "24576:wbBPQGLub7tNJ0zenqpvWLALclMrRNib+GN:89ib7tNJ4enqpvn79G+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772556834, "uuid": "4409c3a2-fb88-42b3-a726-08b8e0c9d0b5", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772556834, "uuid": "3c6a63a0-27c6-452c-9b64-030dd6731988", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772556834, "uuid": "8e5cf9e5-3b10-4236-980d-b50d7bdc55ed", "value": "6z03.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc56ca9-1748-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772573688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772573688, "uuid": "56db5464-d5cc-43ea-bbd6-5c545a859f8a", "comment": "Malware payload", "value": "5c62cdf97b2caa60448619e36a5eb0b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772573688, "uuid": "06dc18f2-8c23-434e-b178-931e0d0633aa", "comment": "Malware payload", "value": "60678e352f3c849e36413f5de51b5eeca1180840c818f9ece0a0da803eb205a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772573688, "uuid": "9630ffa8-83e7-4dd8-a0d3-bc7a8de56ae1", "comment": "Malware payload", "value": "f7576bc246e4bf5e47f54ba957371c938fec122c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772573688, "uuid": "7166b40d-5ed9-428d-badc-e26e27a6d7f7", "comment": "Malware payload", "value": "865812dcf2062faa28905cd3d9f55ca65d1ff03b7b9ec19b8b06accb6094d36443ef51f898543dc9ede82807630a3e2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772573688, "uuid": "2fd09011-e8c8-4470-af16-c564516deefc", "value": "T13664C8A27B37D4F1C4F2A73C946A512C9EB7FC261317DA75098F1090E84924A9E3DE78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772573688, "uuid": "e129158a-717c-4c82-98f7-c29e667c82bc", "value": "ced2b517332bf6ac4202f986e4ea5ef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772573688, "uuid": "059d07cc-64bc-4c29-a146-70a0b19aaea3", "value": "3072:YxTHBVlC1y1sDUkHcHM5kvjDDMZEnEChBAO8nWXcAvWMv08mTnPd7YfhxBz2Dpxi:sT3lC1y1CUOM7L/oElP5XMGVf/ZCyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772573688, "uuid": "57d1f025-bd64-4a3f-8684-c629d9644be5", "value": 309304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772573688, "uuid": "ed258c18-07b3-4223-b73e-57549e27d533", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772573688, "uuid": "54b70d1e-69b2-491e-b846-f07b63ccc188", "value": "60678e352f3c849e36413f5de51b5eeca1180840c818f9ece0a0da803eb205a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402eabc7-1756-11f1-a769-42010a9c0008", "comment": "Malware payload (njrat)", "timestamp": 1772579463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772579463, "uuid": "b43406be-9480-4161-9540-5ee836b77e82", "comment": "Malware payload (njrat)", "value": "69d863f1f146b0904057ebdf3d8f91e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772579463, "uuid": "511fdf27-fabd-4863-b468-c53712a7c683", "comment": "Malware payload (njrat)", "value": "620d61e4b15a0c4f3e8f31855cbcc94ca02601e899145bc48c65610e2e4ba0ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772579463, "uuid": "c4489152-9e9a-4a3a-a3bc-e7c2f7179314", "comment": "Malware payload (njrat)", "value": "4c692a72fd3440d39f2b50f9d57ce8ea4a7970a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772579463, "uuid": "fa64f60b-37a5-438d-83a1-28a7dfcf53f8", "comment": "Malware payload (njrat)", "value": "0e0c266d2809af8791713beb6000ff8b31b13e187381d26cf62020735180fda9705f0f88554a0111f5842a196156bbf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772579463, "uuid": "8ad9c9cd-f553-432f-81cd-6ff3e785198e", "value": "T1E1A35B0EF7468ED5C51D0F73CA63904941EAD5BBB827F73B58EC2EE15C228889D8B950", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772579463, "uuid": "8c908b16-2e9c-4d2c-bee3-de4d9e7c8b39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772579463, "uuid": "e07c99c3-0c04-45cd-8b9f-c6579352efbd", "value": "1536:aeSeVVhNjG0mq0XLyuzLEf877kkrbZ1flGdsbYsjn0SkRpFozbIJIuF:djmNTrd1flSSYsjn0SkR3ozbInF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772579463, "uuid": "f579f346-0109-4119-92b4-dd22fc0e919a", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772579463, "uuid": "65afa951-a48c-4901-8dbd-7cc9c445b495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772579463, "uuid": "f3e01a97-275e-40d0-9c8c-d61716d2ddb6", "value": "DONT OPEN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914dea91-16e2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772529778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529778, "uuid": "a2f5d4e9-c428-442d-9ab1-ad8d9a68da76", "comment": "Malware payload (Mirai)", "value": "11677caeb9d88433d85e1f943732c361", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529778, "uuid": "8664b424-4aae-4dc5-ab39-fe1965fa210c", "comment": "Malware payload (Mirai)", "value": "6258a47ba514ed17a41d868bb45914d11768be1dc7da62bac054dd9d32d8a92c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529778, "uuid": "716f2418-85ce-4e93-a467-2c6d02c2f067", "comment": "Malware payload (Mirai)", "value": "8b902991565a91af3316c1b96477bbfb8ccdb4ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529778, "uuid": "9b4cdd47-66f5-4235-8b57-a04f2a7f2fcd", "comment": "Malware payload (Mirai)", "value": "4d7eca4d278411d44524fcee2462c27c026a8ad3008cffcb13aff82b390abb4aeb42375d6408e96472fb3783fe3c5c98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529778, "uuid": "174cf5d2-8890-414c-9abd-a959f9845875", "value": "T16A735C95B8019F7CF94FCAF641160D0EF9216346A6930F27B767FED32CB20995E06886", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529778, "uuid": "c5b16869-c85d-46b1-b929-bd738a20e2f7", "value": "1536:9lPx17B1r2+zOoNtHmjAh9zYFl728Jo8f9MQfaR:Xl1r2UO6BXTE6+eR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772529778, "uuid": "22953d7f-c316-426c-8862-5d166dc44aa1", "value": 74864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772529778, "uuid": "67c34d2f-0cde-4fa9-b906-d6999d8c7d68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529778, "uuid": "385f22cc-5b13-4e81-9079-1c26361ae7ee", "value": "nullnet_load.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b1edfc-16f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772538001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538001, "uuid": "5a5a8e53-1f72-4ddb-93c2-de5a43ace9cd", "comment": "Malware payload", "value": "fda501d63f3d2d74e05a63e0d51ee0cf", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538001, "uuid": "f458e226-41d5-4b87-be7e-215f4b08564f", "comment": "Malware payload", "value": "62c477c0827752ffeb8ea243497eef1c666fc41025d287909d021bceb5b8e699", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538001, "uuid": "458c12d4-942c-492b-ba92-115ddb92aa64", "comment": "Malware payload", "value": "0a94b4351852e78fdf38db25617d6a58d394d649", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538001, "uuid": "ebcdc9dd-eaa2-4445-abc5-259e9aa8cfef", "comment": "Malware payload", "value": "5521e8766fb8ec3dbd69b52bc312d4f8373b24044585f4441f54a7de9b08dd891d8e01d562ec9eaa72e9ca7ee6e99087", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538001, "uuid": "c1f90ab2-6e3a-4165-ab48-ebe2a8d0110a", "value": "T19C51017CDA39FCD0032D73D059323F9B20D81E23CAF66A28D98118A96834A05EF2655E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538001, "uuid": "6ab19223-3b27-459a-b3f6-44eb7dc6f1ed", "value": "96:8TgY7XEo+pUdjgY7XBoGfVLOwOx1LCYyXLr6TzpNkHPkOMfdBtYhT:RKEo+umKBoGfQNLCnXPepqHMOMFTYhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772538001, "uuid": "77136da5-7e39-4e08-abe8-cd1db92bd498", "value": 3151, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772538001, "uuid": "69c9da05-dbfb-4855-a8a1-e5595426aaa5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538001, "uuid": "801d5f44-ab79-4aad-b469-6ed0a70fa733", "value": "62c477c0827752ffeb8ea243497eef1c666fc41025d287909d021bceb5b8e699.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb209289-16a1-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772501931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772501931, "uuid": "05baeb82-322e-4644-b9d9-eef2bb35935a", "comment": "Malware payload (Mirai)", "value": "57c7712daeaf0b0621585912e080e592", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772501931, "uuid": "ec21aae3-c541-4d69-a924-a5f7092e30ec", "comment": "Malware payload (Mirai)", "value": "63e85708497eb0158b3554ee38fd84fc89491a7c95ae16bd222bd0992c9278ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772501931, "uuid": "ab23a3c2-db4e-4810-99b3-e1ef458ad0c7", "comment": "Malware payload (Mirai)", "value": "9661be6b2a35c948c4643adad3e6c843f2877d70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772501931, "uuid": "008f2e57-7032-4e15-b755-a98918877365", "comment": "Malware payload (Mirai)", "value": "fd4f954a35084aa8ce0c4a49909007f9c40d0b9d70d810e65fc1c70acec2da31ae6cca0aecf1f819f78f94f5a8fccc9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772501931, "uuid": "7c62c149-e7d5-4e21-9fc2-e75dad6eb80d", "value": "T11834B70AAF610EBBDC6FDE3706E90B4625CCA50722A83B353574D528F55A90F4AD3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772501931, "uuid": "c6242d68-2b26-46e3-bfbb-0ef461f7d4ae", "value": "3072:xZG8jFmW6R36qXQeDT6idlexwfRSHjwoGC0kMZ/:xZG8jFK3RQeD/8qRSke0zZ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772501931, "uuid": "5985ac48-d0ef-487d-b4ab-7e245fd5417d", "value": 241264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772501931, "uuid": "7a818b46-9b92-4f90-af31-1e9e8c1e865c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772501931, "uuid": "2b7b70c3-f3d9-4002-b3c7-043eb8d6ee8c", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31b7abf-16fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Hajime)", "timestamp": 1772540679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540679, "uuid": "da007460-355c-408c-8924-5f5cd57e0661", "comment": "Malware payload (Hajime)", "value": "9274789998e8f74b7bf110e7edf7a8f1", "object_relation": "md5", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540679, "uuid": "27968242-7695-4e30-8d0f-369c4ff87adc", "comment": "Malware payload (Hajime)", "value": "6512a40b4b577e7af2f2166719379ad4f6049322c4dea97dfb5cedb9718db27a", "object_relation": "sha256", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540679, "uuid": "5a430fe7-7faf-4c6a-afdd-737eee75ccf6", "comment": "Malware payload (Hajime)", "value": "0d63791c7d6364dab9d5df568e9144429b9ef076", "object_relation": "sha1", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540679, "uuid": "381f2b53-4171-44e5-99ed-bf85eb05216d", "comment": "Malware payload (Hajime)", "value": "f2edebca82526c34fa5e9785cafa41c89af07bc389274590108a94e6bc0c8d81c85995c8190256517e4cec43618e1d33", "object_relation": "sha3-384", "Tag": [ { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540679, "uuid": "57559883-7210-4f46-b9e5-488c5329ee2a", "value": "T1AB7312E017B517CC1371E8353BED205E9124223972AE35202E97528DF957703B6B2DBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540679, "uuid": "e01963f1-82a6-4569-9b47-596f178fa68b", "value": "1536:87vbq1lGAXSEYQjbChaAU2yU23M51DjZgSQAvcYkFtZTjzBhr:8D+CAXFYQChaAUk5ljnQssn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772540679, "uuid": "29839713-2283-44d4-a2a4-7eaab9642b25", "value": 79836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772540679, "uuid": "49be246e-fdaf-4ad3-9121-74a0d519a970", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540679, "uuid": "e73a24c6-b261-4588-a9ad-f039b0b66450", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eae5367-16e4-11f1-a769-42010a9c0008", "comment": "Malware payload (MeshAgent)", "timestamp": 1772530632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772530632, "uuid": "e8d5f3ca-5da5-4546-a3fb-c837c1eed5dd", "comment": "Malware payload (MeshAgent)", "value": "067df7cf197945f6aac5413e722d5398", "object_relation": "md5", "Tag": [ { "name": "141-11-107-134", "colour": "#BF8B25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772530632, "uuid": "28ce3f68-8d30-4f8f-97f7-769c794503f2", "comment": "Malware payload (MeshAgent)", "value": "6545b109e575cc3a60d80e7155a4a5f70d770adbe96965cb7e42a2d62ca83043", "object_relation": "sha256", "Tag": [ { "name": "141-11-107-134", "colour": "#BF8B25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772530632, "uuid": "b790d0a8-53ac-44cb-a300-5b8492c9dfef", "comment": "Malware payload (MeshAgent)", "value": "c7e02cf4a5acc6a766a5d09d951b3e2e1ed5180e", "object_relation": "sha1", "Tag": [ { "name": "141-11-107-134", "colour": "#BF8B25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772530632, "uuid": "17141571-ea75-4357-85be-d441be0f2b7d", "comment": "Malware payload (MeshAgent)", "value": "12e19cda036dfc7b909ec375b4dd5e9cce755018c18ec75c3bef65d9a9bffad80554d4cd95a71b02e23b1ed0c53441bb", "object_relation": "sha3-384", "Tag": [ { "name": "141-11-107-134", "colour": "#BF8B25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772530632, "uuid": "6d137af2-18cd-441d-9edf-4b6d78f20a96", "value": "T1A906AEC3BB834471F8A736B411AB53BE9D7D69530728D4C393D428A949316D0AE3B39B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772530632, "uuid": "e8f9cd19-1979-4ca2-92f1-c0e2781b7fff", "value": "7aa58492bf5691114c98568704d048cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772530632, "uuid": "16d1d713-3bf6-4d0d-9a74-cb63c2e52f0d", "value": "49152:hfEV3ugKeuWoAkf6bRexQlNIdwB0pJCWJ0+1NaZPwq+5bWZPaK:hfEYnnfKthWq+1jJWZPaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772530632, "uuid": "42283722-b08a-48bf-96fe-2ba1e288b2fe", "value": 3856520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772530632, "uuid": "51ebabd8-a75e-4a0e-8e16-c93708e7f3e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772530632, "uuid": "a2a31906-549d-4da2-bf1a-e6d6ee4cfa1b", "value": "meshagent32-Access.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c544d9e6-16de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772528147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528147, "uuid": "211288b9-2ec4-471f-9858-c5fd2a38aaa3", "comment": "Malware payload (Mirai)", "value": "bf2e5bdd59217d65d9c8372545f70c85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528147, "uuid": "2d4e64ac-9010-4e6c-8b9d-e58dd0e45f5f", "comment": "Malware payload (Mirai)", "value": "6613f0240f310bedbf9633de0ef39d8883c0927f2b28ca32e272fbee89ef7176", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528147, "uuid": "ce34d36a-8a7f-4268-b6c1-f218f184e536", "comment": "Malware payload (Mirai)", "value": "a3120c61657c21da0e967a89945f540a87633cb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528147, "uuid": "583b8e40-8e3b-487c-a845-4bb65890c284", "comment": "Malware payload (Mirai)", "value": "6669bcd5f55c4830ceba6e500f41a489a308f85cdefc2fd7a9c3cb08c6d02a5ffa31badcdc8f23aae6e321fdb77dba5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772528147, "uuid": "570752fc-19fe-4965-a11b-c85c23f65eec", "value": "T182638E73D569ACA0C08441B575E88DF10BA39D00A2A77EF69982CE254407FBCF6167FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772528147, "uuid": "bb078f97-7ac3-4d90-b173-f600e71a4a8d", "value": "768:y/+mVIT6tauIgm97leEPL2jPg1KN2D4lZQZUHBFzsiYMiBRfZoDP6N2Cvy7P:y/PC2tauOcHlZQiCReDa2Cvy7P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772528147, "uuid": "201f3bd6-6114-489b-b99f-0a6f9e71b20f", "value": 66752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772528147, "uuid": "d9e8baa6-dee3-4e64-89f3-e6efdaa24761", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772528147, "uuid": "23830553-b965-4f9f-8a2d-44b14c995f8f", "value": "nullnet_load.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2dd089-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772548744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548744, "uuid": "07ff147d-eed4-44bf-a526-873f7d78cca8", "comment": "Malware payload (XWorm)", "value": "912b9610fa007eca6e8b742d34497dd5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548744, "uuid": "f928d1bf-98c0-4e65-ac27-4355e3b86d72", "comment": "Malware payload (XWorm)", "value": "66f75bb8cc5acb3676df766e7a57c9727063ba0955ae1333ee68d81f06fadea6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548744, "uuid": "570b7f27-79d9-43b1-ba0e-76f9d922cd9c", "comment": "Malware payload (XWorm)", "value": "4d4df88dc08de5b0cb0650ff4f72afc28faae701", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548744, "uuid": "6369e2d2-1cfd-4666-a2b4-fab4c97eab43", "comment": "Malware payload (XWorm)", "value": "9ff60e91e45f999739b346ba011f462ec1dd8f453f7b1fcf27cabc3a5df505c3cb8fb0d1b49e07e3eb4c867b44f3678c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548744, "uuid": "ee72c972-b50c-426b-8b80-39611e69d66b", "value": "T1B4E36D5EFBA35919DA0E8D378263451897A5E4E7202BF7EB25C488F14DE78D88F87840", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548744, "uuid": "564840f2-c698-459c-8932-159d677e11a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548744, "uuid": "07a0d8f8-1068-46a8-9cd7-1093905271d2", "value": "3072:UqTKhTGeV4pjCp5v5OBw0vZnBlcN1/KOb/uUwXZbJsIX:+qZpIyv9mCOb/5wXr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548744, "uuid": "6720eca5-aa3e-4380-a174-2dd73fd051f7", "value": 147456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548744, "uuid": "09f59d14-48d4-44d0-9e71-363a78d17575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548744, "uuid": "d7efbc4f-5bdd-4ed2-b117-5e45078cd663", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ffbc4c-1728-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772559849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559849, "uuid": "7491032b-75e5-4a35-9581-a1329bb1724f", "comment": "Malware payload", "value": "1ca16771ae644a8d0b7d83dd3068dfb3", "object_relation": "md5", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559849, "uuid": "33b75368-ed03-4ded-8808-426a7842cd7e", "comment": "Malware payload", "value": "690b3064ad7a6072f42d394d5ca8c295de1be489f19723b80702da95e0f41664", "object_relation": "sha256", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559849, "uuid": "9c755108-791c-4a7c-a5dd-5c1d9b69d05f", "comment": "Malware payload", "value": "b88143cb015b379cb0d8b0f2ea92893c2b314607", "object_relation": "sha1", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559849, "uuid": "2254f7d5-b66e-40c6-81cf-486eeb81c9c5", "comment": "Malware payload", "value": "2b30742346dfcf88959705fc70f45d73d2010e08a1ae6c29850c01111bd1e63756e35cda20fca93e4deb01ffc12847d0", "object_relation": "sha3-384", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559849, "uuid": "24535749-d958-406d-a13f-94b3df29b6f0", "value": "T13221DF2B1794A2BB5F14C05D8B2C9F14EA02A0EAF40555DF37389B9A0A954FBC1F5889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559849, "uuid": "cb15fbcf-b9d6-4b53-a7ad-81633b83614e", "value": "24:LI2rUbD4euW3fCMDZ8En1Yw5ACLAC4UJsk+2t5HuVMoz+u5WNzj5WwCa5WN412:CD4rwPVn1jyBKQ2txuYuK/fCaK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772559849, "uuid": "8ce7e9cb-9005-4d7d-817d-f3779b5cae2b", "value": 1367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772559849, "uuid": "d03b8744-c725-47dc-86c2-e9a9403a92e9", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559849, "uuid": "7cd78016-0efb-4196-96e8-0a03dd22f51c", "value": "yguzspb.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba39251a-16e4-11f1-a769-42010a9c0008", "comment": "Malware payload (Metasploit)", "timestamp": 1772530705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772530705, "uuid": "ed775279-7d7e-4218-97fe-2e838ab26daa", "comment": "Malware payload (Metasploit)", "value": "5b0bdc5dbe5eee1f523e7c3fc8d887d1", "object_relation": "md5", "Tag": [ { "name": "141-11-107-134", "colour": "#BF8B25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772530705, "uuid": "094e12f7-3e2c-47b7-9a91-19356b81fec4", "comment": "Malware payload (Metasploit)", "value": "6a3a4b0552cc98c9e45f85eecee968c0108535b52ec0f8c5f835e7e0322c66f9", "object_relation": "sha256", "Tag": [ { "name": "141-11-107-134", "colour": "#BF8B25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772530705, "uuid": "ee67af2a-9c5c-480c-9383-4b3f38ac10b0", "comment": "Malware payload (Metasploit)", "value": "a18dafed4a69e1ce956e45f0f5e30832e4d28dab", "object_relation": "sha1", "Tag": [ { "name": "141-11-107-134", "colour": "#BF8B25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772530705, "uuid": "bb26f40f-235d-43a7-b765-09e3141944c7", "comment": "Malware payload (Metasploit)", "value": "f5ce8d8256ff9e507e466e50f865cb0a5089e42ecba04babe756a0c46abffca725e257c230ff278b4550cc8410bda868", "object_relation": "sha3-384", "Tag": [ { "name": "141-11-107-134", "colour": "#BF8B25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772530705, "uuid": "692a139e-8288-44f8-a664-5840e21998ae", "value": "T1A78229897B06D8CDC5B68179C4322D2A9129F36453724BEF67B1482A0E63FB07D2DF94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772530705, "uuid": "0c96cb02-bdf4-48c4-be07-45fb73769aa5", "value": "ba782605aac629a26bc1fecb2cf3b2a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772530705, "uuid": "92167846-d881-402f-8070-00c455c56cef", "value": "192:dGFuOW7Lam/qxNvZzgUuzjm+xatsJlNf6gr2PxsMKup7xofn6TD/L3dz66G7+HFK:EceV4P6gr2u2x2n4rL3w6GIWI/c+To", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772530705, "uuid": "a6ae319a-afb6-4d4a-8195-b4dae7a5169b", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772530705, "uuid": "86d52c53-44ba-4c7a-8395-c8d4f11259c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772530705, "uuid": "3141aff2-8a06-4a2c-9f0e-6a79361cdf1f", "value": "Stnon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "695767eb-1724-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772558057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772558057, "uuid": "3c6102de-29aa-420c-bed7-369d1a0a6bd2", "comment": "Malware payload (Vidar)", "value": "5d738bd83900bb7c9376a25cf54ee238", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772558057, "uuid": "ed5f9d76-55f7-4726-a331-ca20d1fd06af", "comment": "Malware payload (Vidar)", "value": "6a3b4a2e848e6310161edf0bfbcf2f53ec1bd5165974d2d9bfdace6ea38db672", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772558057, "uuid": "16d3b13e-579a-485e-a526-62a3bcb93dcc", "comment": "Malware payload (Vidar)", "value": "80783ee54a653df1349d2d21f2609d04453be8be", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772558057, "uuid": "72cb1904-5bbc-47e9-b95a-967f6ef44ab5", "comment": "Malware payload (Vidar)", "value": "55541296fbea4fd6bbc76574e7e520d291f578b38030195830c90d34a0c2752d6ff8ddddefa320a616acb1be3cb5310f", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772558057, "uuid": "7f462690-b376-42c6-8f00-c1d58530bbbc", "value": "T12F96072B22E58168C22EF13AD4B38B40DCF774750737C1EB13A527694A15BF94DBA7A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772558057, "uuid": "e7b874a5-c4fc-43e5-a920-640b00ce469b", "value": "9fa09a64686909db97ebc147f2f0d1cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772558057, "uuid": "7317cf5c-d57e-46fb-b89c-121153781242", "value": "49152:/SC0G9vUq/7AVxLk77pe9wueSuTgF/VWfHOjOoeouBunDfsTTP4qSFnB6AvCB7Ji:17b2OoeoSKsqoi4SHKs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772558057, "uuid": "722faded-713b-426b-a3b9-a2792589c52f", "value": 8687104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772558057, "uuid": "c3613fab-15a4-401a-9552-4115a0bdca33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772558057, "uuid": "2374dcc8-6fa7-4580-9954-bcb72899394c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50218154-1699-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772498315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772498315, "uuid": "1f27c87b-79e3-4fc3-b645-63c17a23a906", "comment": "Malware payload (RemcosRAT)", "value": "83f5156c7eaa6fa7681d5783e4b0dc6f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772498315, "uuid": "8dfa4078-d49c-4904-8874-7ff03cf8a8db", "comment": "Malware payload (RemcosRAT)", "value": "6a794a8e3184d505573cc23c957b78b11a7eb89317ae2a82bbaa1195c310da0e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772498315, "uuid": "358d2d63-66a3-4627-b349-278564c239ed", "comment": "Malware payload (RemcosRAT)", "value": "c4db84797f4994b5abe481903534fe300f2b4d5c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772498315, "uuid": "55452917-c219-4e2e-9fb7-a9425e3ac3fc", "comment": "Malware payload (RemcosRAT)", "value": "c885c323cd33ea0a9b9e4ed5b5f4634bd6e340edde139ddbbe4ee3422910ba6754b70d4794e11b2f81240082eafc220b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772498315, "uuid": "7dd5c0c9-e81c-4caf-9847-8e97b05d84c7", "value": "T1D27412273B9AC08BD56605300CB2DDBEEDA8BCAC5821866B7790F75DF47325468493F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772498315, "uuid": "9c46994d-4a91-4821-a19e-28ad99171eff", "value": "4ea4df5d94204fc550be1874e1b77ea7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772498315, "uuid": "353bc312-731b-4b91-a4f3-35bcf8f35c23", "value": "6144:cwq3NpGrARHzuMKqcCgog6NCnnN7Y418YZzjERFi00e:czSiHzw3nN847ZMRFi4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772498315, "uuid": "887e6ba5-bdc2-4344-af11-4dd00c9401e7", "value": 369680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772498315, "uuid": "191a885e-dfc7-4e1c-9cfc-51ec4a694fc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772498315, "uuid": "f17a94db-20f3-467a-afbf-bd2a2c8ea8fc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afddd7a6-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772548727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548727, "uuid": "7de3f519-9123-410e-a11d-24150a703433", "comment": "Malware payload (XWorm)", "value": "d71fa6049701cbc01b0fa9cb148977b8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548727, "uuid": "acfd5266-72ea-4364-ae50-cf4aa8a1ae58", "comment": "Malware payload (XWorm)", "value": "6b3c209d187de8dfaaefdc5c0890a87bb22951b76e9676b7e3e72397633b2383", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548727, "uuid": "ce039fd8-0e25-44ec-8942-8b733c85c154", "comment": "Malware payload (XWorm)", "value": "50f55a29a0427819d2bea1056c4ee242e6444288", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548727, "uuid": "c14902a6-5995-4a05-9fb8-94deae396ca8", "comment": "Malware payload (XWorm)", "value": "083007d04b7445aa4c93b95941f5090430a3ef91be4ccea44ed07ed938ac41c8d5fa35935c3154869d8bd3fec4b173b6", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548727, "uuid": "b9ba2069-a63f-4c61-ae4b-e94ef1634318", "value": "T19C451BA6C7A457467A05F3B32BF6E44D40107642FB14E7DC4CD2C98CB89E11CBAAC96B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548727, "uuid": "d3f94f45-cac0-4092-887b-66f310715dcd", "value": "96:YZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZm:+niKMn1eda1ykuF4W46YcLiL5ZUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548727, "uuid": "47b98593-bc30-4bd8-968b-e8801a67accd", "value": 1255799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548727, "uuid": "3a9c5a37-7c90-4436-84d5-3040c4dc73a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548727, "uuid": "a58cf7bc-78d0-436e-a3b9-a82c40c180e8", "value": "d71fa6049701cbc01b0fa9cb148977b8.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c4eee8-16e2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772529785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529785, "uuid": "04bac5f6-e6b8-4329-8a12-760e6e2cff3f", "comment": "Malware payload", "value": "a2d76787213ae8c1dba3ee79328cca21", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529785, "uuid": "9fd31f1d-765a-4c4b-87d1-728c1fece736", "comment": "Malware payload", "value": "6cc4b9b9e5b56537ee5d28508af78bd06102334eeffdf4ac1454ed1ce6a1693e", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529785, "uuid": "f66559e7-16bc-43f5-9b6b-746c17523c4a", "comment": "Malware payload", "value": "4c980b5792447adb3baaf6e917a687ed629eb369", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529785, "uuid": "cc4016df-42b7-4b1e-9a4d-8009f5932ca7", "comment": "Malware payload", "value": "123526d068612176b5fba13f3b5af102a45f2e3fafb184d5da0108f36ed41eafb88e5ec871352765eabb230b0fa9127d", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529785, "uuid": "93a50c91-6060-423b-b0d9-04a3668c3403", "value": "T15D972309EB1CE82FDDF3B07D8E194232701EBC259641D797A805AA6DB9D37C84E1A7D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529785, "uuid": "e9567260-475a-41fd-b581-bc490efcca8e", "value": "786432:GLP+2s1oY3CO1v4Qc+IjuUWxlpQJzM2Rh5YG1nZLrCHv1Iq:GbY3n1v4Qzg7Wxl/IOqnZLeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772529785, "uuid": "cfb1b66d-2c92-4616-a89e-362a0b60c313", "value": 41730859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772529785, "uuid": "6f518d4f-07f4-44fd-a26c-9e38ad3c71c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529785, "uuid": "2357be12-b197-4b22-97cc-ef98c2409488", "value": "Phone+File+Cleaner_1.5.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d7101a-16ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772542246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542246, "uuid": "0835373b-9be0-44f8-b92c-fecb10d11654", "comment": "Malware payload", "value": "889d9972435d453c9f7ef37a258f8970", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542246, "uuid": "1eafc4df-bc58-40b2-840e-de17a2fa5fa9", "comment": "Malware payload", "value": "6d03e164fcdf457b0acd581ec4890dcb489a842335aa0209a745adef4d38fb41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542246, "uuid": "38ead977-ad28-4fe4-80ac-13ead7bffce4", "comment": "Malware payload", "value": "66dc8af930f26e4be912fee3989f495d5d08d08f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542246, "uuid": "6e9f0576-0b4b-4ed9-b80c-32a3cd0ff3ac", "comment": "Malware payload", "value": "8f2b8667004d2ba4b808c3e0cffa0364af7bce4a79c84f5ab84f1be125ca87db718b4ece405bb2c44f3b2726813cad29", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542246, "uuid": "082795c6-62b0-4254-bc54-6b382ea00e61", "value": "T12DC55B71F79BC12FC56209F1A62CC6DF91696BA11F6240C753E82D6E58B88C25332E37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542246, "uuid": "5b43529e-cdd1-4cee-9140-5f75aa754f0c", "value": "2565cbd2a560c6b3554de2985322d883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542246, "uuid": "0d2dd47a-99f1-42a6-abdd-e274923b39fa", "value": "49152:ZfImZfi2k8XXSSRrHWaVFuHT8xyMdVh5JZAa/rvVUD/Va+FN/BJ9+mIY:ZImZBk8XXSSRr2aVFuHIxT5J9rt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772542246, "uuid": "c713b116-4607-4bfc-9d35-d10367039b12", "value": 2678784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772542246, "uuid": "c38a38d8-2dfd-45ae-83b7-12174d50090f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542246, "uuid": "db893729-4d1d-46c8-8b05-a1ab8e5756a7", "value": "V-Lover.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ad9462-16d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772524415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524415, "uuid": "d3db4e0d-f5e5-4d3a-94bd-d260107e89d9", "comment": "Malware payload (Mirai)", "value": "9a0e13b077a7ac68b0261074542c79c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524415, "uuid": "d5658e3d-84e7-4dc6-9d86-1a2ca954acd8", "comment": "Malware payload (Mirai)", "value": "6d088ec98a0223b9fb5c9372e78397c97f8a02e1355b46ccecf75d487b68db47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524415, "uuid": "14081c60-e628-47b3-bdb4-d42d6b38836a", "comment": "Malware payload (Mirai)", "value": "e6ad31cb3fb580e3c75345e3c0f898738c3d3914", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524415, "uuid": "0ee7a8c8-d1c7-4b4b-b524-c44ea637ba30", "comment": "Malware payload (Mirai)", "value": "5e3e8375277d508e182fc6f704bcfa852fa064ac7f7b18a86a7325687bd6d0db60647476f285cc2f888f9d31841ec0ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524415, "uuid": "55445e81-55ee-4cbe-a183-5665762b8ddb", "value": "T179A3720A7F610EF3ECAFCC374AA92B85148E651621997F75BD70D818B60B24F19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524415, "uuid": "254e747d-1da3-4bc7-91bb-ad9c0bfec224", "value": "1536:HIXNqQL2f/0poEgA1A3LeZjeUoo1/OK9SZBqifJ7F:oXNqQL2f/0poEBA3LDeS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772524415, "uuid": "f43bc1a7-dca5-4504-8541-ede3df35e619", "value": 100552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772524415, "uuid": "e80f0ee5-a0f8-411c-adda-97007eb383f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524415, "uuid": "c985788b-e047-475c-a0cf-e448fe60d484", "value": "nullnet_load.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92027c00-16e5-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772531067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531067, "uuid": "806dd13b-33ab-490d-9694-b08e092a6bb4", "comment": "Malware payload (ConnectWise)", "value": "cf6415c6d1b9ccfd560c48153078b7cb", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531067, "uuid": "44a06d35-07c3-4397-8fde-9ec8f1ed3430", "comment": "Malware payload (ConnectWise)", "value": "6dac87f7338571b0dca5cf1887cf072802841ab9547314c638bd46b8ae315ab1", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531067, "uuid": "ff44513c-febe-4832-a1f5-66136a737469", "comment": "Malware payload (ConnectWise)", "value": "8ac9775306e9f0381c81097766fee7351816faec", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531067, "uuid": "d37681f1-a3ab-4dd2-b333-648fe2e19603", "comment": "Malware payload (ConnectWise)", "value": "38289c6980c9ad4ae4f885d8bf01c5f45372db9845ceca5cf17ad2c71fe38602a1e1c4b1bf71eaaac6bf94bf226be41a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531067, "uuid": "e2c6c8a9-ad36-4003-9803-e880b22a224f", "value": "T12ED623116BF89678F0F26A35E876A075E5377C129E22D12E2364791E2C75EC0C9A3733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531067, "uuid": "5c14685b-5ec2-42e1-bf5a-d39db063b397", "value": "196608:5Hxcp9ym3nltDUJVAHxcp9ym3kHxcp9ym3/Hxcp9ym3fHxcp9ym3JHxcp9ym3sHP:LGplpzGpCGpJGppGpbGpKGpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772531067, "uuid": "fdaa00e0-ea15-400b-ae7b-e17434fcefb5", "value": 13541376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772531067, "uuid": "672e11b0-290e-48cf-8f88-c996ecaf90b0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531067, "uuid": "d725247d-11e1-473f-8d1c-54f173423289", "value": "Mr3!26.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "907b8020-171a-11f1-a769-42010a9c0008", "comment": "Malware payload (Babadeda)", "timestamp": 1772553828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553828, "uuid": "49422bb3-b75a-41a8-9f7e-89c25b8e9c7b", "comment": "Malware payload (Babadeda)", "value": "a5a28f826c387c49e2e7bd353948d3dd", "object_relation": "md5", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553828, "uuid": "7aa403fd-353b-4b10-b33f-dfa967745ff4", "comment": "Malware payload (Babadeda)", "value": "6de74d9e38c026c4f3c4181545a8e92ffd35e6a5caa10619e362e258ce26fc89", "object_relation": "sha256", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553828, "uuid": "83740164-004c-43ff-8adf-f51fbead4268", "comment": "Malware payload (Babadeda)", "value": "a8cc5ef2f1571bc073f5ec141b8047b6572e65f8", "object_relation": "sha1", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553828, "uuid": "36b91dc8-31a7-44f7-a2d3-dfd59212786b", "comment": "Malware payload (Babadeda)", "value": "2bdfad85ecd6fffdfac7f9090a7a1c9620caab99b6beadf73c3ac9d666a6d5acce5e402556e2defcf1a9e94b5d3bc1b5", "object_relation": "sha3-384", "Tag": [ { "name": "Babadeda", "colour": "#2F44B8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553828, "uuid": "1cf4325a-18ea-4c55-998b-c7a37333b784", "value": "T16AD533797DCA83B7F5BA083300E06559BB613400EB61AFBBD728BA1292817C5D17D3D9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553828, "uuid": "bb90d78e-ae49-4e78-837d-6848fb9c12ef", "value": "2c5f2513605e48f2d8ea5440a870cb9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553828, "uuid": "08c75581-38f4-43f4-b8cb-73c18a19b1a6", "value": "49152:eS2Tv+4C9l6zd24gHlfBtu4O1MM25DofjNhxSprkA7ICZPWk8sbvVtOiYT+hF:30C9loiFfBs85Dohh4p+C9NhbvVtO5yL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772553828, "uuid": "2c8908ae-c71d-4a4e-b048-911b9ab1b94d", "value": 2761728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772553828, "uuid": "fe56b4cc-7e1c-49e2-92db-57cf13332571", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553828, "uuid": "666309ec-61fd-44b2-bcb7-89185647a6cf", "value": "run.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f6bf20-173c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772568566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568566, "uuid": "d9772340-0622-49a4-9e64-91210617c9e4", "comment": "Malware payload", "value": "524b2a63a15a6ca22750112e9c580b73", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568566, "uuid": "e9329073-9bcc-4acf-878d-0c435b2bf834", "comment": "Malware payload", "value": "6f4273c7f5d3c19365f05e95399140916d83e1d300b9ae652e93a3e6a043b509", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568566, "uuid": "3b3d2494-86a2-4d26-9897-05b5e27846c3", "comment": "Malware payload", "value": "f8b8dd253a7baf2bca07ec62dd34281fb40e0380", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568566, "uuid": "58590b29-0054-4271-afc7-b23bc0360a8b", "comment": "Malware payload", "value": "5b2d22de660377fd9824d6f80f1ee84ed0661b4aa5328f25f85a2aaad1200df8c5d81f6c84ab640a3822fc2255842c09", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772568566, "uuid": "c0af44fe-830e-49f1-8bd7-e6803a7d05ef", "value": "T112863335F0A909D2F47BDC7EE2F32945C3D7120DE897D47A8180B9C876E538909D8A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772568566, "uuid": "56d890bb-7418-48b5-a503-82573995296d", "value": "196608:xHXUnZftSF0whOJzc67Rg7vmj0uU+HB/OGUElH6XU8YYl4:xEnBchOD7RgKjrU+h/PUEl0U8YYl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772568566, "uuid": "ca602a48-ea25-4c95-95cc-def17448090f", "value": 7880711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772568566, "uuid": "d72f80b0-7790-49cd-b059-75c71e09c683", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772568566, "uuid": "df8fa17d-2359-42e3-9fb5-236a77d42e36", "value": "bkmsiqop.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ba862a-16cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772520652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520652, "uuid": "d7bd5d9a-c86e-4796-a1f4-48d5c9dbc643", "comment": "Malware payload", "value": "51d5c419aebb671941c84e7f05fd8262", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520652, "uuid": "c5daed74-02cc-4dee-8fc8-777c79ffcffe", "comment": "Malware payload", "value": "6f8309814c6c83591014ca5e66475c20e6728dde9efa033aa185d20610a2e012", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520652, "uuid": "eb11da48-46da-404a-a2b4-044eff3c6ba7", "comment": "Malware payload", "value": "0922ad5e693e9efc33288fcdfa2bc07e561d8313", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520652, "uuid": "1d399c5f-6272-4aee-83dc-1869b72d098f", "comment": "Malware payload", "value": "024c9f5b17896f6045c563b9df65451ad68dabe9b3f17f37ea1dfa32c5df400717819ab2669b5f81259a2c57a6baa520", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520652, "uuid": "325d3c25-8221-4bf2-a629-cd0c8931bb38", "value": "T1E73544B474737C87D873A643928C254EAF5176C63102A438F596F3E7893A91C83EC7A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520652, "uuid": "00a999c7-90b8-4d08-b6d5-bf9b63b41990", "value": "96:r333333333333333333333333333333333333333333333333333333333333330:PFyB/4utl3vrr/u79ljOhJ/X4xfa4ox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520652, "uuid": "720ec3f3-17b9-41a1-b35c-687c0d1b63df", "value": 1142120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520652, "uuid": "3877f510-dc37-4294-b6ed-1c15641931c2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520652, "uuid": "e619bd19-b44f-4445-9ad3-5cc7fc9dd500", "value": "6f8309814c6c83591014ca5e66475c20e6728dde9efa033aa185d20610a2e012.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abdfbf9-16cf-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1772521579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772521579, "uuid": "57c2443b-ab86-4aa1-b658-77f0162232b5", "comment": "Malware payload (CountLoader)", "value": "13db8467d59cea4dcbe1fa8a5ccd2c90", "object_relation": "md5", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772521579, "uuid": "f514d7e4-8ada-468a-af42-af3cfa71f8ba", "comment": "Malware payload (CountLoader)", "value": "7016c7e011010d1a3d80a1b2405283e3e1f4983625f4e87d36009d7c91cfb11d", "object_relation": "sha256", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772521579, "uuid": "c5453b00-30c6-4ae0-909e-1871f317e3b5", "comment": "Malware payload (CountLoader)", "value": "27c3cb0d3bff8d8bcacf394f53151d79d53e769a", "object_relation": "sha1", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772521579, "uuid": "0faaa144-a603-4c18-a162-6af5aecc38ca", "comment": "Malware payload (CountLoader)", "value": "e5a5e4081598299894f2da03a6df344ba042172456bc6d8a0905bce5c664e8de8ac845d26fe4900d0fad0d9909e595e3", "object_relation": "sha3-384", "Tag": [ { "name": "ascii", "colour": "#26C43A", "exportable": true, "hide_tag": false }, { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772521579, "uuid": "e20e16ba-6178-477f-9f9b-b80bd78bcb32", "value": "T13BB3D29C07CF03E19E63A4C48ADBA506FB691517052CD68C7B2DFEF12F105AEE0E5299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772521579, "uuid": "9bf6954a-47f7-4bcf-8232-ccee8f3c3b2f", "value": "768:NVwvOv9shqTNEK+ggbSPC1HWOeB8IESyZPF0cJqB4E64nH3ovu6GdFxL2prSz8wI:3wv4922Cue3PF5HAYmjdFILwasiTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772521579, "uuid": "37f3587a-c4de-467a-88ae-3fc10a497a82", "value": 116644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772521579, "uuid": "b426d081-6dd5-44af-99bb-d20506eac680", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772521579, "uuid": "e92e7f1a-b871-4bf7-9987-3d6f5464d7b1", "value": "file.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cf337fa-170e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772548641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548641, "uuid": "0559934c-08e8-4a36-bc51-f5658a9b6ce5", "comment": "Malware payload", "value": "6c23915f0bad2816812e206f61615869", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548641, "uuid": "af002225-1095-42d8-b1ea-761fad5e353d", "comment": "Malware payload", "value": "704aab9170ab6f49a3918ad10aba0b044c8cc2d1288f348bfa5fda80c999a151", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548641, "uuid": "fcd61503-f514-4200-9f65-1e08f088cc03", "comment": "Malware payload", "value": "c63f46bd04197e078ca455fcc655f9bb1c6a4178", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548641, "uuid": "c78b7a44-7a66-4db7-b724-2115e6ac0d78", "comment": "Malware payload", "value": "4e83b59a6ed24f4bdc06ed7c443300dfd792afa560a26c71384d353561223e0a5e2fd7e0fc82cd39dc7a3fc1d3154465", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548641, "uuid": "94f9afbc-2157-4f7e-a93d-fa6e73b18ce9", "value": "T1A6D2629D3ACAF168033271372A5BB51AE0BF2C85744C9654C3A5BBD4FCAC718E0B6D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548641, "uuid": "e5730478-740b-4ebd-9a59-8d55f64b29a8", "value": "384:3MQO0pNnkcXnUVIn45QfG0VpfK0WTccMtWIhAisNvfSFbL3Ygo81w0NFoREu2jJ1:3fOs+06y4eeT681OxoEw0NrPJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548641, "uuid": "87dfe31c-9efe-45ac-8369-1cf23b0403f9", "value": 30960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548641, "uuid": "f5973c16-5ea9-4d57-a9a9-b9dda2fec536", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548641, "uuid": "f4b6e49a-fc64-4272-81cd-29e53400d9c5", "value": "6c23915f0bad2816812e206f61615869.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b0a8666-170c-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772547618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547618, "uuid": "e1383378-734d-4369-b872-a80a9158463c", "comment": "Malware payload (AmateraStealer)", "value": "76eacdd3d3f79114da03a8d12324a354", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547618, "uuid": "17fff30b-83be-4da1-8f61-64e710002c1e", "comment": "Malware payload (AmateraStealer)", "value": "7081ed638a67a0f5cf95948e4b63444da033787c10a5896688fd8ae93777856f", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547618, "uuid": "25762095-0107-4b02-9450-8b86d640843b", "comment": "Malware payload (AmateraStealer)", "value": "e26d6b96d351adb580a814b454d41477050c134a", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547618, "uuid": "9e2ae371-9bf4-42c1-8f95-99b9e9089624", "comment": "Malware payload (AmateraStealer)", "value": "3a485b31fee7e64697b869191c219d2129ecb421ad01baf1c14a8c87a8a665ac20a34f309c995b161596770ea69ac0ac", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547618, "uuid": "dc3d2ab6-83e2-436e-878d-c15d97512e01", "value": "T1DE167C13F349653FD06B1A3B683F9654583F7A7029178C179AEC3A8C4E791802E3A767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547618, "uuid": "a7ddb24d-b8fc-4818-b939-1c149f3a1991", "value": "adcd9682585d11d95f17bb6ffa76f15e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547618, "uuid": "4ba80a96-9f7a-41c6-837b-a4ae2043dcb5", "value": "49152:y44B+lNsHPWeelGdwSxQRw9CuL0wijepA8oGd9Tg70aQ1pkfX333bNwZX20dLY:pIPp70wijepoGzgIAX333b7q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772547618, "uuid": "916fd097-a0ea-4a99-a7d0-879f54ee6f4f", "value": 4122376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772547618, "uuid": "b629389d-90ed-497c-99dd-b818060687f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547618, "uuid": "0361291b-88ca-4ff7-a962-082e38312e65", "value": "76eacdd3d3f79114da03a8d12324a354.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a3a9ae-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772519027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519027, "uuid": "13db93d1-c173-4dc5-bd6f-9c421e03dbf2", "comment": "Malware payload (Mirai)", "value": "129c0cc64b3a0648dea0fee5451a9027", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519027, "uuid": "390051ab-7a40-4a23-a35e-fac641c7e6e6", "comment": "Malware payload (Mirai)", "value": "70abbe15514bc803b05cfd3bf042fe4b055ae2b87c968ffae1373a25ed623978", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519027, "uuid": "767113a9-9f30-441d-9ebb-23dd67896dfa", "comment": "Malware payload (Mirai)", "value": "9f7ad6a1e86888e90fecdf5b841449571cbeb5a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519027, "uuid": "bb328413-bb41-4c75-a8f5-e5ec609d2e18", "comment": "Malware payload (Mirai)", "value": "02da750937eb9a99049f0b27a31c794cc186e325820f95ccd6fa26b02f775f74598130bfa39887e49885c0d50be16982", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519027, "uuid": "df81b3d6-351c-435c-adcc-755760b84ac4", "value": "T173831882BC40E616C7C01677FE6F108E331567DDE1EA7242DC251FA07A8A91F0D6BB96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519027, "uuid": "4445449b-51df-4a5c-8e35-d9c44730950d", "value": "1536:IfpkKEekyI+22YKwUh4VXmmMUt652hKnBEXB8t46IdsPzJ5T74:spk9ekghSXQbqR84vdizJp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772519027, "uuid": "a172c532-e6f5-4c9e-a1bc-65aea1f8a937", "value": 83020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772519027, "uuid": "c5fd4387-5985-447d-982e-7583bcb2b144", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519027, "uuid": "d0e0b35a-4169-4fe7-a607-7603ce2ccabf", "value": "nullnet_load.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ff1cc0-1729-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772560203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560203, "uuid": "33777867-417e-4c0f-bf64-65972c87d1e9", "comment": "Malware payload", "value": "03108548205773672b1f9a340a4658a8", "object_relation": "md5", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560203, "uuid": "baf70fef-5337-4a0f-aa8d-1853a7b532ee", "comment": "Malware payload", "value": "7505c991fedce0cec185a68e50aa6504039d1ac36351d9cbfa3910bc8b8cf036", "object_relation": "sha256", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560203, "uuid": "c6f4dc2c-4a1d-48e1-b90f-7b132167ec44", "comment": "Malware payload", "value": "c69aa0a251d2e9b7a0e26920206a92741d95439d", "object_relation": "sha1", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560203, "uuid": "ec3caf02-070b-4468-a60b-9c52d550baa6", "comment": "Malware payload", "value": "89e70e03d38db5ff250716c2662db291bd9ec6ac62ec0a1d027baaf150aefa554432eb4a79e4f631d1fc42f3c1d4d18f", "object_relation": "sha3-384", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560203, "uuid": "dd71c559-a715-49ff-b0f2-4bfaffc162b5", "value": "T1E7E0F11178C8D0DC250527CAA248C359A4E340953F08F4B21B49C7DCF54323103984FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560203, "uuid": "322ff838-baf8-4a97-921d-e75b8320a0b5", "value": "12:qRHNkuqrw6s+2Fv7UxMbedO89ojALqWNHF8E4:qrkRjD2FvgWkOpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772560203, "uuid": "5783664e-3bdc-42ad-8da8-bcdff8f2fd7a", "value": 405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772560203, "uuid": "424ad086-b621-4845-b8b7-7181754327ec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560203, "uuid": "ca6ec1cd-7223-41f0-8ef6-6cced085f6c9", "value": "7505c991fedce0cec185a68e50aa6504039d1ac36351d9cbfa3910bc8b8cf036.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9926a0e6-16d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772525066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525066, "uuid": "0c989593-a6fb-4d5e-9cc0-21f27c454ec2", "comment": "Malware payload (Mirai)", "value": "4ff272716f4f8123d63b1da75e132fae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525066, "uuid": "c0dd01f1-f5db-4fae-87d0-679a5ee35d4f", "comment": "Malware payload (Mirai)", "value": "765369623f5d00b45c21af0a064755157cee636712c21665f1f988696061fd3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525066, "uuid": "a0d17d61-6db1-4656-a6cb-2b28d08dccd2", "comment": "Malware payload (Mirai)", "value": "4a5bbff7001755c25109f04f41461a8380fdc50d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525066, "uuid": "58f1efe6-081a-4a7a-ae0e-314795dd994b", "comment": "Malware payload (Mirai)", "value": "9379bc843c8c32195f8e4b0a398c26f4cb2915fe3b2357c60ff277f37ab14ab3a775b2ddbdccd31de04929f127df2651", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525066, "uuid": "1b6ed665-4f4d-46d7-8be8-fcde48d28d3c", "value": "T1B4737C21AC792E06C0D4D5BE12B7C7A5B2F9270F24A4CA6D7E310F8EFF505D4A6066B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525066, "uuid": "686b5b3d-691a-461f-8e99-b113c9dd10a2", "value": "1536:124IV9x73W3JiITFqO5r5CsPdsOea7VY7R4:h4bZoCsPdseVr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772525066, "uuid": "e170d2a8-4ff4-4f43-9a7b-221fb68b71ec", "value": 77248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772525066, "uuid": "eec50a3b-a586-47a7-a3e8-45828fc18869", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525066, "uuid": "500d58e3-67c2-43ec-a8c3-63eb7e370c47", "value": "nullnet_load.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4143dfae-174a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772574311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772574311, "uuid": "1fd50243-8c66-48de-ae8d-afa4f6e0eaca", "comment": "Malware payload", "value": "4a2e5a268b422b207f87ffeeaf83fbf1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772574311, "uuid": "df464f31-68be-4863-90d5-a338b9e3c53b", "comment": "Malware payload", "value": "77a2c2761bd439548177a36b6a10d8979c0e41d2cf3c1c98329307cbe5251ab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772574311, "uuid": "f3cabc0e-1f21-4ed3-b331-a75346e631b5", "comment": "Malware payload", "value": "f2aefc8b54f7540ebf975e466d272ae836c42cbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772574311, "uuid": "919faa83-a776-45a2-a23b-f62555f84490", "comment": "Malware payload", "value": "0da4c26d03c745d80af6d0e5000494182540ca80bf8ae208d718663fa12a97e35634bd06bc6e4927aa2d8ff512511aef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SmokeLoader", "colour": "#406E43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772574311, "uuid": "d3e8f8d3-5e96-4506-8521-c11323978524", "value": "T16A242A2AF25B61FCF753C07C83667232A532762B07349EF74293D73016329D26A78969", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772574311, "uuid": "ceede715-d15c-4e84-ae16-e9249065c765", "value": "c81db0a320cdad5ab41c9a291ea9b6e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772574311, "uuid": "3c125296-23f0-4ee8-baa0-c764201b4483", "value": "3072:qdypFAKxVbtEgCnCgnhZRsdAzjqVP72+cjvF9OKG+BIbYqwvCcH9ZWBGJ:FpFJxVbqzn7nZsdAzjOj2lvF8EIuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772574311, "uuid": "12debf54-04c4-4363-857b-7841bcc39984", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772574311, "uuid": "58954977-2381-4748-85b2-ca4470f7514f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772574311, "uuid": "8cf4ce00-38d0-437f-97f9-75626ef71d21", "value": "embedded_payload_decrypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88cb784a-1700-11f1-a769-42010a9c0008", "comment": "Malware payload (RedLineStealer)", "timestamp": 1772542648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542648, "uuid": "9ce16c0f-7973-45ad-99c5-7840c4a89ccd", "comment": "Malware payload (RedLineStealer)", "value": "e468fff11b549b11c889c92acdba3f02", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542648, "uuid": "0e08d330-26d9-405d-8aa7-4c5e73157bf1", "comment": "Malware payload (RedLineStealer)", "value": "77fb832052abc29f8392e50a83571fda0a9a44fc14c485bc9ae58b37ca51b00e", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542648, "uuid": "f975af16-a936-451b-97da-4f9f8e74fea3", "comment": "Malware payload (RedLineStealer)", "value": "2fd4cdb80817a5c671f2bc3cda5ff7440dc846db", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542648, "uuid": "9cbd1146-4768-4589-864b-f98274c5ca9f", "comment": "Malware payload (RedLineStealer)", "value": "5a04922d87c20edcb7b6db676c61d4e5583f4c5196a038931b7da76798f60cc3c484e475b68b20166b0453f6a31fe988", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542648, "uuid": "f3293c18-f5e9-4f77-a4d5-2670bea89d3c", "value": "T1F2E711F7CEE476A44768D1DAAE1A9059570513B0BC1C7BFB1C4C8E4A26AF6B43BC4630", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542648, "uuid": "28011ec2-f544-4a1e-8431-350481df46f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542648, "uuid": "5007b1a8-4180-4bb2-b6dd-76f0ae7cb6bb", "value": "1572864:sUwyhJYCe1tCwA83uUQVerfILuUn7mec:sx3vOgQV41U7Hc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772542648, "uuid": "d34fa555-7b3c-4ab6-9f82-a4f656f89d8e", "value": 69202944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772542648, "uuid": "145504b5-a234-4ee0-8d77-017f8535b515", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542648, "uuid": "a35f10e6-de0f-44e1-832e-b4aef1239872", "value": "77fb832052abc29f8392e50a83571fda0a9a44fc14c485bc9ae58b37ca51b00e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ede8d8-16d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772525697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525697, "uuid": "de14acd4-bc3a-491e-bea3-a4175b43ed6c", "comment": "Malware payload", "value": "40d059d501c09e61410957f76c4b0769", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525697, "uuid": "1d52cad4-f814-4d25-8bc2-6f45733dabd0", "comment": "Malware payload", "value": "793b9d915d2f412ad32d3aac486f17dd7b5014b86469b6a4540d559ee70a4d7b", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525697, "uuid": "f31dc078-35e7-40b2-9c49-75cf4a260cfc", "comment": "Malware payload", "value": "1a6e7a4dffdf13fd41a502a0dea98ed7d99907a0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525697, "uuid": "bcfecd39-2459-42a8-90bf-14de43f089d4", "comment": "Malware payload", "value": "18872354591714a4ee164ed31bd1f7d30d832ab888422373507cac03dd9486aae01f2b3771364b75b1f1929cc1dac27b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525697, "uuid": "6f909db4-d353-4279-962a-d4618c33376a", "value": "T13EE52345FE086D2EC5F7F074DC4181A59339B8199B469247A512233DE8BA6F08FCB3A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525697, "uuid": "ae52f08a-aee6-4651-b33c-d329a1e37461", "value": "98304:y9ZGC34cPbDhNzcDqaEsv2F1ac+OlZsOlszdxU:y9UC3RPfhNzAJEQ2msN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772525697, "uuid": "72c4b80b-0a17-4c75-b817-d4587ee32a05", "value": 3282676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772525697, "uuid": "caf61267-872c-464f-81de-1e496798c2b3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525697, "uuid": "76eabdd1-d383-4a9b-9cb7-a1d6058c563f", "value": "Video_020326mp4.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5143a0-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772518898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518898, "uuid": "a0306091-8528-425d-b6fa-2af64f1c0955", "comment": "Malware payload (Gafgyt)", "value": "dc4cd371c771d7fb69a856755712eac7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518898, "uuid": "0ff7c2ac-d2ab-47ec-afb9-aeb894cc2dba", "comment": "Malware payload (Gafgyt)", "value": "794b5e79c742d16b6a8eb5e25b580e328731466ff894a6ff1cd47e49e30ddabb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518898, "uuid": "e44ca8a8-68da-43a7-9581-08be86e5f823", "comment": "Malware payload (Gafgyt)", "value": "fd1eb4298c9d64f64272b32cfdb2cd1710def9ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518898, "uuid": "0e4f8e67-67e9-4df4-af69-81b12a6d1501", "comment": "Malware payload (Gafgyt)", "value": "bba292141f9973c5040993e77cb336fbfbc612c5e6fe5c2f2978661f0c193682a9a638a5fba7f52f333c904f8b55761d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518898, "uuid": "ccde8e7c-1e93-4f57-a0ba-4aabab6aafe5", "value": "T121735C456280D6F7D18316F1069BAFA8033AFD3A1ABBEE45F3587CF48B710847925719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518898, "uuid": "c2924200-48aa-4b22-b02f-4aaa15ad8981", "value": "1536:8p4uw66yastO49zyje4MkJLwDnOD8J52rf3BstzWT/O/sZw2U59RLZ5:8pV6R+x9zyje4MkJLwDnOD8mrfRSzO/C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772518898, "uuid": "74237fc7-ea02-490d-89bc-12317a77f401", "value": 74492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772518898, "uuid": "fd2baa10-dd07-4a5d-915a-71ee3c06e84f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518898, "uuid": "0837ec1a-2528-4219-8dbe-2f17b9db66e7", "value": "ftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ff6837-1748-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772573676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772573676, "uuid": "2b81222a-333c-4c2e-858b-8fcc568f0e64", "comment": "Malware payload", "value": "704fb67dffe4d1dce8f22e56096893be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772573676, "uuid": "965b39bb-b96a-4ee1-90e1-b0d85542518d", "comment": "Malware payload", "value": "79c2c656eac34f628406855c9fafe36161ac423c071d9b20b64f4f511c9ec241", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772573676, "uuid": "a0df2c1f-e8e2-4f65-8beb-721cc9097867", "comment": "Malware payload", "value": "88e345cd7b63dcc6f9559de4208d8832835ca6a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772573676, "uuid": "98c3728f-591e-457d-8747-2c050a5466c7", "comment": "Malware payload", "value": "fc9c4d96b686854e91ce8d6af308c81ccda169df4b11276e5ee725eccb9853106abea385fcf54d3a0f819c3c14816ef0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772573676, "uuid": "daca6f13-0150-439b-a560-98ced36ec16e", "value": "T16155CF0CF2A504EAD0F7D5F89F7ED702E67D3C2D2221E64A326716161E13691BE2A713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772573676, "uuid": "ec0dbe97-21d2-4bf9-85eb-c87baf57f005", "value": "b1c5b1beabd90d9fdabd1df0779ea832", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772573676, "uuid": "1436a36c-d2a6-4593-a656-4380e488c36c", "value": "24576:1uDXTIGaPhEYzUzA0nR8mtaeslFAqDav+n09I1jF5M1JwMB:IDjlabwz9IlvuvSK8jFG1JR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772573676, "uuid": "7544c4f6-6301-47d0-a88c-13aae173e20f", "value": 1317751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772573676, "uuid": "bb92dccd-f0da-4ad1-9635-e0edc3a271a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772573676, "uuid": "7ab3692d-2033-4bdd-94df-a80059df9eea", "value": "79c2c656eac34f628406855c9fafe36161ac423c071d9b20b64f4f511c9ec241", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ab779b-1718-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1772552741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552741, "uuid": "ef7c8595-90c3-4d1b-aa83-5e208024cc24", "comment": "Malware payload (DattoRMM)", "value": "72d8bb0459ec0adab6892dd91f87d0d0", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552741, "uuid": "4402b9d8-9269-4658-89c6-2acc944ee308", "comment": "Malware payload (DattoRMM)", "value": "7b40c7549945ff5d1cf91c37a39a97964e7bd0dfab9d4049a655943162268720", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552741, "uuid": "93225ef8-1c12-4e0d-92cd-fb15d083dac0", "comment": "Malware payload (DattoRMM)", "value": "6595db7cc6a686db44bc2aee41b373f503efe440", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552741, "uuid": "115028f1-4ac5-4cab-b406-ac8d2e60c1cc", "comment": "Malware payload (DattoRMM)", "value": "e83ffb5cb2e1811da67572bad3f0df3bef3e4372ad1b1b8e41767521c9d4af49eb47a2e89d968df963afb5e7d17fff8f", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552741, "uuid": "48ee32f4-3be5-4de7-9979-1c30f384999f", "value": "T1F6B63347D9778DF0CA330A3890D2196B3305980E485BF4C9F609277ADAF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552741, "uuid": "bc2499c8-9ff4-4e89-a3a1-a06385cee98f", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552741, "uuid": "36621723-4e7c-4486-9a27-68707e484091", "value": "196608:TaZk+wHP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2z:znWmzZFw5S9pE7Asjp29qIT0jarlZr87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772552741, "uuid": "b2bf8bae-a5b3-4e45-b339-6bf0c45f49df", "value": 11056120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772552741, "uuid": "231553ab-bbc2-4bdf-a7d3-04b12dddcd06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552741, "uuid": "e5c9fb74-70fb-4752-a409-a66164606ee4", "value": "AdobeReader2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89b4d335-16f1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772536207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772536207, "uuid": "90579aa3-cf2b-42b4-94a7-827bca53351f", "comment": "Malware payload", "value": "6a5583838661534baddf08816e7d5600", "object_relation": "md5", "Tag": [ { "name": "150-241-66-66", "colour": "#B04651", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772536207, "uuid": "8983ebea-a8bb-4e7b-8ffb-0ee956ddf3a1", "comment": "Malware payload", "value": "7b75cfc8d8f78028f5cdc2f03e4aa7be1ad15e567d227d353c6cbc2e378271ff", "object_relation": "sha256", "Tag": [ { "name": "150-241-66-66", "colour": "#B04651", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772536207, "uuid": "29a570c3-215e-4154-b3e1-389372261e45", "comment": "Malware payload", "value": "4984d677f493f4bb1d56214095b30874898725e4", "object_relation": "sha1", "Tag": [ { "name": "150-241-66-66", "colour": "#B04651", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772536207, "uuid": "652f41e6-21ac-4428-81ce-0ae2cff82ac5", "comment": "Malware payload", "value": "c282a2c6cfea19ec926c398ad5f9f675556e29840ec7dcff887d5105d4837fc93f7d1d8b7a81a3fc46d1ace86366caa8", "object_relation": "sha3-384", "Tag": [ { "name": "150-241-66-66", "colour": "#B04651", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772536207, "uuid": "4f68ee6c-678a-4ae5-8d23-49c34070a62d", "value": "T18721AAACAC198247568873F8BBF38758CA61B6973D67AB642541CCE0271C42C9A603A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772536207, "uuid": "c542db7e-7984-4dbe-ab6d-a2c125110405", "value": "24:1r5HLDad1pYdoFu6derKWNmC0I+1wgo6ki2nHz9:FFDw8x1B/0ISkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772536207, "uuid": "71478f1e-6092-40e3-b1e4-f4fb4f17be0f", "value": 1127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772536207, "uuid": "a0fc01f3-cb50-4fb4-a9a9-5ea6fb2ef0fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772536207, "uuid": "189e8778-a012-4626-99e1-d86b2892845d", "value": "1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ad81ad-1708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772546027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546027, "uuid": "7c8e04b6-9ec1-4ccd-a676-f52d869cc41f", "comment": "Malware payload (Mirai)", "value": "3e2f0732c3c659fc07f62dffd7f5d089", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546027, "uuid": "d9115f27-ee6d-44d5-bd47-e11d96274581", "comment": "Malware payload (Mirai)", "value": "7c3dd869293288427c5274e21c0613120b6224eed01c74b94f16d0cc68780fa9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546027, "uuid": "b408d433-5bd0-4b96-8977-9763db7af231", "comment": "Malware payload (Mirai)", "value": "44584f2074c2efcfbaf7dd013f85c45e107a370f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546027, "uuid": "61d97228-a6a3-4cf5-9621-b3f26ce07b85", "comment": "Malware payload (Mirai)", "value": "75bd153011d3ab446714781767a6590c84a95fc3186c382332acc797dd59c8d87cdac2c2450c6704564855b355a801ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546027, "uuid": "8074d3b8-3527-47c0-9b3f-ae09ca043faf", "value": "T14623391295BC2E2FD4C0A27611A34362E1FA1F859184E68FBD621D4FBF253541B7B6F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546027, "uuid": "6cfee017-3da4-49a4-9fc3-c32b7b028608", "value": "768:z4KgSLdXocLCvRliDzu5A+bJaD47SlXF0xOVMgS9g9VEMIZsTN:zNgSdXBLm/iD65A+bAH0xOVuCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546027, "uuid": "1c23580e-f6c2-4c7f-b624-74b48d3fe918", "value": 48848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546027, "uuid": "6b865186-c0a5-4515-b2c9-079a0aae37c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546027, "uuid": "657de607-2bea-4c80-a68a-d1fd861822b3", "value": "titanjr.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e6d096-16fd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772541320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772541320, "uuid": "8b025f06-d971-4ccf-89ee-d6f466151067", "comment": "Malware payload", "value": "62f350c9bd4815695e5fe4099211a3bb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772541320, "uuid": "95b3ff25-565f-4f8f-9289-43e7269ec827", "comment": "Malware payload", "value": "7c519ab5b4da70d36c04ed39744f99ceb52d877c107c45cf7f731518fcb2c2d2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772541320, "uuid": "14c93690-7d45-4d86-bace-cd0540f76d82", "comment": "Malware payload", "value": "684f6d61b87118381d670d995553b3fbb446404b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772541320, "uuid": "9a938a00-cdce-47c9-897f-710c566401f6", "comment": "Malware payload", "value": "4ad22e8a003af89e5899ed04823250de50d213691c0b312a696192c3f2d969da4f2095dd2ee1126ccd26eff5dfb74164", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772541320, "uuid": "dbb0d237-bd74-448a-9eb6-22df9e470591", "value": "T1DBE58D0BAD9118E9C06E97328DB7569A3B74BC0A0F3223D71E907A792E737D05E36714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772541320, "uuid": "93a38d3d-b60d-4278-abf1-99edfd422fec", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772541320, "uuid": "585f0b07-0fc5-4cbf-b6b4-6edbdfa94a93", "value": "49152:Bao7w5LONovfQqN0X/wZlJw0fw2DAqaDkeCvErOr:BaFaiM8SyADn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772541320, "uuid": "56dbff03-a038-4f07-ba33-edcb08a1303f", "value": 3035136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772541320, "uuid": "ddd2b5d1-3408-4706-a1f4-3630d409625f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772541320, "uuid": "855502b7-dc99-40e9-b4ca-42d4f4e10b4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6321c47b-16de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772527982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772527982, "uuid": "62576750-3a22-4b2b-bfd9-7519b68f900c", "comment": "Malware payload", "value": "9a03235a56f4c54aa8fe2eb2825d461a", "object_relation": "md5", "Tag": [ { "name": "77-90-185-24", "colour": "#B47C2B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772527982, "uuid": "fbb99c15-444a-4f40-b15e-1a563576e4ed", "comment": "Malware payload", "value": "7cc3e5a166db1a8fb0c183e5871535986d78cb3b96304222c3f9f71c1e2f269a", "object_relation": "sha256", "Tag": [ { "name": "77-90-185-24", "colour": "#B47C2B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772527982, "uuid": "03d752d2-4fd0-4802-b130-82559b93d33a", "comment": "Malware payload", "value": "39d4205b89d43a5ff7451042110eb55294e7e8db", "object_relation": "sha1", "Tag": [ { "name": "77-90-185-24", "colour": "#B47C2B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772527982, "uuid": "7175dcf1-ed5a-49b8-95b7-c7c9695771e6", "comment": "Malware payload", "value": "0d4403165a6d82653a3630a326897318f97ac46bf9ced12d5e9e92bfcf14c10f4ae067a359090e6fd020f48822723b98", "object_relation": "sha3-384", "Tag": [ { "name": "77-90-185-24", "colour": "#B47C2B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772527982, "uuid": "38602249-a568-49c7-b5e1-3d81cfdc49bd", "value": "T11D62D1E1FF4905CD80C9DAB07C3F9F86533D85FE0276AA0A6A802D4BD5804399E6637D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772527982, "uuid": "cfb95190-d877-429c-9193-5b2d742a2601", "value": "384:mNbXVI4aamq0tHhdj11j83tLuM4Bq8kgNi7i27CbFD+:mNbXW4aRhdj1StyMPxgNi7ifbFD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772527982, "uuid": "875e9e96-c946-4605-bd72-ceed236db737", "value": 15764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772527982, "uuid": "4a8b3019-f0f8-4215-b6fe-3a8758536442", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772527982, "uuid": "5c916732-6b67-4ce0-a705-2cb566638a78", "value": "59afb5496db1f96bfeab483e0dfb58e38204e4fcf4adae646ac703ab2cf62765.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51242a96-16a4-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772503041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772503041, "uuid": "f1d8e5c0-a7a2-4565-ac2f-94c4d4bb5782", "comment": "Malware payload (Mirai)", "value": "83afa382fb3da6449ba608ba6a5cb53c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772503041, "uuid": "e0175d57-58f3-4156-a298-886193db0787", "comment": "Malware payload (Mirai)", "value": "7ffd25afb89705b96ecee7716eff0900e3d7127b7552db3aac5ea6d983b88607", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772503041, "uuid": "670b3b8e-f1de-4d86-98ec-cf3673b82e7d", "comment": "Malware payload (Mirai)", "value": "22d9c3e3048bfb212215638980ddfc084e6b98d7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772503041, "uuid": "eafbf85e-4429-4ee0-8661-599e19d50df6", "comment": "Malware payload (Mirai)", "value": "c93431aca652297595f5b0ae6904aea198d10da32db00809b6e22c056911b4f5ac40f65ab44f90137921422e0d9efe61", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772503041, "uuid": "e112da71-bc2a-4868-8f37-01e53003f28c", "value": "T151F30745B8519B17C6C516BBFF4E42CD772A17A8E2EE7203CD256F20378B95B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772503041, "uuid": "f2882160-a54e-4f96-8d1c-bcaacd468ba2", "value": "3072:g7gKP19Kfqz6BGokiP5dY9oTpnR345pGoSTUwDpIH4:ERP19KfqzMGokiP5dY9odnd45QoSTUgf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772503041, "uuid": "b6071f14-515b-4bf2-b24e-eb8a7d95ebe1", "value": 161720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772503041, "uuid": "ba93adec-7ed1-49cb-b65a-527c97e1a258", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772503041, "uuid": "a2a867bc-2487-49fb-94b8-a27cd64df3dd", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3185dcb-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772519070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519070, "uuid": "83cf304e-7d36-4390-baa7-4df9a537483f", "comment": "Malware payload (AsyncRAT)", "value": "fe1fc5b31fb58378ed107ef930d271e3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519070, "uuid": "7651cfa6-3f14-47b9-be13-3d4d621bd08e", "comment": "Malware payload (AsyncRAT)", "value": "800d862ec650c0a31e564883c0235894f1846ea2cce7f8f70788ecf4fe7b09aa", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519070, "uuid": "691e65c2-b62d-40e0-8dd7-a7ce0bc9fc8b", "comment": "Malware payload (AsyncRAT)", "value": "44a83c1eab8f23084bbaab8b7771b5e6e2f6b937", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519070, "uuid": "af7419ac-b2d1-4c83-9ebe-30c9f2397e3a", "comment": "Malware payload (AsyncRAT)", "value": "f5e61b64c11bd07b93c29563e48a1bce5cd0291769196308d051061ef71dda2b90ebc8478b44b52fc2d2b992713cca7c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519070, "uuid": "38e491e5-42cc-4ed1-a91c-cff104efaaec", "value": "T184D23B08B3D88562E1FD57B94C7293048775EA4B9973DB9E1FC444AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519070, "uuid": "b5268d4e-1131-4ff1-90a6-a90e45461c35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519070, "uuid": "a9c720d7-e301-4216-bb96-eb2c7c30bf85", "value": "768:c8fRXNsH9aOQg/cIRGqom/Rb7fB/dTP/+:zfRXGH9aOJ1i4RbN/R/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772519070, "uuid": "fdeb7cb4-41ef-4821-bc33-db528bf207b8", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772519070, "uuid": "11f8ae6b-b1a9-4d59-ab28-d91cbec370f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519070, "uuid": "13f84c08-df33-483e-92b9-310862a6636f", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8929fb38-171f-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772555963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772555963, "uuid": "2fb19107-d8f9-4216-8e52-3dc194bc90ed", "comment": "Malware payload (Smoke Loader)", "value": "c70742a566b8b47c758ef69d310d7926", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772555963, "uuid": "d9df983e-94a7-4b12-989d-b392ddedab08", "comment": "Malware payload (Smoke Loader)", "value": "8068deb913b87d47ad5e3dbadadc8e8ea118e86bb0d80b87fdd74a383d9fa1dd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772555963, "uuid": "6c4b7508-6a51-4438-97fa-c17002bd5571", "comment": "Malware payload (Smoke Loader)", "value": "0288103f4109be32793f878196b2b8e7c4edf53d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772555963, "uuid": "ba98bddc-81de-416c-9cfa-e9e434e6f013", "comment": "Malware payload (Smoke Loader)", "value": "4d5b4e558bed7e6b08a7b14eb2f2d5fa4def4df845e0c592113be1a2eb6286252cdf0d1cc9fb95200245c0c91d4dfa7a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772555963, "uuid": "9ee97a03-b0cb-4e7d-868d-4f5d89a4a68c", "value": "T12FF5F1386EDA5133E19BFEB4AEA07511BF5879D2D1500CBC90F7698B0CEDA012D39927", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772555963, "uuid": "6f83ce5f-1640-42f5-845b-4263d1a7d9c0", "value": "49152:3AziROSQRaF1ik86WbgJ3XGriV5V2mHNMrElpM8gPErSZLtBEsrBETReUq4fZQtE:3ACMLlbuXGriV3HjlpM8g8uisVMRVZ5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772555963, "uuid": "f22c422d-f5da-4f18-95bb-3940844cce46", "value": 3645400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772555963, "uuid": "e00de68f-b4f2-4bbd-b1f3-43d1946a98a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772555963, "uuid": "b58bff9c-d0d5-4e59-b33f-fc6ee266b13b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9600eeb1-1700-11f1-a769-42010a9c0008", "comment": "Malware payload (QQPass)", "timestamp": 1772542670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542670, "uuid": "8516dde7-318d-49f1-8644-b2656b96cae0", "comment": "Malware payload (QQPass)", "value": "ba91bf8cf959ce66da9854747f5adb37", "object_relation": "md5", "Tag": [ { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542670, "uuid": "b642984d-89e4-44cd-945f-ae2dcc31f658", "comment": "Malware payload (QQPass)", "value": "80cc2e05768818efd119066e5581ed339c89096bcbb8afca541583deddb3152e", "object_relation": "sha256", "Tag": [ { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542670, "uuid": "b24f491d-b66b-4af6-b3de-6466db840e42", "comment": "Malware payload (QQPass)", "value": "185520c99c97d4097ba3ec3794992822bd980981", "object_relation": "sha1", "Tag": [ { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542670, "uuid": "ff081466-fe47-4a3f-8a3a-198cef95165e", "comment": "Malware payload (QQPass)", "value": "8f97125fff05d458655a63417c01e1d46be3a90267203f1f321bfe1367ab01b3ecd7fe063ee90df4520e4183aa12324b", "object_relation": "sha3-384", "Tag": [ { "name": "QQPass", "colour": "#57E1A5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542670, "uuid": "54bafbe0-62b7-47e0-8b49-6051ae4b7924", "value": "T11CA33A9F76E684BDFD14627418AB17B08677A9C0127A97CB3BD0CD79843B12A573C283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542670, "uuid": "e3e43146-5f2f-4aee-a7be-e61739a3f2b2", "value": "f24e64014af9015dc25262e5076fe61f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542670, "uuid": "b0d93a46-f97a-4a60-8a85-076159e09aa9", "value": "768:JgO5xRYi+SQvvG5bnl/NqNwsKVDsBYD77aXKynF0vT:eshQvoLqNwDDhCeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772542670, "uuid": "0cf4faf6-f5ac-4c6d-a8fc-d3309e27d3e4", "value": 106264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772542670, "uuid": "0876ab26-e9f0-46e9-a6ad-f44a1feaad02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542670, "uuid": "f09ac91c-7a6d-41c4-9f8e-db4e20134c00", "value": "80cc2e05768818efd119066e5581ed339c89096bcbb8afca541583deddb3152e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883ca476-1728-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772559827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559827, "uuid": "ad8a869f-8b7e-4cc7-9f7e-3c7a9b297913", "comment": "Malware payload", "value": "9a86cf6ccdd1024cc756a1c764d5f652", "object_relation": "md5", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559827, "uuid": "62b77301-1b28-4863-91d5-9a746c673b19", "comment": "Malware payload", "value": "80f6a67aa0282abe0920d7d3cf36d879eea6b01e34d50dc1468f9ac991360c5f", "object_relation": "sha256", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559827, "uuid": "00844bc4-924f-494e-a56e-8b2897a4b39f", "comment": "Malware payload", "value": "bd77f2d1804905699f872f5219b005b0f1bceb82", "object_relation": "sha1", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559827, "uuid": "484a2095-7b7b-43fb-866b-5c26d9af06a8", "comment": "Malware payload", "value": "dbfb822d82b9612ae36deda7958e9c10d91fecd38e66e5733067e85b503b979cdf4dc95de20750ae3896248cf9cb1039", "object_relation": "sha3-384", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559827, "uuid": "a5857b66-2593-4704-ae30-3083c4272654", "value": "T1EF33F2FB047C42D35F026A3F8EAA912F50F1CE48799823A5754FB3815D3662866371B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559827, "uuid": "5b170388-fc0f-4b68-87f9-f9b5beb5ec13", "value": "768:J+bp7kqrT4HE5rmUCsg+/PAQM6xI5nyCn3SnNUFmIO7Nxx1FpZhEX+qfMzjixtC5:S5rmUCsHgLF5nyzegxx1Xf8dfAjixtC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772559827, "uuid": "4eadd87c-906c-406c-9dc2-33bc846de517", "value": 53368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772559827, "uuid": "9f4056f5-ba7a-4bd9-acd2-5d67c08f52be", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559827, "uuid": "9584070f-3aae-4089-b81e-fdd90d8157c5", "value": "new.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d747b3-16cd-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772520793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520793, "uuid": "595cafbb-d19a-463b-9941-347f97175272", "comment": "Malware payload (RemcosRAT)", "value": "a3953ffd7828e7d679438b70b2747b73", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520793, "uuid": "65f6097b-6fc0-43c1-9ba9-1ab2e2f2c7b7", "comment": "Malware payload (RemcosRAT)", "value": "818ce6d4783106f464ea36b948c76de53631164b37e2189f5a689deab76f4494", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520793, "uuid": "6004ffff-15b0-4b6b-a5f3-90c1ce9f95d6", "comment": "Malware payload (RemcosRAT)", "value": "731c87650bff36fd457397d488f3443a3f922ba7", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520793, "uuid": "150ae60e-d639-442c-9c03-91eed0358490", "comment": "Malware payload (RemcosRAT)", "value": "fab2c429de3e64e1f121687d279bf84c113fd93826543ad16c38cac9f0c2a08baa28af1ba56a3b92f3a776dc691f1f6d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520793, "uuid": "0f935ffc-b3ab-4614-b68c-951b1ddb4ab0", "value": "T1AF64012BF664F10FD2A2153985D382DA2A71BC0BFA5957073F44FB0C36386E2F21525A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520793, "uuid": "0e370eaa-fb3c-4448-8f05-3a4b80d4b2e4", "value": "6144:Be86TzZIBeQigZ43YbTLeG61lI4UOMBEDFrp03bMcm9e7gA:BmTzZIBeQRaI3LeG61lI4oEZN0LT6e7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520793, "uuid": "ffe26662-d152-4321-8757-2f2b97cc8683", "value": 314368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520793, "uuid": "0209e7f8-21d5-422d-a845-a5b90339fb3e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520793, "uuid": "6f1a7933-0353-44d5-9772-0cb7dbf4efb9", "value": "818ce6d4783106f464ea36b948c76de53631164b37e2189f5a689deab76f4494.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6260fc4-1729-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772560334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560334, "uuid": "161c9dd4-d8e7-4a40-9e4c-21ea108a6aba", "comment": "Malware payload", "value": "4e3eabbe8398c1cf4da5dedb38c3cfcf", "object_relation": "md5", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560334, "uuid": "988301b3-e6c3-4b87-83f5-a559b7d36096", "comment": "Malware payload", "value": "81ef0a0821784a0cbd5914ac7b78fda3ec0ea7e44c22e5ffeee86af81888fba3", "object_relation": "sha256", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560334, "uuid": "57b5d622-8a58-415b-999d-e5f47a751652", "comment": "Malware payload", "value": "527939fdc083a4adbb48fb01cebee7ccbdf0c08d", "object_relation": "sha1", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560334, "uuid": "d75c34ce-60d4-4567-add4-3723d36c0203", "comment": "Malware payload", "value": "7c291e53648b52eb5a50cb64b6b56f8e0958a0e950fdddd3649a3b282b1019d06df2768f4d341871ddc865cedb52cd64", "object_relation": "sha3-384", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560334, "uuid": "a4ff18d0-c782-482e-8f69-65373c382948", "value": "T11FB01214D406929BD5027055A0D9D6A0BCC7814D04D3C5FA93438B1FE9CA5F2456C28D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560334, "uuid": "e4d22e8b-2f52-4887-b8a8-4743b4db941d", "value": "3:HRAbABGQYmoKz0+nc3M618PKgeIy:HRYFVmJVc3Z2ygPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772560334, "uuid": "999edfae-cdb0-4245-a818-3d414e077173", "value": 105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772560334, "uuid": "8e6455c4-e01a-448b-8409-827ec38f3f28", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560334, "uuid": "8f9c76a3-1ff6-491c-8345-93807955167b", "value": "Fac_2026_2254335867.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62de277e-1723-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772557617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557617, "uuid": "2dbca62b-0145-44e1-9f14-c4c7d9c753b2", "comment": "Malware payload (RemcosRAT)", "value": "d39da1e76c92e7c6541191e6f9a87ee6", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557617, "uuid": "1be90f33-47c5-40ff-8114-3bd8003a9d4e", "comment": "Malware payload (RemcosRAT)", "value": "824a89791735bd086168a07bb938b79549bd18587c6059ed316b9fb8add7a16d", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557617, "uuid": "702567cd-749f-42e5-a347-744deef42042", "comment": "Malware payload (RemcosRAT)", "value": "4d992c5294b2e53fa471cd89fd1160bb1a863352", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557617, "uuid": "9bd7e8ea-a8b6-4c6c-9e5d-951873945844", "comment": "Malware payload (RemcosRAT)", "value": "4c2ff1e9ee22f58600acfd6d612643b77aaf6cb33f134b5da5afa818191d23e781aea5a7659c44351de3f9696e4bd5f3", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557617, "uuid": "4dca7b7c-50f4-46af-a248-aaea13aa0b41", "value": "T190F1AF516670DDE8DC445FE2D8F1CB87350F12FB9D212AFA1AFD4299C786DB102519C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557617, "uuid": "51491869-e0d0-4cac-b710-32e747fb72bf", "value": "192:IsY+x6gElw7nChCWynxj02Z1kXrDXUG0gmDQQPS3w0mIY+:IsYC6gG2nGCWQ9TZ1srDXgkQPS9mIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772557617, "uuid": "19e63daf-d5aa-4b8a-a70c-17cdd2f175c7", "value": 7800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772557617, "uuid": "56b1cdd4-3898-4fb4-9fa2-4c9a7cf1d412", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557617, "uuid": "e1f02b39-211e-4a70-b68f-5c6c50940ec9", "value": "03032026_1624_NEW PURCHASE ORDERS @300499754.vbs.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9d0539-171a-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772553927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553927, "uuid": "cfc5347e-129f-427e-9e87-23f8808547ac", "comment": "Malware payload (RemcosRAT)", "value": "1e41cbfac881161d0bcbe6fd1f48a815", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553927, "uuid": "b6fbde3f-b57f-4061-9c3e-8223bb524fef", "comment": "Malware payload (RemcosRAT)", "value": "8262a999b922f4db69bbae6222cd1ba9862081306539cd1061e17085010cf89f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553927, "uuid": "4a94c699-3daa-4412-9643-442f5eb23b0d", "comment": "Malware payload (RemcosRAT)", "value": "600c85ff225cf21e97ffa07f5fc772559b0f1598", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553927, "uuid": "7be97e0e-19fe-4fb0-9ae9-65b42a550126", "comment": "Malware payload (RemcosRAT)", "value": "d1d31adce6c620ff7e5074e1afeea3f366c570599127253afd228a0abbfc123873afec000992f0517d1b8edefe5e581d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553927, "uuid": "4701c1d4-57dd-4f4e-a064-66c3e6fa26a4", "value": "T1A046126FD95B50287E708207FDCD61E92DA50AE6309BFE46496E83EBD703056424CBBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553927, "uuid": "616e2539-01bd-432b-abd4-90fb7cc84f7b", "value": "48:awfgC323ZwR0YBHplc92ZSpOHfZHLYcpwv9YtnYfWZjRCzCOxT58D4kH6KC2w2BJ:Nkq8t4MKNQ5dL/p+KUYZ4FT0bYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772553927, "uuid": "7390c343-fb65-4c8c-b78e-cbadaebda5bc", "value": 5599617, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772553927, "uuid": "95ac30fc-ef89-4115-a115-ab100027250e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553927, "uuid": "db8dcb9a-2117-412d-b6ba-26fd0f2c7fcb", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e960b5d1-16d5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772524342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524342, "uuid": "b9bae9ec-6715-492d-af3a-9026a9ab2c55", "comment": "Malware payload", "value": "9c6c67344fecd8ff8dbbee877aad7efc", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524342, "uuid": "3828c6e9-8d37-4334-8086-54a7c7381630", "comment": "Malware payload", "value": "83651b0589665b112687f0858bfe2832ca317ba75e700c91ac34025ee6578b72", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524342, "uuid": "46c21844-8de3-4225-bf09-036ab74f2374", "comment": "Malware payload", "value": "04ee8594b5101505b92e14777466a62a2f4a2ceb", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524342, "uuid": "80aefa24-e2da-4d04-8de6-04f158723cba", "comment": "Malware payload", "value": "deb0a55ce53bec60d12ed7c23e80ba2ae5a96b289afe31c1df0323f5a7ed606eb35ca6e1fd3fc1d3ae73721cf8f258d9", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524342, "uuid": "62d3a4ed-d666-4f7e-a163-1dda5eed73c0", "value": "T1EB373343F785E90FF0F7833A8A7A4561E5064C1A8B07EACB5988773D38B7AC09B456C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524342, "uuid": "f9adc714-b9e4-44dc-aac6-faa6362f8b2f", "value": "393216:IQNNTdIbeNstoGDcrz1RfPz3tSfygZ4Cgy7AJknQ7pAnQIBY:IY12tCrfrdSfVcEhdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772524342, "uuid": "74e0043b-eb8c-445e-b7dd-7a21ec0bcc7b", "value": 23240876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772524342, "uuid": "53163c1f-9a3d-4ef9-a384-de844a00795e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524342, "uuid": "179dbb89-4f40-404a-bf26-7620a9aea492", "value": "RedAlert.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eddbadcd-16e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772531221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531221, "uuid": "0ef3eb41-d188-4d27-ac84-b82e03723934", "comment": "Malware payload", "value": "2276c0cd166ffbdfd5c277a2f8e4ac7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false }, { "name": "www-msftconnecttest-xyz", "colour": "#90A83F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531221, "uuid": "38e95c5f-4f7e-4a4f-89c9-e18efe77960e", "comment": "Malware payload", "value": "837053b6a0c978e5e16716a947c1afa00aea8ba040a962ebaf7b0ab92794244d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false }, { "name": "www-msftconnecttest-xyz", "colour": "#90A83F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531221, "uuid": "5fec8b99-069a-4e31-bb15-05368546ea5f", "comment": "Malware payload", "value": "d87fdc43bc723609590c6e562947b11c5f0f0837", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false }, { "name": "www-msftconnecttest-xyz", "colour": "#90A83F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531221, "uuid": "7be5bb2d-d154-4c86-9d03-0ce55bb17e04", "comment": "Malware payload", "value": "a01e2b0130db8fbcd178750e2e4122f52cef8b62a728bd026547610b8e9ae9dca5edef30b2d00268b312337747fb9fc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false }, { "name": "www-msftconnecttest-xyz", "colour": "#90A83F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531221, "uuid": "64df3c55-75cd-414a-a5c8-c4c052b8f103", "value": "T110746DA5F75208A6C91FC2B805674576E5B73C604B448B9F2A14063C9E2BFA31F3DE8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531221, "uuid": "fa1d557c-fb2d-4ab1-b2ac-465d18c107cc", "value": "ccbe08e827b25fbfa0f5d6bf1c177d57", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531221, "uuid": "ccc460f1-2490-4009-be83-5bf5fffc61e4", "value": "6144:wYsX9ad3Xpmc/EwEXY4y/ELoPCkK1KFUw/iHJF1XIe:C9EEwEXDoELohyK68iHJF1Ye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772531221, "uuid": "2840d7ef-e262-4338-aa2e-9714e9856da3", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772531221, "uuid": "5275c2c0-2d67-47b4-bc2a-f6f2e58a7ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531221, "uuid": "4158362e-b302-4967-b96c-6a58580807ae", "value": "837053b6a0c978e5e16716a947c1afa00aea8ba040a962ebaf7b0ab92794244d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb87171-16e1-11f1-a769-42010a9c0008", "comment": "Malware payload (KarstoRAT)", "timestamp": 1772529372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529372, "uuid": "b5859ff0-3fbb-4ba5-b744-47dc0b007c80", "comment": "Malware payload (KarstoRAT)", "value": "f35cebd169a5751e89d7048a28ecace7", "object_relation": "md5", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KarstoRAT", "colour": "#8F853E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529372, "uuid": "e2a87ecd-d572-41c8-8dd9-f1bc45011b8b", "comment": "Malware payload (KarstoRAT)", "value": "839e882551258bf34e5c5105147f7198af2daf7e579d7d4a8c5f1f105966fd7e", "object_relation": "sha256", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KarstoRAT", "colour": "#8F853E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529372, "uuid": "b2e0fdf0-b774-4a89-8408-69aa3d23e906", "comment": "Malware payload (KarstoRAT)", "value": "2d32b10f191b3897dc4ab5041639f16e0bd75ba4", "object_relation": "sha1", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KarstoRAT", "colour": "#8F853E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529372, "uuid": "b74861c7-2982-44bd-87fc-27c13598e805", "comment": "Malware payload (KarstoRAT)", "value": "39f4caf5a2014c41e7e9a5cd38c5df150bd685f8c838240fd271d3d6effff6772008beebb9c612cc8a1daeaf9b874fb6", "object_relation": "sha3-384", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KarstoRAT", "colour": "#8F853E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529372, "uuid": "61eb0541-c867-4376-bffc-7f15a573919e", "value": "T1B5E33A2ABA151076D26AC178CD870543FB737C5943A1A7CF17E09EF61E23AD0BE7A601", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529372, "uuid": "47b39001-5489-4667-9e75-fbc0cce3f4bb", "value": "ab4214e84badbe2c73497d1c177d82ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529372, "uuid": "0459a00d-ac29-4ee7-8bfe-a646f1ddddb1", "value": "3072:IFv0eY/1RJENt2hy/5+Xkr76r5fKjZME:IN0b1RuNt0W3reVfKjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772529372, "uuid": "ee17e81d-6b5e-433d-a178-4d0c193841da", "value": 146432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772529372, "uuid": "eb57c7c4-6de3-4d20-a966-9bcbef616ea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529372, "uuid": "f9a786f5-a4c1-4c39-bdd2-49fce01cae1d", "value": "3client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d16dded-16f7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772538790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538790, "uuid": "1c3aef36-6994-4264-a801-d480809d5c80", "comment": "Malware payload", "value": "497c1ad79c4ef5425eb8a7e4f49efc8b", "object_relation": "md5", "Tag": [ { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538790, "uuid": "f2d6c921-79d3-4ee0-a031-430e54907102", "comment": "Malware payload", "value": "84378b3e87ca6b472847bf4a6a7a6d171b2d8159573a6225925aab89617e74cc", "object_relation": "sha256", "Tag": [ { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538790, "uuid": "ebf9a114-12a4-4344-960a-70cd50b11778", "comment": "Malware payload", "value": "01185318828ce07905ca20b8d8601284c258b1e8", "object_relation": "sha1", "Tag": [ { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538790, "uuid": "6e5b088b-38c1-48b8-b315-af80c64c691b", "comment": "Malware payload", "value": "2365f918957c9abd472bfd3f9d33f99007b842ab11cbe53a3b02fccf3ec09be307074d2e772190cc4d11270d0da2f1d5", "object_relation": "sha3-384", "Tag": [ { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538790, "uuid": "a48eab0e-e707-47c0-9610-a85c8a79244d", "value": "T125E31239F9C13357EDC508CA13D194D6592C7899702B62139CFAE58E9D3E8AA38B4C0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538790, "uuid": "40645a53-76e4-468d-8008-03ebb9ca9028", "value": "3072:0+mII23WU02AvjKmaqnQgjzIrrhlLAKleh7l3vP9FRcH9:0+lAKePIrHWhB339FA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772538790, "uuid": "aeaa64bf-3d18-4ea1-bcf0-beca8fb35104", "value": 152027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772538790, "uuid": "81a64e5f-0fee-4b26-8cbf-555fbbef9d61", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538790, "uuid": "e56a9413-b91f-473d-8c49-9782aa71c5f7", "value": "84378b3e87ca6b472847bf4a6a7a6d171b2d8159573a6225925aab89617e74cc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220a5b1c-1747-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772572970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572970, "uuid": "7aaab957-5e90-45a6-aaa5-8803ff1abc24", "comment": "Malware payload", "value": "70d673945bf1886217e0a869d4f93c8e", "object_relation": "md5", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572970, "uuid": "03710cab-2b2a-452a-88d1-e961fa939ebc", "comment": "Malware payload", "value": "8438567f52cfa8c933c8b39bd71712371728d1f755b703ef8394390353d55421", "object_relation": "sha256", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572970, "uuid": "4cb644a4-38b2-46a3-9c5b-d9f61e4cbb2b", "comment": "Malware payload", "value": "b2506e7e2d9fbf065eb591820c2dbc6e744d6112", "object_relation": "sha1", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572970, "uuid": "b986052d-9eec-4ebf-ba4b-4f64f945a60a", "comment": "Malware payload", "value": "16961f46f6c7bbde4aa41f67243c96ea01921924490f12249cc55e9f8c991d302d0c2e4009b6a1ce694706e2e3cea218", "object_relation": "sha3-384", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772572970, "uuid": "a4d05eb3-1fcf-49d7-bf9a-2c6a483ef662", "value": "T12BF0929BDEBA4B41E86E5B7958C902A790905A8A4113579799111A830AA17E21B03F2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772572970, "uuid": "11ac3d1a-5dea-4d2a-837d-9c0fb07a2fb0", "value": "6:5jwqPjlDacIP0x8ITyNsCOBxPR0IuAVarto2PpB4XE+tbakP0xZz0NtG81:5jxPjZaXPLdNsFWPXPpO0KakPo0NtG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772572970, "uuid": "a596e888-e247-414b-8870-a08c376d8c2c", "value": 444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772572970, "uuid": "699297e7-27d5-4042-87c9-241de562c921", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772572970, "uuid": "404e83cd-ef2b-4793-b35c-cebc8d260f97", "value": "Nuova cartella.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5826f23b-1704-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1772544285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544285, "uuid": "5291d13c-8d81-43a3-826b-695bc8f2273b", "comment": "Malware payload (CobaltStrike)", "value": "3394ce15331383eee6694e5c51016f26", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544285, "uuid": "29e1d5d4-b844-4bd6-b14c-8cfbfb426f99", "comment": "Malware payload (CobaltStrike)", "value": "8665c6898b572b340bb1f7dc251a54880c4072f360cb2320910d66e5bb8f9abe", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544285, "uuid": "d19e6e72-cf25-416e-9ff8-87bfd090dbaa", "comment": "Malware payload (CobaltStrike)", "value": "90433cf15f739ed9ad9e13678d8011d067646c80", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544285, "uuid": "39649bba-1f00-462b-9814-c6f4350c3579", "comment": "Malware payload (CobaltStrike)", "value": "7a7c39dd1648cbf0835c3ff34ad6837b11f959968289a34ad13d4d58927db30ea0ef59342bb1e1689ff95b454d2c9a9f", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544285, "uuid": "dc494f48-529f-4922-8ba3-9449072872db", "value": "T15794F150B4C0C032E9B215390AE4EBB45D3DFC701B64DCEB67C852BD5EA05E29A359AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544285, "uuid": "b38f0bf3-3fd0-47cf-9a82-3aa6ff40ddef", "value": "acd1d08703e972dc62c468aedd1b58fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544285, "uuid": "598985d9-8784-4848-a419-eb3d5b8d776c", "value": "12288:CztaSwOzsaoQKFAYhlEcbykVD6tfSsL3Vx3Jn:a9QaWF3RuwSSsJxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772544285, "uuid": "99044edc-abe8-4995-9170-6fdb261237c8", "value": 411648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772544285, "uuid": "40a51bf2-61d3-47a7-97ef-43a17873e8ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544285, "uuid": "7ee32546-d8e1-428e-bd21-752532a36144", "value": "8665c6898b572b340bb1f7dc251a54880c4072f360cb2320910d66e5bb8f9abe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5701e4c8-16cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772520660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520660, "uuid": "2761fe5f-2cda-4037-a4e4-8feb69b0b6e2", "comment": "Malware payload", "value": "87f94a7bb51ce3e7ea2dcb737d0da1ab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520660, "uuid": "3a02146e-2d19-4334-b432-4437cbbb8511", "comment": "Malware payload", "value": "8784bdfc859e2b4c189d41dd85a2e90241c7fe81d894b82c9fa8cd8204b46c93", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520660, "uuid": "c902bbc1-82ea-48bb-8d0a-01f6e0ccf04e", "comment": "Malware payload", "value": "2efbd1aea557913c944fcd455431ce16745dcaf9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520660, "uuid": "6c977586-d015-4090-9ecb-3bc560790f28", "comment": "Malware payload", "value": "5eed43de158ff961d5535dd9ac3d3abb459e9b66afbb8305c6206abc46609a4cebbbc14259c403c297c4c1c2d68ee2c8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520660, "uuid": "9b729bf5-d813-4b8e-be7b-63c14297b4f1", "value": "T1DE35F0737508C8F8F6810219ECFD6A449F684AA473AF0DFF94BCD7DA8CA3A485794149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520660, "uuid": "703627f4-8f0f-4138-8116-f8263e8e6aa7", "value": "96:g66666666666666666666666666666666666666666666666666666666666666O:8L/1XZhrdFUBxVcIORWSWgl2Mvinhn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520660, "uuid": "05972c4e-a82c-4a60-9529-c9c50fab611f", "value": 1123417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520660, "uuid": "70291097-74fd-47d6-b0e9-c50690a84d14", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520660, "uuid": "d16c95b6-88d6-4203-9bb9-13bd9b51f6ea", "value": "8784bdfc859e2b4c189d41dd85a2e90241c7fe81d894b82c9fa8cd8204b46c93.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfdab281-1741-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772570658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570658, "uuid": "9d07beb8-a377-464c-98d3-4e65c8a4daf0", "comment": "Malware payload", "value": "9511e7f16b3999ae3727e8318b80d277", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570658, "uuid": "59a00418-2ecd-400e-8500-1e14c519dc9f", "comment": "Malware payload", "value": "879089fee57b3b894aaabed768d11a289e8076252bbd9364cfb695e3c90ca5cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570658, "uuid": "c05cc225-49ce-4ab9-8b57-6da1902216ed", "comment": "Malware payload", "value": "1549db115037008d47653680cd1e893c9054ea48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570658, "uuid": "7ecd79fd-5190-4007-aab7-9be019baea5a", "comment": "Malware payload", "value": "011a2cdb272ab901140e874571673753f52a3fc9983dfdbc9ff41b30ef503a3e21cfe303a4cf7354a12b84489dcbd421", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570658, "uuid": "ff12d328-1ce2-43f2-b988-cc56a63dd0a0", "value": "T13F28E01663E112A6D577D138C79BA213EB72B807133087DB329C07662F73AE45E7A760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570658, "uuid": "dfbda0d4-89f8-4c0c-8320-bfe76855dd08", "value": "9eba512b03d8cac8a6c4424e25e9f06e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570658, "uuid": "3db8d0b6-c4ee-45e2-b165-f069912fde89", "value": "1572864:hVDG5MiP2aVxUXuNOXbcOSzFLVJRxg91/EPwDudxaUxRM:hVDG5NVyuNOXbr4vRxg91ydTTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772570658, "uuid": "3e4d42e0-ed62-43c5-b482-d1a2f895879f", "value": 96227420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772570658, "uuid": "1ffbe9c3-2511-422e-8da6-2256b36ca638", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570658, "uuid": "5d9e6d95-ff12-4ef8-a2e4-ca78c9924acb", "value": "UnityCrashHandler64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499d5f98-16e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772529228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529228, "uuid": "f427f0eb-15f7-4f98-8bec-237b36eb3303", "comment": "Malware payload", "value": "154e4d8f65e5ce80733228b70182f95d", "object_relation": "md5", "Tag": [ { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529228, "uuid": "4590f68d-ad2e-4fa6-a480-c53ad43390c6", "comment": "Malware payload", "value": "889ccecbf81cd04bcc4df73b015db81919334d85df1f1aed55896f331d36e1f8", "object_relation": "sha256", "Tag": [ { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529228, "uuid": "672c1d6b-ef78-4841-8fb6-a1fa09b21a2c", "comment": "Malware payload", "value": "114f30e063f3eebd24961a4934fe77a1a1afbd19", "object_relation": "sha1", "Tag": [ { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529228, "uuid": "d3a7e8dd-ddd8-4ad9-a906-f5afd76c25dc", "comment": "Malware payload", "value": "de6f28acd75f381df3f4891bb0c2efd46a34942817000c02e5137f918082b76f2b3283cd29fdd37e580eb2e9903e4e2b", "object_relation": "sha3-384", "Tag": [ { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529228, "uuid": "50cd1336-6ef2-45eb-b1b8-e7c1c9cc74b4", "value": "T1B0B6336CD77F0627FEBB2A31AB91CE1E871D87A52059B40F5F8D06D38C82590274AC5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529228, "uuid": "ddc7f289-370b-4c28-9a72-7f655844625f", "value": "196608:zYIfpCv4hVdVhPc0osM57wu9Qa3LVgIg+PpSpfVCSvGsedfpwecQX8U3Sx2ZD8eJ:zdfpCvMV/hPyNwu9FLVgf+Pi5eJdOec+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772529228, "uuid": "0d3610fa-60dc-449e-80b8-89325bb1d6a8", "value": 10541268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772529228, "uuid": "fc3c8975-5b6b-4766-948c-1fa88ba790c5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529228, "uuid": "255d5964-61a7-4805-a47e-fdaf4a20d4c5", "value": "889ccecbf81cd04bcc4df73b015db81919334d85df1f1aed55896f331d36e1f8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45116c09-16ce-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772521060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772521060, "uuid": "8aa9776f-454a-40d5-8c79-ebfd0f0c9f44", "comment": "Malware payload", "value": "9e1ddc5c3cfa45a739ef746254352661", "object_relation": "md5", "Tag": [ { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772521060, "uuid": "42334260-c774-430a-a2d3-7c6f0aad4748", "comment": "Malware payload", "value": "899ab6919b64f55f0db5b9fe929d85df8148454a1ae550256ae95cd9303051fa", "object_relation": "sha256", "Tag": [ { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772521060, "uuid": "c972491f-21b8-4919-a194-6f7af4c5d7d1", "comment": "Malware payload", "value": "6f42e3f8632aa922731835ad0b5212a00fc69455", "object_relation": "sha1", "Tag": [ { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772521060, "uuid": "b8b98555-7d68-4439-834d-9ede1f84ba10", "comment": "Malware payload", "value": "e55f24dc50b85504cac515ae1d6e219a6de501af7413ba96f4684a8bc3f3470fc243c5caaa7fa3d701010843985aa877", "object_relation": "sha3-384", "Tag": [ { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772521060, "uuid": "f031ebae-e9c8-4f78-82c2-3ac6d2cc9db4", "value": "T141A53306F7C5203A56E9D4B807F64789483B08E2756A7CB157827EF64A3DF4BE332528", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772521060, "uuid": "fa04b0d8-ee44-4832-987a-9a8e98483d6b", "value": "49152:Vbl8yNnnmGCRQUN31fKL1Pz+7IWqIeiCizjq4JbjD0TzzrEfS/LAnR2F0:VXcRQS1iLIMWqIeLi3qsXD0TACLAnYF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772521060, "uuid": "39d3a67a-ed64-44ec-87a4-d0a34a1ac2be", "value": 2128830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772521060, "uuid": "0791dd62-ce28-4b97-9a78-793b58c79499", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772521060, "uuid": "9340593e-efb8-4f90-8521-7eadb3386e57", "value": "img_184335.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0707082e-16a7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772504205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772504205, "uuid": "bc0881f7-1fba-48f9-90b1-452c682f3220", "comment": "Malware payload (Mirai)", "value": "264de251c123bc0bc41c7cf40a88719d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772504205, "uuid": "df6d15f6-7286-459d-ae40-06f3e7335ffa", "comment": "Malware payload (Mirai)", "value": "8ac799559b827697e2f199900f6ee1acd4ce9d55e6614a24bb62851ece2b8029", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772504205, "uuid": "483e2998-48f9-480e-ac86-11dac073f830", "comment": "Malware payload (Mirai)", "value": "deedd6a1af1d6cf01cff1d359c89e677220128ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772504205, "uuid": "e6c49558-19d3-41dc-b438-945db75ea3b5", "comment": "Malware payload (Mirai)", "value": "365db9e24d61984350c9a13c8b84c3daffce2ffc1bf653af29122f04eaf5112458f91cacacae37dfad9a9c2dbb3fe1d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772504205, "uuid": "9db8617a-84ea-447c-a9b9-cbafb37cbe86", "value": "T1D224B65E6E228F7DF66C873447F74A209B6D23D623E1D685D2ACC1141F2438E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772504205, "uuid": "b4aa439c-1b5f-4c19-befa-db1d0d566292", "value": "3072:zm1UhvEQLO5NIH5xP4b+ZSkpoyeur0Qtx3+XNTByA8HXGT1dFrf3Go5:C2ZEQ2NIZJI9kpbd9OXNTtmXkdFjN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772504205, "uuid": "e77c0f9b-f0fe-414f-8172-25addd1af2cb", "value": 224636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772504205, "uuid": "a2b3b645-ada2-4d89-98fe-846e536fe2b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772504205, "uuid": "947ded16-94d6-4fcc-ad20-95c863d1eeaf", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee2a19e-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (STRRAT)", "timestamp": 1772548645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548645, "uuid": "cff4d3dd-03e9-48d6-8ce3-d1a1b8551af3", "comment": "Malware payload (STRRAT)", "value": "515b4fae6e9397b6ecd39473158beda0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548645, "uuid": "13993ca7-9033-4476-930a-00bb1863c178", "comment": "Malware payload (STRRAT)", "value": "8c7dc32240973d709944a50bb82d9bc35ce65503ed860395e0a18e6d7897d5c4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548645, "uuid": "803bdcf4-c7cc-4052-8a32-567dc6685964", "comment": "Malware payload (STRRAT)", "value": "9b8cf9eede5dbb362f8c4a82b684e0c4799159b2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548645, "uuid": "310afe24-c565-47fd-b14a-fb4cbb87d217", "comment": "Malware payload (STRRAT)", "value": "d92977d6eb4252998936f686ca74cab791d47f0f1767207786fec6953ba749622568d49b539330ca74145ff91f526089", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548645, "uuid": "b68c7e94-bbc5-4650-a929-23f37664d999", "value": "T17BE1DC47F0CF18712E8EE1875A4C1B8D063DE16F5176B3D24699EB78120BE47E82BE49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548645, "uuid": "8666f4db-ef39-41ad-81bd-1b16279acbc6", "value": "96:EWtsKUdGNCtAZttKT1tgFXtnk8NklkLkNkeSbk6kWpYkftCmLwntuoVVE:iKUY1ggz/+E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548645, "uuid": "e5982e31-22c5-446e-a9a5-02960b99ce9d", "value": 6809, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548645, "uuid": "cdb57a3a-ee70-459a-9622-36b2382b24ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548645, "uuid": "29783f95-5ee8-492f-bbd7-a8413ae970d8", "value": "515b4fae6e9397b6ecd39473158beda0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f82c29-16d4-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772523710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523710, "uuid": "70a6c6bf-a7f9-48d1-a53e-4301f9b3a0e2", "comment": "Malware payload (Gafgyt)", "value": "03e886b39d22acb4582433d6f81a3fb6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523710, "uuid": "f27a801e-3727-480b-b093-c5061a0d024d", "comment": "Malware payload (Gafgyt)", "value": "8d06d1cad5c3492ec5a79681906114e8a59a8bde37b85f5906f0f1d182800441", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523710, "uuid": "d1603c31-6a26-46a8-a2cf-0d4c7b0ba59c", "comment": "Malware payload (Gafgyt)", "value": "17877598fb6e54ac080fc9e3f58021d724a0a28a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523710, "uuid": "41ef976f-d54a-48bf-b560-37c582a62a48", "comment": "Malware payload (Gafgyt)", "value": "5f159dd0443cadcdd9dba8060b80d2ac320775d1e57e218c4e7f7f7b5162b34f1239e940f2690adf5e90d0ba32fe7b38", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772523710, "uuid": "8f40cd6e-b62e-49ae-b62c-52448746805e", "value": "T149D24A86EDD2D1F1E0838572009BAB9BDB35DF260004CA97E3487F64ACA1797515F6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772523710, "uuid": "0c751a44-54b0-485a-a111-f9951170829f", "value": "384:t2S0dcs/Olzp7kDUSv/y9nOPURiuJknhVuHzWlxWlpaQzhWrBxD0KnqEgLAZAPR6:RkSVOPUJaazWlxWbajBWKycZAPazErYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772523710, "uuid": "b40cf98f-c315-46eb-ad6c-ecb5e0c6b1de", "value": 28757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772523710, "uuid": "caf5223d-f6b2-4d8a-aa37-6e1c43d15edf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772523710, "uuid": "b8a4b001-86d9-44f1-8036-20527337b542", "value": "8cb7qpuydx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8756e85a-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772519024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519024, "uuid": "5994942c-1dee-4592-bb3e-6cee9f53ef60", "comment": "Malware payload (Mirai)", "value": "0d81c7b2c2e426b016493b5151a413ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519024, "uuid": "c16e8abb-6660-4384-b5de-5fdb9f51e259", "comment": "Malware payload (Mirai)", "value": "8d256bb0433e8d5e5e473e0d3dd23dee2e66a2df79e7a6bd446555f0c76e8c80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519024, "uuid": "983c4a2d-0ae6-4f8b-974b-b21afaffdab4", "comment": "Malware payload (Mirai)", "value": "c73eb4922c8609f9b131603f5e380761c3143de5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519024, "uuid": "d27b6153-1a19-4ca8-b4e7-e590f2514077", "comment": "Malware payload (Mirai)", "value": "ab4a51fbe0a56de160d470e07b1110258e3768bfa9082822f7d4f19e9272df885ff76367deeed23e9d61c0be573cf21b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519024, "uuid": "0b180925-234c-4ae9-9077-7276d4d3aab3", "value": "T17F735DC8A5C3F9F0EC000A783077EB71AD77F53B6179DE9BE7E96563A841602910229D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519024, "uuid": "99f50f6b-62d7-4fd6-993b-8b61392da9f2", "value": "1536:oJCMny54LiYugKbKz78/2nW6r/G81X5QkE18HbZNW8opVbzEleyb/4mgtqm:oBnyqLiljiw/2nDr+81X5Q/CHbAcNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772519024, "uuid": "89f467c6-3012-43e6-96c0-683d5a83f73e", "value": 74512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772519024, "uuid": "136a2a9e-b3c2-42ec-bf7f-53710b0bf671", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519024, "uuid": "4b5811e8-f222-4a35-8a24-07cc9c6cbbed", "value": "nullnet_load.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e582f727-174c-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772575446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772575446, "uuid": "1885e30f-160e-4e6e-a004-303984dcb268", "comment": "Malware payload (AsyncRAT)", "value": "c2f137108af41d3f33a2fb1177f93244", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772575446, "uuid": "5fa2c26f-4441-4e7b-a519-3e4a7dcb207a", "comment": "Malware payload (AsyncRAT)", "value": "8d51b594c3f05f8e19d1fb07b0f7c6be20cbc12f63fb1bf462fe9b7a2cdccaa6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772575446, "uuid": "b2ea30ca-a3e7-4317-94af-131c13b57878", "comment": "Malware payload (AsyncRAT)", "value": "2b9ea9a1a97c3758581f66429c80f1105438ccd7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772575446, "uuid": "bcc9f06c-d6ba-4ea5-bdf2-af22dff3d777", "comment": "Malware payload (AsyncRAT)", "value": "dd39f7d9e570724fe30287c415fb5ac00939ac879c9662a650fa51b6f9058f74e72f7e81a157d82a1cb0576db9832282", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772575446, "uuid": "4be790c9-1ab5-4625-8bad-4c8d4716034e", "value": "T19DD24B08B3D88561E1FD57B94D7292048771EE4BA973DB9E1FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772575446, "uuid": "cf5ce594-b1c8-4cf5-ad2e-92424067f7d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772575446, "uuid": "f5eced86-f362-4820-aa63-3dd3030b024e", "value": "768:wwbRXxZb2uSEg/cIRGqom/Rb7fB/dTx/+:bbRXvb2uSV1i4RbN/L/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772575446, "uuid": "0f587773-1385-4f93-85b3-289649f75917", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772575446, "uuid": "be91a54b-6ffe-4bf7-a1ee-f54cd89f4b87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772575446, "uuid": "839daa1d-fe26-4ed4-aa80-da2dd05d61d1", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24dc8414-16ff-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772542051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542051, "uuid": "bccc2e8d-1ab6-439e-bd9f-b34fb56e6505", "comment": "Malware payload (Mirai)", "value": "81951bd4758d495ca424ac721e97b184", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542051, "uuid": "a8125a52-9b0e-4d3c-bac6-67328ca32ff9", "comment": "Malware payload (Mirai)", "value": "8ecff67913822cba865d3f69777425e16c8eee250e13cc88fd2c21add4d785d0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542051, "uuid": "cbb599e2-d544-4038-8bd2-be491e0be933", "comment": "Malware payload (Mirai)", "value": "62436518e1e3437322e2d8aa556f83c0cd2aaa74", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542051, "uuid": "34ceb918-d4c9-4307-9642-9f73438cc264", "comment": "Malware payload (Mirai)", "value": "7d2c98acdef4a270aa9ee638e44bb0643c1399e220cc4bcbad05902d9f80fb2cdea9073451abc0001b6f1e81f47c5138", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542051, "uuid": "72c9bc97-12be-4bba-aa26-6d6730baf5c0", "value": "T1B37182D42370C3377CA2463614B95ED863C5AEE791D58EE0B0BA3F61C88DE4C2E947A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542051, "uuid": "3b66cf6f-77a7-4483-8d10-bc3dc63463e8", "value": "96:v4BB4IX4vl41B4GTn45h40j4o54zN4sB43t4GkGO4ez4GD4kk:UW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772542051, "uuid": "f6b9ec3b-5b16-4a09-bc49-58b421161636", "value": 3795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772542051, "uuid": "c3bcf091-ec91-4d8b-8488-c8b094f74b4b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542051, "uuid": "d815545f-5956-461f-af05-2b4656f85cbc", "value": "nullnet_bash.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0599ce8-16f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772537239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772537239, "uuid": "67f0343c-c4fa-4a37-a156-6d33006aa446", "comment": "Malware payload (Mirai)", "value": "30f99daa1a8c5f540d5653e5452e760a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772537239, "uuid": "a1c3b541-7d0c-4bdb-a362-42f37965b1e4", "comment": "Malware payload (Mirai)", "value": "8eda36f051926131779cac928d51b16c9c3f7714f66d24d45717c503024692df", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772537239, "uuid": "62f74702-2442-4626-acdd-6e445aee0a40", "comment": "Malware payload (Mirai)", "value": "1c3ff417f9eaaca0c6d53638e42eb86985ae2afe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772537239, "uuid": "81744385-47c4-4d1f-9b78-71fb6e6d9d77", "comment": "Malware payload (Mirai)", "value": "c1b77eff8475ff5115c9e20a3e132496de460277c22db3124c2212ff4cd8c3c4e2b4a57f3be5b6123c7cf55db18526b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772537239, "uuid": "9f0d3948-7a1c-4468-b700-cf5e8b4e03be", "value": "T151D35C0A78D274FCC687D170926E9F61EA3A745C02183DBBA3C2AE711937ED05E15F62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772537239, "uuid": "6f500aae-4d21-40c1-a2a9-6260f9b57310", "value": "3072:lAF2acRfkY6z3xv+ErH4vk9954rlvLFZW8YYQL:yIRfe3xvvSrlvZZ7UL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772537239, "uuid": "f6f5ee6e-4fa7-442d-985d-edd632fe1ab5", "value": 136064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772537239, "uuid": "a111bf50-08f8-4be3-b04e-210a1fce5bf3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772537239, "uuid": "bea04f31-48ca-44eb-9e9b-36e6432ad097", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4df14d6-16cb-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772520013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520013, "uuid": "e74e475b-9a5f-4e1a-b165-d100d5a423d1", "comment": "Malware payload (QuasarRAT)", "value": "dac7a6bf86b1f586c67c5349cb490c44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520013, "uuid": "5331946a-9d70-4f15-a36d-0a2ba2e37ac6", "comment": "Malware payload (QuasarRAT)", "value": "8f1fd5f8e2d73c1fe9aea345a4a3653e766fbdff31172e08fb7c06d4abfce07b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520013, "uuid": "b2ba026c-48f8-4988-afac-6dcf937832f6", "comment": "Malware payload (QuasarRAT)", "value": "d1f2eda381a1ace222c8a2e0d46098bb965ffd75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520013, "uuid": "614c8532-bd0a-4cf8-b3e4-db0dad854a46", "comment": "Malware payload (QuasarRAT)", "value": "f665b744427784b7afacd07de57adf15d18a42f050b946ae69dfc582fb718a2d6bedca89e23327f8962aa698b9acbed2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520013, "uuid": "0981dd43-e6a2-43d2-94f4-074647e68693", "value": "T11DE56A1537F85E23E1AAE2B2D5B00406A7F1F81EB3A3E70B2581A77A1D53F409D81767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520013, "uuid": "daa63bae-807b-4349-bfa6-94b0972a56f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520013, "uuid": "0424af03-56af-4079-ae78-234bf26ac9bd", "value": "49152:p7Klt24FoGeVKmCEWkeT82buOWQM8eaNML33BHHB72eh2NT:p7S24FoGeVKmCEV682COQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520013, "uuid": "3b764a81-051d-410c-b401-5a546657bf30", "value": 3280384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520013, "uuid": "7f10953d-147b-456e-ac95-52a819ee110c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520013, "uuid": "0f172da5-848c-405b-9264-7c9f7b7a240f", "value": "voover.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b995e42-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772518896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518896, "uuid": "ba6c8fdd-5dce-4aa9-9307-6386b43bc82f", "comment": "Malware payload (Gafgyt)", "value": "052db9b2580e25e314958e3262951af2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518896, "uuid": "aec1bb82-e500-4139-b1be-3191917a8b34", "comment": "Malware payload (Gafgyt)", "value": "8fa80c33a2673776e0ac04e990ca120ee14bf1c03c68aa2b2bfe05a2fc379f4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518896, "uuid": "1eba1024-3789-41a9-aeb1-6ddc6c9a5011", "comment": "Malware payload (Gafgyt)", "value": "066036f51742b5f1096e0ff57bb9c04b737a66e9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518896, "uuid": "baacd192-a66e-42cd-ba1c-94f36ba08ff1", "comment": "Malware payload (Gafgyt)", "value": "50a36371d93f3e15af2fad5e0a8f772ff51a370a181f76ee31bdb6bb74c22da5702a4f83ff114597633c278e92d03da4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518896, "uuid": "237effc6-db97-4096-86e2-a5465016f3f3", "value": "T1DD83099BB61D0BABC5975BB12CB737F19B69ED6002A211C4A10EFF9007B29702532F75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518896, "uuid": "3686b781-57bb-4909-8f5e-6be6b1cd993d", "value": "1536:rhUB/XYuBXJWiOV7NTEO07Kq6FUI+U7D47otwHUIe:1afYOfwNTZ0ObeUqotl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772518896, "uuid": "5c912300-12ed-408b-933b-1e3c61eb0d36", "value": 88583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772518896, "uuid": "836ae7f0-8423-49ca-bfd1-43907c7284a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518896, "uuid": "b883546c-998b-423d-9caf-2204c1a95af9", "value": "cron", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9804a36f-1708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772546110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546110, "uuid": "fd07ea08-0cd8-4423-a040-47d6f6150441", "comment": "Malware payload (Mirai)", "value": "94f429bd5c129cda6985bc85c17ed7e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546110, "uuid": "2930a841-9822-4ecb-ad43-a459d727f653", "comment": "Malware payload (Mirai)", "value": "901215bd03c85947477ae1bf6eb16a7588369f51ab97a0326ba341b6c698525b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546110, "uuid": "1c12916c-787e-452f-8c84-ff2d7076c76a", "comment": "Malware payload (Mirai)", "value": "53ddd45627d5c08b4341578b5ba1db9f1bd8b975", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546110, "uuid": "6cb440de-f5e2-4aa9-bf2f-155140367c74", "comment": "Malware payload (Mirai)", "value": "3175c626c9d43539fb705e25cbc7970db41c62cdeffc18ba350014dabd3e88b3dab01cf604a0e192630b9c83a67e3742", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546110, "uuid": "42696d52-278a-4aa4-a87d-f78037d63917", "value": "T172733A95BD818613CAC512B7FA2F428E772627E8E2DE3203DD156F11738BA1B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546110, "uuid": "3f9bb338-fd2f-470a-92d7-4c6115b82a3f", "value": "1536:buwDOdYXa9tRZvUoUBzuWM9uU9sHEvQyr1AqatvH9:bdaqaFefVubIUYEvnBXsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546110, "uuid": "522470fe-1ccd-4547-88e8-46343bd5b35d", "value": 80408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546110, "uuid": "01dd650b-b57a-46f1-b086-dd25e9fb0ed4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546110, "uuid": "780ae7f3-2648-47c3-aecf-1e44a79a1287", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f703f7-171a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772553753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553753, "uuid": "bd95f1f4-605c-4b45-b501-378dd8fac503", "comment": "Malware payload", "value": "2f83ab33777e15e956883e2dab5e4c31", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553753, "uuid": "5704a34b-7dff-4d06-9b1b-40357dbb81c1", "comment": "Malware payload", "value": "90499b4ea50433946ab1b182145c7f86237409e51677131ced3935301abed43a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553753, "uuid": "cc8ae793-5033-4563-aba5-ec1100bc31a5", "comment": "Malware payload", "value": "7aac1e9f1da7ae9d5ff272253f8acb33941baa52", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553753, "uuid": "837d67e2-862a-4bec-bf67-527dd599c2b2", "comment": "Malware payload", "value": "8864e7e143718b4830b01aacbdd116131e7ff4e3c2d4817aa4ed4e1a9902a00cda3357225af4d17ce2e000ce0294fa98", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553753, "uuid": "b2bfda12-9be6-4101-93de-6ddc7dda98c0", "value": "T179D104202CEB20DE323B5BA057C8F5FB0A96F5F5292EB1F420419A4947B49D4CCB2E74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553753, "uuid": "de7e49ef-b053-43de-a8a2-2cd58380bd81", "value": "192:SZRbhzI/bhs9vTcOtcgWM/Kpe735ZrJqB8araqcQRcZe:+8tsFTcOtcgWMCQ735zqWaraqcQR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772553753, "uuid": "61b213e0-4995-443b-846f-7d73378f8f86", "value": 6272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772553753, "uuid": "086641b7-f54b-49f2-9d27-e1e4f3f0eb36", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553753, "uuid": "a6a4965c-f831-4d99-b116-f6cf9d9c9319", "value": "f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56b160e8-16f7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772538699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538699, "uuid": "a6b639b3-796b-4d32-8b0e-00b7a7e28309", "comment": "Malware payload", "value": "078d33da1777dec92ebaf3230e653cbb", "object_relation": "md5", "Tag": [ { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538699, "uuid": "6d2ddc7e-73ac-423e-9ebc-f59c3ad2de7a", "comment": "Malware payload", "value": "90592e8f68afd56e897b87d79176944f5c84144aed5ed712b43f93e5fad09137", "object_relation": "sha256", "Tag": [ { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538699, "uuid": "2bad1873-ef35-48d6-a804-edf03f7026b4", "comment": "Malware payload", "value": "daddd03801aa4fe25ff0c200cedf34b413816db7", "object_relation": "sha1", "Tag": [ { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538699, "uuid": "06b5317b-18a8-4416-bc50-ddc8fa028176", "comment": "Malware payload", "value": "487cbffdeba8135b1b01d2ec9fbd6343ace1b7681131f39fb2740f7dc3e6c32e12422393d002de3ed8eca4c3c1cdfcf5", "object_relation": "sha3-384", "Tag": [ { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538699, "uuid": "d6c68659-f95e-46d7-8bad-0498d065e2c2", "value": "T1EA5302239DB7A4767C5199FB4ECC3C924D8D2942346727746034B822AF12A0B7D5A27D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538699, "uuid": "56009f3c-1031-40e8-bb04-c1ae92514909", "value": "1536:9QuaFPFizi08jxJ8e+OQh7YcrpoQMeiFSZsEhgBSwDnub7tISsQXHiC:KF+ibxJ8bOceneSmUuCIiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772538699, "uuid": "f09962c5-d86c-4a14-99a8-a0f5759f8b5d", "value": 64932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772538699, "uuid": "21b66838-7986-49cd-a9fe-89ff792d2fea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538699, "uuid": "bd41e77b-4461-4cc5-8890-cb3f752995b3", "value": "31f1a97c72f596162f0946df74838d3bef89289ce630adba8791c0f3220980ee.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c9ed0e9-16cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772520670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520670, "uuid": "0108417a-792e-44fe-a9e0-8f78c652e13b", "comment": "Malware payload", "value": "0e01e18328df61781f91287671987035", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520670, "uuid": "b08fdebb-8334-441e-ac56-205bd757d503", "comment": "Malware payload", "value": "90ad3f364faa85e2242802819d8d53948fd720dd9a08bb282816b1dca9f5bc4b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520670, "uuid": "140ef44e-7596-440f-bf8a-f68de112d27d", "comment": "Malware payload", "value": "cc88cdab65650c05b39f26e568bf9ebacc17cc26", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520670, "uuid": "320ee749-03c7-4218-9f2a-25bbdab55456", "comment": "Malware payload", "value": "e4edf00aa727e69d9cf195ce1931fc7f65e389575c7d7968e53a0bc3ef7d1deac127e9b2eb6c691313adf7fc0a52ca94", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520670, "uuid": "e08384e0-a95f-444f-9e98-c27a0c7999a5", "value": "T11845EC79E9340AE8011A962E8780F349DC068F36242E5DFC273AA4FD85DB506ED7FB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520670, "uuid": "a5184f79-a5c2-4d4c-8a54-add1dc67c521", "value": "384:+lN9GM1Ca+1yVqxr0bu1CuK4w1CxK9AOV4FHwS0sdEvnRfr+K3PvW3uiESMkJYBV:fvU3GeIeSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520670, "uuid": "9de7c127-1520-4d21-8334-7c15ff63a78f", "value": 1169923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520670, "uuid": "c56057a7-df62-4b6a-8bea-ed34e173ef8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520670, "uuid": "88d2212f-dd52-4ba3-a35e-5a025412811f", "value": "90ad3f364faa85e2242802819d8d53948fd720dd9a08bb282816b1dca9f5bc4b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009ae8f6-1747-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772572914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572914, "uuid": "9d59d1d8-5c06-4447-a895-82abcfc0526e", "comment": "Malware payload", "value": "321453eda934c3eb082f710c7e2e9e5f", "object_relation": "md5", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572914, "uuid": "63e24029-a64b-419e-bc38-c7ecda08adbd", "comment": "Malware payload", "value": "920971e8658cea8843239247959e393f60fcd3e50afe8bc45e577dae80b00b2b", "object_relation": "sha256", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572914, "uuid": "4f26b245-886a-497f-8554-a20bbc19841c", "comment": "Malware payload", "value": "639379e7028a504ddbd0f1b58002a8b57003a7f5", "object_relation": "sha1", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572914, "uuid": "141fc9c1-f6ef-400a-bfee-4393af53422a", "comment": "Malware payload", "value": "d71271d2e004bea9e428dc95f76bea4102948dec65676f3d0c1d83f4ffce03e5eaa00023df1115123fee64933cd470c4", "object_relation": "sha3-384", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772572914, "uuid": "039bbe99-c1ff-4b8f-9fa6-00c3b35475e8", "value": "T168D0A7A4C71B6163D393A5327CE1DEF2F09E3241570079DA29A864D8A5553245B4729C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772572914, "uuid": "f326a8d5-74c8-4c5f-9e32-89fbf62c0e18", "value": "6:5ju5+SFko4MVHp2eCx2Ahgtya1Ffu5+It5EfFk3t+lh:5jpjMVHp2eZAp+FRI3tah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772572914, "uuid": "d3498da7-c39e-4c19-8c6d-ead78abbf16f", "value": 245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772572914, "uuid": "9d5c9eae-e058-4858-9f60-100cac044d99", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772572914, "uuid": "33531209-3ae6-4219-b906-a344c8720c55", "value": "Fac_2026_1819465741.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59f63c1-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772548710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548710, "uuid": "85c2b103-1761-443e-8222-1cb5cfd5c0c5", "comment": "Malware payload (AgentTesla)", "value": "78539601482501174eaf628e70b49dc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548710, "uuid": "8dfe7ab3-020f-417b-a3d7-3ca1d62b72e7", "comment": "Malware payload (AgentTesla)", "value": "9214ccecd9dd5f6453888299033d6eb9e6d129675fa10003bd88ca49e088f0fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548710, "uuid": "ca902c16-1dba-4dcc-b225-9aee96060bd0", "comment": "Malware payload (AgentTesla)", "value": "0c599bfc11d9da820f1a76454d190ebed47e351a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548710, "uuid": "a1b0ced5-3435-4cba-8af8-559668118fcd", "comment": "Malware payload (AgentTesla)", "value": "ee82ee4ce027d03ec30b761a39aaa6494dae25e861c5d43d1fa5e7622abd01fa648ffb55966eadfdafa9047ee3b49a0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548710, "uuid": "fa6710d4-150b-4e65-aa8c-101a1a27d0a2", "value": "T18E558D5514D2A8C9CEE8E62791EC559208FAA197BC2BF30DDA233B79EDD1791C27F004", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548710, "uuid": "168be580-2860-450a-bb65-df01deea5bcf", "value": "24576:kntIEZ19GeVJwxRl5iPGakISPXO+9nXXLILdRFy:uviPI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548710, "uuid": "7ffd9180-c4b6-4b6e-86f1-c69f83d43767", "value": 1364274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548710, "uuid": "69c98f02-713f-4fe8-a72f-9bd128cc515a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548710, "uuid": "03f758fc-4f3f-402c-805f-bcf8bac672d9", "value": "Bank slip.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541fbf2d-16f7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772538694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538694, "uuid": "8cf63805-f87b-4164-b055-c96f07a37eff", "comment": "Malware payload", "value": "3f25c60d96f9cbbca7fd19278545207b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538694, "uuid": "ca8de6b3-e1c3-4a87-a1ec-47fe5c00916c", "comment": "Malware payload", "value": "92962bfa6df48ec0f13713c437af021f4138dc5a419bc92bc8a376d625a6519a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538694, "uuid": "b0c77e78-71d1-4b78-85af-4874947071ef", "comment": "Malware payload", "value": "80157e0a596b111519c3146fada535ed4304917f", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772538694, "uuid": "cf289b2c-c0f4-4db1-9434-c11b49958498", "comment": "Malware payload", "value": "410386603a472a594e65a0d0fa4de9f0d5e220669aed4df5b7aa6fc66ef57718c8bda110340b5bd227e9ea287fbafc0d", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538694, "uuid": "374a35fb-51c5-472d-a89f-572ddea72312", "value": "T1F521AF1422F50718D7B34DB9BCBAE3218633F821FD5387CD1250A2854864224F53BF2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538694, "uuid": "9c061501-d6e7-4562-a4b9-17c390626486", "value": "24:8hwWa5y5LEnXKPiW2lxAtWF+/CWw+//fIPd4I0aho+Z5:8HVZEMfCnPCI0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772538694, "uuid": "c20c2293-bea4-4efb-a63d-deed0d749868", "value": 1371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772538694, "uuid": "9c32af2a-de2a-4b85-b32b-24cf91521f2e", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772538694, "uuid": "9820acea-c71b-430d-b756-934e9e75936f", "value": "92962bfa6df48ec0f13713c437af021f4138dc5a419bc92bc8a376d625a6519a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af26e6d-16cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772520694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520694, "uuid": "26b4ed7f-6068-4e3f-9eef-2d6bc5af82a6", "comment": "Malware payload", "value": "6f733ef733b52feafcf8e613d39f2c1b", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520694, "uuid": "0a2af61f-109f-4e27-ae01-f4c606c9336d", "comment": "Malware payload", "value": "92e93fd4e2c4ac7dcd25d0ed43be2cb330e1b688803d3bbd6a811df2099d3e07", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520694, "uuid": "31361e81-66bc-46e6-8451-2a5b67102bc0", "comment": "Malware payload", "value": "07c12382318f8ec2367cc6f979be8b7cf88583f7", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520694, "uuid": "bf3f2214-c756-448e-825f-c7ed31e39c5a", "comment": "Malware payload", "value": "70162af8363aad34ad7f80a5f48cef6107b18c22b6ef827d8546b862a5bb6e3ba5560533f5da99732dd488c09964179a", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520694, "uuid": "00fbb541-3f7e-4b6f-bd8f-b74f76169298", "value": "T1E9941225BB96FE5BEC5703370DC54656A607BCA1974A481F3882B72F187F2E3A56230C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520694, "uuid": "b4ce8ef7-e71b-4a77-b0c1-0355607d22de", "value": "6144:iSOY+3HGjhFLs7Hottq4JqG60M63XWCOPKm/vem12EPDejkf1f6AR0ivLu:E3GhyItgZGl2im+7E6K6a5Lu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520694, "uuid": "51a9c507-5f16-4d8a-be6c-348b2fa4caec", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520694, "uuid": "4f431485-9fd2-4992-8e74-cdced9b0dfe2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520694, "uuid": "0f22dd96-e1a8-46e6-a759-abf5a81d4a3d", "value": "92e93fd4e2c4ac7dcd25d0ed43be2cb330e1b688803d3bbd6a811df2099d3e07.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d076846-1706-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772545232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772545232, "uuid": "181ff39a-0202-4129-a9c6-ff5f64fc8578", "comment": "Malware payload", "value": "3b610cb400fc3f1a06dc550f71a25229", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772545232, "uuid": "70996d72-56ba-46b5-9cb1-066cbaa15f60", "comment": "Malware payload", "value": "9304a3f2c70b92e1eea18c10579b4fc57298cb54b393d5e01330650183b9d90d", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772545232, "uuid": "73fdc3ec-0ca0-4f04-9de0-091cbe8ffe0c", "comment": "Malware payload", "value": "b6646f8096bc54b72e1903abc91d6ea91686be6c", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772545232, "uuid": "0bebd8cd-e343-4dc3-8a9e-abbb9b5cac8a", "comment": "Malware payload", "value": "559fe51c66d4ab0b271d06dd159add0acd218f96722d619f8f2ef1d757c4870766e2c24a22bcfdcdfbff6391b3258f24", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772545232, "uuid": "b1e3a00b-00ab-4240-9707-4e80a1f7a140", "value": "T171D17E01F50F4A0230F2F4B78963F41AFA84D4B653B0902DA23DA50EB116EAB863614E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772545232, "uuid": "8b58e598-5a71-43cc-991c-d1ca66a4b7de", "value": "192:Y2zM7txML0/LeXuVDwhB+NQjWjyFhQKSk9x8CEyOyI:Y2CMA/CWMhMOyIYWWQOyI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772545232, "uuid": "cbd275a7-0ed3-447b-9b9f-e89415f2ee21", "value": 6199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772545232, "uuid": "839b4121-06f5-4f71-9460-d52adc353105", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772545232, "uuid": "6a840cee-0397-4798-9b44-843e5feb175e", "value": "implant.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6560f707-16d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772524550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524550, "uuid": "9413daa1-d6a6-40d9-88d7-959032e6c319", "comment": "Malware payload (Mirai)", "value": "97d1d609a4b63557e70400e98f19be67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524550, "uuid": "dadfcfa1-d283-4a91-895e-fd60356b82e3", "comment": "Malware payload (Mirai)", "value": "938a4c50b4efbb1ad97e31393f4ab160c1baa254277f645f82967d687b01a21a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524550, "uuid": "cc693d01-3491-4b22-8ce2-07a18c225adc", "comment": "Malware payload (Mirai)", "value": "fa74d83c30f0fe73c05e0e7b5702ceb3e77d1d0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524550, "uuid": "e77d357a-ac8f-4887-bb11-f2c946bc6c79", "comment": "Malware payload (Mirai)", "value": "3ade9b19bbba89c96851225be2819d6d008d9904d3e5f2dfbd91840cb4e5c9489d209a1cf69223dffd279aef05da9172", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524550, "uuid": "0b6ea46a-692c-4ea9-ac64-f450ef982ca8", "value": "T15E731843FC81D906C6D013B6BA6E61CE3311739AE2DE7207AD216F6436CA91F0D7B295", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524550, "uuid": "10dd798d-99f1-4aaa-9e80-ada36be78af1", "value": "1536:f2jCRjAOjrCT+aBGZ4FTM5yj++5mmFBJMjPzy2+46xklMmN7P:f2eZjaM4tMP3mFfMjv+zSmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772524550, "uuid": "ae151821-7dfc-4944-8b58-ab6f4c999950", "value": 75040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772524550, "uuid": "c979d6ea-592d-4e28-9d8e-dc5e70cece8c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524550, "uuid": "6d95c835-b22e-44ca-9595-c499dc592a1c", "value": "nullnet_load.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94a62e85-1700-11f1-a769-42010a9c0008", "comment": "Malware payload (Berbew)", "timestamp": 1772542668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542668, "uuid": "133f18f8-f806-4bb7-870b-3329224b9572", "comment": "Malware payload (Berbew)", "value": "6f34ed5167f1c37b8027f0e8201844b0", "object_relation": "md5", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542668, "uuid": "7cb982ed-9762-4250-9de3-a6f41d10275b", "comment": "Malware payload (Berbew)", "value": "93d8c7f4f3c7b19c000187f1e7a5cf8a83d25f6a3e5fe992461459c06496f79f", "object_relation": "sha256", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542668, "uuid": "33bfac01-d9e4-4246-9b79-44e3a3264184", "comment": "Malware payload (Berbew)", "value": "32f51673038a3eeefaa94e27de4a4918e7ef9628", "object_relation": "sha1", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542668, "uuid": "1914998d-cb13-4f67-b6e8-6961ea46113f", "comment": "Malware payload (Berbew)", "value": "00c40530519ebf86c15f7824dc10452a6ddfbe64249fca3de808d07542849e2039bcd533eeb5c68e3cc4ecd914e18720", "object_relation": "sha3-384", "Tag": [ { "name": "Berbew", "colour": "#4AE63B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542668, "uuid": "16ba430f-88d0-48ea-a37b-8a32b714d92a", "value": "T181D38DA29CAB2E05D90451FEFD110C22C778CD171CE5A9B411FFC789685B7A866AC0FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542668, "uuid": "9d7b356b-6f20-486d-ae1a-fcc3a4d2e3cc", "value": "02a702ad162c3a8a4d8bd0bfd0ad831e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542668, "uuid": "01176b65-646f-4a12-8a77-ea926674940c", "value": "3072:pZisz7e95b2eSlj9pui6yYPaI7DehizrVtN:pZiIcxNOpui6yYPaIGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772542668, "uuid": "ceaab773-8f6f-4640-b1f6-e0d37d05c4b8", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772542668, "uuid": "3fb6f265-c421-4120-91e0-eac221726ef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542668, "uuid": "908584ac-e368-4b2d-acae-653513b36abb", "value": "93d8c7f4f3c7b19c000187f1e7a5cf8a83d25f6a3e5fe992461459c06496f79f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6229d3e5-173d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772568783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568783, "uuid": "260078b9-b494-4d31-8b50-9640f768e995", "comment": "Malware payload", "value": "77d13bf89cf59f0766178c9441bf32e0", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568783, "uuid": "e0f694e9-5dab-4e45-8042-d07b3bcafa02", "comment": "Malware payload", "value": "94a4f72b23e4472a836b1bf2f6b092687cd12ac03c41c5276a0333d9ebd8ff75", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568783, "uuid": "624b7ee6-a53d-4e58-b697-0e60a1971af9", "comment": "Malware payload", "value": "6f451fb7569055c2c52d9aa5a0ab9148eb847976", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568783, "uuid": "353f7e2d-a43b-4343-a82b-aefb42077976", "comment": "Malware payload", "value": "88a31d4741c785f91b6a03f9aa341806918a7f0f097c0f9828c5f602eae39474ac137e67b1f3da93cd00e3ae103c49e7", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772568783, "uuid": "ee41f289-03aa-479b-9572-b4d768cb5ddc", "value": "T1B892B7166AB300226957C0BC67A79746333180079645CE2A3FEC5294DF8AEE5ADF37DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772568783, "uuid": "6c903dfa-8fe6-4a76-bd25-b7962a47c4fd", "value": "384:yFTAsXe7FUF6/+9MAKksb7Rssa7bWkkg1k4iPiliri/iIk4i7aiyKi8iJiyILne4:E8sXe7FUFw3OsafWkkg1kVKUO6IkV7DF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772568783, "uuid": "7944d85e-34c0-4131-bc96-50ea0c2996e3", "value": 19719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772568783, "uuid": "d15daaa4-254e-445d-ab47-175c4ebbc9d3", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772568783, "uuid": "c1a246c3-b60a-4925-b758-b220e6402e89", "value": "vp32ssdaq.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031ae6e9-16a9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772505058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772505058, "uuid": "c303f600-19fb-4320-bf50-2747496b9675", "comment": "Malware payload", "value": "e98275d56925801da0ad4f8b677bdf78", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772505058, "uuid": "ffda678c-e626-44a2-b736-3af474cae409", "comment": "Malware payload", "value": "96c1b9bd2b8cf07ae3d7ad843b81b01e72e78ee8956f533e49332e18b2571862", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772505058, "uuid": "4e8811ac-5d5a-4999-976c-b9f5d48bdf70", "comment": "Malware payload", "value": "22ef2cba5f9afdc1677ba591a7d0ab20e56b94ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772505058, "uuid": "9a3e669b-3e1a-42cd-beb5-23a14124cc8d", "comment": "Malware payload", "value": "0b0d6399c41d0694ef597efcd0f2ca897af953a3c0ffb06fa3903a052ae511fd0ffc3120d2b5fee7079a09a21ea0d96e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772505058, "uuid": "849e08d7-8f21-41bd-b4f0-4f416dc71408", "value": "T13FF533DBA3AF481861320EFC2627406BED37D96E25879971639D738C79F18E43298DC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772505058, "uuid": "dd568a58-6571-44c4-9001-8a9d4f97111d", "value": "98304:umJX32liF5aYmRHY4T/8J1U8DS0gG6CG7MBmq9jcZSZ2:JJn2lg5R0HYaCACDIVSZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772505058, "uuid": "13834012-6067-4a89-8373-d888cfb4d09d", "value": 3340552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772505058, "uuid": "db0759bf-7ce2-48e0-bebf-1f6ff07bae26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772505058, "uuid": "ce9c0d94-8c06-41c3-b47a-e952c94edf9f", "value": "rolf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b93a5de-16cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772520588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520588, "uuid": "076bfd09-2023-4226-b3f3-d58060025f3c", "comment": "Malware payload", "value": "4e8cb3356db7ef8488c07666688ebae3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520588, "uuid": "c98f1e66-0b0a-44a5-8aad-6f804734d51f", "comment": "Malware payload", "value": "96d4e77c0d433b14c2030be194ad12e159b5292f33da3a7d4d2749475845c253", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520588, "uuid": "c8ef0a5d-74bd-4346-be46-91310dde7efe", "comment": "Malware payload", "value": "ef834093c4ee95212ca952ab4c361fbdf35be92c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520588, "uuid": "7e11515f-fa76-45f8-b4e2-333ad7c07eb6", "comment": "Malware payload", "value": "e0e7c5ccf0f5cdcac22d947c01098111524c03bd04291fcd7284355f4da2266c2cd357036eab1b3f56d00383f3caaa50", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520588, "uuid": "618de704-86d0-43b5-b97a-08aa9c9ea375", "value": "T1D855B607F253CEA1D25C1733E2D7092003B4D5856623DE0B7A9D1B392AD37BA9E26277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520588, "uuid": "266dd189-d05d-47be-9ddb-65439b126152", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520588, "uuid": "dc7416f3-414b-46c8-a337-0a670d309b23", "value": "24576:5yFaAUSYwy//L8OvUe4VkjWIEbvdzbUl:vFwHbv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520588, "uuid": "163745c1-cc62-446c-9ff9-124580f7e65f", "value": 1329664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520588, "uuid": "0b160d85-2c41-4215-9989-157c06cbacba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520588, "uuid": "d6fe1493-324d-4fe5-932f-e123b24aba78", "value": "Microsoft.Win32.TaskScheduler.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc379c4b-16cc-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772520428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520428, "uuid": "0222a034-b3b4-4be9-8627-ef2a9f25b231", "comment": "Malware payload", "value": "61c20642c321dd1298fa4f68fe88c70e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520428, "uuid": "a1cca36b-4788-4696-bb1e-d17ff5a8323e", "comment": "Malware payload", "value": "9777c212d65e343f5fa2095e690750b23956f33ec83ff1bf53c02e1d44f66d94", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520428, "uuid": "95ce0642-bc71-47d7-b044-c5f33d8b7611", "comment": "Malware payload", "value": "dfd78394e046c4917787b886f31eba762bcd8083", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520428, "uuid": "f85d97c7-2c12-4c6f-9a4f-05f00c8509a3", "comment": "Malware payload", "value": "7bc07fbddba0273a301d2a893782364f0c8a1017509652de21e11795036ba8103087f67d479ccd76ca9e91f35772c587", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520428, "uuid": "cb77be54-9fc2-4405-b54d-a991a5886a3f", "value": "T18B65469E2A6B19C98A2001BD428D1DD5BE4CF888BDE1127F3D44F9EDF97C7641CA2D21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520428, "uuid": "70846def-b59c-41d0-b60c-3b3d8cf74287", "value": "96:I///////////////////////////////////////////////////////////////:6NR0WZZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520428, "uuid": "f6603057-2cb5-42ca-9f3f-45c0223626dc", "value": 1416955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520428, "uuid": "e409a9ef-7846-416e-bf62-178c0749debf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520428, "uuid": "e0381a96-ad74-4f07-8836-d7c0146fc7cf", "value": "9777c212d65e343f5fa2095e690750b23956f33ec83ff1bf53c02e1d44f66d94.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e985ac7f-16e6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772531644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531644, "uuid": "eec273ce-7239-45d5-8eb4-12d2450482bb", "comment": "Malware payload", "value": "ef211dd68325f87395a1cf5232501880", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false }, { "name": "vo-msecnd-cc", "colour": "#4EA23D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531644, "uuid": "013abc6f-0b7c-49ea-a6d8-748842be8821", "comment": "Malware payload", "value": "97e32c456e5757fde0cc81de20e041865fd1cbcf42b5e90bf15560703d00bcd3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false }, { "name": "vo-msecnd-cc", "colour": "#4EA23D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531644, "uuid": "7eb96ac7-3f48-41e6-bc55-ae53eeef54f7", "comment": "Malware payload", "value": "bc740f18683d7e35a254de4d901e2e184883680a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false }, { "name": "vo-msecnd-cc", "colour": "#4EA23D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531644, "uuid": "7a2b5f70-507c-4545-8b1e-b9e6a474feb9", "comment": "Malware payload", "value": "1b9c1122fa12b3c3f67077b93d8fdeaf213e6aeb08ec67d42457f04fff6119c1eb74fd28bec1ea5171bbcb236df532a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SparkRAT", "colour": "#D15709", "exportable": true, "hide_tag": false }, { "name": "vo-msecnd-cc", "colour": "#4EA23D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531644, "uuid": "b2ff814d-3706-4c88-9340-ac3b5fe317de", "value": "T190248C59F25100BAED7B823489A74A21F7B778600754AB9F07608334EE1F3996F3DB64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531644, "uuid": "20900366-09f8-4c0b-aa62-4f4904b86dba", "value": "5ecd04557f8f2f4b668349ce1ec06691", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531644, "uuid": "1be4f457-fb8a-432d-9376-cf8acbedd158", "value": "3072:1a5dEdprxJGI9x9uKMhABhLU0SCRKBbU7qa2jq1l1tG/Kduh/mbo6g:omv9x9uVhABhLU0pRK16WslI/Wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772531644, "uuid": "dfbeda63-6748-4332-b81c-b5f0c4da2a53", "value": 214016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772531644, "uuid": "aa4858ae-0605-4e42-9c52-0bdd14f8c298", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531644, "uuid": "bde11b77-ab56-498f-91c4-69d46bc99e77", "value": "DesDtCore64.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad8d08b-170c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772547591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547591, "uuid": "7a2121e9-c2ae-40d4-a61d-82e68ec96567", "comment": "Malware payload", "value": "131db239740d5b4276b23167471f49a1", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547591, "uuid": "2d9c492d-868f-45dc-9596-3be134c4c751", "comment": "Malware payload", "value": "9842a8bfa5f739186a1e755e8ebd03cfcfedc30cdeaf425cb2d633599846133e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547591, "uuid": "4ee1eef7-5f36-457f-86e6-05a3dd50046f", "comment": "Malware payload", "value": "75c5e5e8be7b68aab9942695fe244f9c2351a9ef", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547591, "uuid": "319e686f-807d-44b7-b61b-480327409a21", "comment": "Malware payload", "value": "a9983ff4c046a95dc41ac1df5f7877e14901cc27883f4a4ab3d2aee34b2959a5668fec36c68813d571b90e39226b67fa", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547591, "uuid": "1fba5582-cf37-49a3-b8ff-04f04697e271", "value": "T15BD40213A3D6BD9BF80647365C850899A10F7C704B5E881F29C6732E5D7B2E2B5A732C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547591, "uuid": "3792c2dd-a808-41ae-96ea-194a6de97475", "value": "12288:/g3Gh5uwgZG/yQNg3Gh5uwgZG/yQf/2ESATsQ4D0mEM8:/gauwgWNgauwgW2ESATX4D0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772547591, "uuid": "a409c602-3cd6-4a31-a18b-576523d8e651", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772547591, "uuid": "2e832321-c473-4a1a-807f-127af5be1d6e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547591, "uuid": "aeb9a2f4-d640-4362-bf76-f90877470bdd", "value": "131db239740d5b4276b23167471f49a1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9623a46-171a-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1772553870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553870, "uuid": "25d8f5dd-da2c-4a04-ab9d-e1d7fea75ab3", "comment": "Malware payload (VIPKeylogger)", "value": "4dabf5fba9e3b4458ddef17ecf73ca67", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553870, "uuid": "a2346079-aba2-4918-9772-d6d9b7a4d8b1", "comment": "Malware payload (VIPKeylogger)", "value": "9899fe72ae403fa3a68ea803f410e50db67918a96a080bcebe3d947148d81cd8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553870, "uuid": "96e15b40-475e-44f3-ba71-aa5d3f6f80c0", "comment": "Malware payload (VIPKeylogger)", "value": "f8a4f0925874c67e14fd5a83696da23b35df3496", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553870, "uuid": "0a1ea20f-b224-4078-a44f-24d6b47520d0", "comment": "Malware payload (VIPKeylogger)", "value": "c64a7465f9b4026f95afa88befe21379c1ed8e69c0fa21d288b04ba626e7ce2a27b75245f7c32e7f544df5722a94e63a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553870, "uuid": "49fe043a-ed37-45ea-be93-fe957f5195ba", "value": "T16D6612F25246BDB51A6D0F00A05D3FB61CF86DDF8178B1A8B98C25CA709D7E1AD1D8B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553870, "uuid": "65dd6d0f-c2f8-40ba-81da-f7342c1f707f", "value": "49152:TQV0f8KUiR8r9hocKsuYaN84LjI9S8pY/OKkz7nNTwPvfPBhhNERyT2WX3NWN/aF:L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772553870, "uuid": "edc2918a-5dd0-476c-b8d6-f61dc0370072", "value": 6653899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772553870, "uuid": "681ee1ab-4ae7-4bc8-af11-9d7512087514", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553870, "uuid": "0e14532b-43ff-43bc-912e-2621e8aa44d9", "value": "ouh3nf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b1187a6-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772548585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548585, "uuid": "a4e5537d-279a-491d-ab35-4ddf2f475a3b", "comment": "Malware payload (PhantomStealer)", "value": "ba48ba82d1a39c87e3e3d01df258d078", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548585, "uuid": "3a35d446-9317-4c60-afc1-b0f1d67e2edd", "comment": "Malware payload (PhantomStealer)", "value": "99b3c140543a93dba9710c1860e98eee03d582639b9d315a64c68d7d4d91e230", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548585, "uuid": "6ac927b8-42bd-46dc-8c47-d189185e926f", "comment": "Malware payload (PhantomStealer)", "value": "3658c8f0fa108b4eb4bb78b4b4265e4f4b942fed", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548585, "uuid": "9e247e53-5267-453f-b2af-0440ee8950e6", "comment": "Malware payload (PhantomStealer)", "value": "3ea97109da3de8cbef6f37df6fa35cddcad1ac761e02c3a16e7517b9336710e8d14aef2090730810bc5a25ca7bb070ed", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548585, "uuid": "a5f96911-a3df-4ad8-bf06-f8803c656ee0", "value": "T14F26BE51EED13F154245EB09D1FC330F23A463EEC4432B2E6759F5A625FB6889B8A18C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548585, "uuid": "2ed561f1-f957-4a10-9d38-dfc36681d93f", "value": "49152:d87ZQJLzTppF0m/w8red98P4XEh4/HXTfD2Bz/sCiTa0o6XtFfERZsO7LaSxyzXj:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548585, "uuid": "8ce29100-b706-4c35-a97e-0cf115afcb70", "value": 4674305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548585, "uuid": "253b1068-474d-47a0-9280-e2da6825415f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548585, "uuid": "2133d022-4430-41ca-8ce1-2b871149c8bf", "value": "ba48ba82d1a39c87e3e3d01df258d078.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8d9220d-1746-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772572767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572767, "uuid": "73bb7497-e674-4091-ab6d-3e2510f93137", "comment": "Malware payload", "value": "d8818b1953c9391a97b6cb8384ad045d", "object_relation": "md5", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572767, "uuid": "873229a5-e1f6-447d-a225-528a02b7eab4", "comment": "Malware payload", "value": "9af98932b061a935efc4e29f5db2a2fdff4c458fcd364c8c7475a4171e215ceb", "object_relation": "sha256", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572767, "uuid": "ce00c1a7-fccc-48ec-8e1e-98feeb27bc8b", "comment": "Malware payload", "value": "28f6efff5f2df5568995dbb07d9ce56a0e06ae97", "object_relation": "sha1", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572767, "uuid": "4c7c5874-030b-458d-affd-3f507b170902", "comment": "Malware payload", "value": "2d77b344f31eb05ff117dbe6172b3f4bc83df55e9fd9fad798a2697795397f0f5ceb3eff4745dbf37023b3fc131959ac", "object_relation": "sha3-384", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772572767, "uuid": "6179b10d-f744-4bbd-96e2-de40b70f26c3", "value": "T1A7E0F82178C8D0DC250237CAA288C609A8E340D43F08F4B21B8AC3DCF68323003A88FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772572767, "uuid": "c374bd28-8b1c-458a-8d49-526b474e2d85", "value": "12:qRHNkuqrw6s+2qp7UxMbedO89ojALqWNHF8E4:qrkRjD2qpgWkOpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772572767, "uuid": "c0181d4a-db26-4b21-8051-a0bffb79abf4", "value": 405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772572767, "uuid": "3b931f65-9f64-477c-9569-9b18ce18c388", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772572767, "uuid": "86a4795b-7008-4008-8761-fab2b44d2c60", "value": "dwgyuyb.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58048504-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772548579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548579, "uuid": "a49c0a0c-af09-44a9-9d9d-f46e7c7fa150", "comment": "Malware payload (PhantomStealer)", "value": "d40b1fae340920a4a31f5c71e79e4373", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548579, "uuid": "01aa0162-9c48-4ac8-9268-9cde6a2df6c1", "comment": "Malware payload (PhantomStealer)", "value": "9bcba202ce44d286302b95518a5bcd7f2bb9c772e2b866d828be06ffaf8676c3", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548579, "uuid": "10ded57a-7aae-40a5-ac3e-78e418af6b69", "comment": "Malware payload (PhantomStealer)", "value": "8ef6cc54b310814515bd0f840007c55fea3073ec", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548579, "uuid": "2a88892b-eb18-45b5-9592-e6b680e74530", "comment": "Malware payload (PhantomStealer)", "value": "b4af0c75b7c14225a89902c7c2d9564f4a4e42e039b93e59afa680e184dc0504a1fcdfeb706474c3fc899d9382c38953", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548579, "uuid": "95bca89e-64ba-40cf-9345-22fb5d10c697", "value": "T18026AE3B6C80FF59CAB8371570BBB40A73B1464EC0549DA9B20DB52BCB757070C96AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548579, "uuid": "9411fa76-37e4-47fe-a96f-8a2136038435", "value": "49152:FAFqLN5DwtIy5T1ujbq3bQRjOjVjFFIFuKltBUivn+8KyqJwOAPXmVuwj:Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548579, "uuid": "f1d4fd75-97b5-41cc-a6e1-3de4dc9bc577", "value": 4674237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548579, "uuid": "50ade9dd-8c46-47b1-94ff-5ac4ff0d17bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548579, "uuid": "704a1390-d048-43fb-8b59-16da087d2437", "value": "d40b1fae340920a4a31f5c71e79e4373.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecfb0669-1700-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772542816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542816, "uuid": "5d4c5fcd-e120-4fcc-806d-e46d8ad1e09c", "comment": "Malware payload", "value": "90ec48b6a8978836a6525f1db43b48af", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542816, "uuid": "72c8cf16-7742-44b7-aa35-6510c4298de8", "comment": "Malware payload", "value": "9c4b5a4d8766b7afd264f9b0c5a50dfa9572516b3b09cab43846137c251a752a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542816, "uuid": "5425847d-88e3-4344-b366-52325fad85c6", "comment": "Malware payload", "value": "65d9107e6e813a3616f299c2306c94c3d4c166c4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542816, "uuid": "18c427cf-83fa-47b1-b731-9d004ca021ad", "comment": "Malware payload", "value": "a8376aa94f635bab7b835b6b48563ad7431952cd62802729c61cb9110168c077c274759516d943bd90a7025a1e2d6fb5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542816, "uuid": "7950c3ab-7fbc-452e-941c-c7f4dccbbd5b", "value": "T10BD71283F79AE813D8F3C735867683669A265C544B53E3972945B13C0DBBAC08B85FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542816, "uuid": "c82eb86a-f6a4-4afc-9a06-c410af8d2900", "value": "1572864:cKqOQ4Yx8Re0V5WHWpiE050M0f08050M0f0XU6K54Dlwo//efOr4+BMF6JlE:cKqOQ4YeRe0V5WHWpiZuRcBuRcXO54SN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772542816, "uuid": "a2320ce6-5b5d-4790-b33d-8c4610798761", "value": 59767336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772542816, "uuid": "9b7b0ae8-16b4-4307-af61-efe04c97c6e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542816, "uuid": "755ac722-29b0-49e2-bea2-2270165f9804", "value": "9c4b5a4d8766b7afd264f9b0c5a50dfa9572516b3b09cab43846137c251a752a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f3a9308-16ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772542203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542203, "uuid": "0a6203fb-1a95-412f-a9f9-6b965cf5e79d", "comment": "Malware payload", "value": "8388e4efd32454a612be1625dd72d588", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542203, "uuid": "d946d691-be38-41da-b959-77ed5fe673dc", "comment": "Malware payload", "value": "9cf66f291d3a7f42ddd7393d8fbd95fc12e223b12fbdd31c52d8c46b3decb444", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542203, "uuid": "31f0996d-08cf-4f36-a9b1-96579057d457", "comment": "Malware payload", "value": "f26154c2de41d8ab9227a5f9f3d8edf3e0e98996", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542203, "uuid": "0896969b-3f3b-449d-8004-7cdabadf429d", "comment": "Malware payload", "value": "451445fdd8fb42da962aec92a516e5d04ce967511fcb1b687f578a9e29584797dc9048c4624e49c18053a9b178401fcd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542203, "uuid": "db1702ee-cc9d-437b-8753-99f0931f9aa2", "value": "T121B54A31779BC12BD96215B06A2CDBDF51287FA11F7250C7A3D81E6E08B48D29732E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542203, "uuid": "e5513552-45c9-4638-b29c-9ff2944f15e6", "value": "2565cbd2a560c6b3554de2985322d883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542203, "uuid": "e0dcc939-b899-4a70-a9f6-444b9bf310b2", "value": "49152:wfImZfi2k8XXSSRrHWaVFuHT8xyMdVkUD/Va+FN/BJ9+mIYDDTBZdC:wImZBk8XXSSRr2aVFuHIxmmTBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772542203, "uuid": "1566fd84-9bfb-4699-b627-514db91f75e0", "value": 2323680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772542203, "uuid": "f6e363b6-e62b-4067-bd06-02a59457c480", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542203, "uuid": "341c0548-1d06-47df-8621-dfa587fd29a3", "value": "ultragirl in dungeon ver 1.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c237b395-1741-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772570662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570662, "uuid": "38a3145c-9368-4c72-9348-d63301e00cc1", "comment": "Malware payload", "value": "97c157ff3a70a95e7a3b15c0b0f17e1c", "object_relation": "md5", "Tag": [ { "name": "Air-Gapped", "colour": "#528C43", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570662, "uuid": "2c5da20b-a920-4878-821c-698514aaa46c", "comment": "Malware payload", "value": "9d6b025b169e4a5357f9fa8b4de392db957ec7c6ce168ddc555a8ac2ce39fd96", "object_relation": "sha256", "Tag": [ { "name": "Air-Gapped", "colour": "#528C43", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570662, "uuid": "e0ca247c-6183-4109-8b8c-587f924bb6f0", "comment": "Malware payload", "value": "ec731ef331fb30aefdde48b973521af6fa288040", "object_relation": "sha1", "Tag": [ { "name": "Air-Gapped", "colour": "#528C43", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570662, "uuid": "196511fe-b4ef-4f13-8153-1c5a195a1175", "comment": "Malware payload", "value": "f002865c05efcb01a5fbd082b8e918ed8b3e02d309794fc6b78c3b9ef677ff9b87c0293ff77303ff458463417dc1f44b", "object_relation": "sha3-384", "Tag": [ { "name": "Air-Gapped", "colour": "#528C43", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570662, "uuid": "50e7602e-4eb1-4f3c-bc29-3ace989b9576", "value": "T1807533C7C1A216C5E41748BD3F713B3484B8A4F3C03A8AE5B54E5E5A7E9CAE218560DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570662, "uuid": "87ef0ad5-89b4-4a72-ba62-8e6e1fc9ea9e", "value": "24576:zj2/4mdy7ZxqcrOX5oCdOUhUiw7gJyWYgE0rLGaoBbI26vfPvd3+UmGk6CuSeMBp:zj2nQ7ZxqcrULdiT7HOVLGPf6PvdBTkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772570662, "uuid": "cf35a950-b292-449d-a7d5-cc8b870bf444", "value": 1561079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772570662, "uuid": "30b344c9-1a8f-46f9-94d8-37b7df5696a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570662, "uuid": "9b981b81-de8f-4c05-bae5-93045f5bd460", "value": "a8b8a92d170029885d4e7763675f10eb172150f8503592677cadedc392edccf4.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b7ea20-170b-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772547440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547440, "uuid": "889bce97-f911-463b-bf6b-ff19b06547e0", "comment": "Malware payload (CoinMiner)", "value": "778c352223045c5d17834a078f226e45", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547440, "uuid": "71724e05-b2b9-4f39-8592-ebb8b110895d", "comment": "Malware payload (CoinMiner)", "value": "9df564fca892f7a5c1f534d25774c3af3a6963c25dee539e2bb0062d6d60be9e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547440, "uuid": "33a7555e-69ad-4ab4-90c0-16de23fea94b", "comment": "Malware payload (CoinMiner)", "value": "5a287f664e28786e4769564b93e1b0527ec46e17", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547440, "uuid": "47ddbda2-1fa0-47d8-b747-45cf55e8544e", "comment": "Malware payload (CoinMiner)", "value": "8220a3fbaceefa1c2c1141eb4535b8291884119393346ed3de0e3c7792a60913edca2343f21dbaa22f94e2ad7dc9f541", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547440, "uuid": "e3fba79b-12e5-4810-9aea-4302ef9ac918", "value": "T13FC5233BB95C85B1D3AB80788902D546FE773C0207B355EB53A87BE949376E01D3A913", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547440, "uuid": "534f523b-2658-4ad3-a7bb-ba698adb4a6e", "value": "6bea6adc95c058cc06cdbe8fdd01354a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547440, "uuid": "085635c7-ee6a-4ffc-8e13-5fa47cefc4a7", "value": "49152:l3c1n7r9Z/qypLjDL5VLeb71JRAltFP0fkPomBUAheubzhgzY/7V:R0nJpLjDTefBAltFrPfjheuizYZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772547440, "uuid": "0f3e88d8-4411-4be1-90d5-fee05a98c25e", "value": 2551296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772547440, "uuid": "725c1730-aaee-4bfa-abe7-e4198844802b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547440, "uuid": "85c04e73-57e8-427e-abe4-cded41ffdfc6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc980ab8-1717-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1772552721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552721, "uuid": "a47626eb-3aa7-4a89-9c9b-f009978acfa9", "comment": "Malware payload (DattoRMM)", "value": "c7f31d56a6033341679153a7a2a17425", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552721, "uuid": "aae3bcdb-7d52-440e-82bf-13dd19cc1702", "comment": "Malware payload (DattoRMM)", "value": "9e61e713b3e6b067f8eead667d971c2be62e26cce6f3f87970e2acc847280d4d", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552721, "uuid": "e95034be-72ac-4593-971d-4259be66ea69", "comment": "Malware payload (DattoRMM)", "value": "4543b4b6d6deb4c193feb8f08835e3741184891e", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552721, "uuid": "f6390404-236b-4971-8d3f-a3f60c82cf35", "comment": "Malware payload (DattoRMM)", "value": "cf2cc416c9a85de4cb1493dcc81941299201f216f64e1855d2bcc62b3c1066f1791898dea4722eb7de6171660d7fc903", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552721, "uuid": "74c0b2ae-933e-4a9c-af83-670e93b4fd43", "value": "T1A8B63347D9778DF0CA330B3890D2196B3205980E485BF4C9F609277ADAF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552721, "uuid": "66e1a093-1ea8-4cdf-9cf1-43390b156db4", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552721, "uuid": "402f8310-aab4-475c-bef9-8dfe1c5256c7", "value": "196608:laZk+w9P+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2z:hngmzZFw5S9pE7Asjp29qIT0jarlZr87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772552721, "uuid": "ba494c4b-48fe-4c0a-916b-881859867a95", "value": 11056120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772552721, "uuid": "ff1b852e-c7be-4bc7-9e67-b4eae6550b37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552721, "uuid": "53588542-d747-407f-b424-eb701b567430", "value": "AdobeReader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db548aaa-16fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772540639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540639, "uuid": "e38d047c-d25b-4172-8f6a-6f7bf9ecb008", "comment": "Malware payload (Gafgyt)", "value": "05c3764d4749e58f9c4aac5e907b5420", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540639, "uuid": "012c086d-ccf6-4e6d-b4cb-c7c580e9cdf6", "comment": "Malware payload (Gafgyt)", "value": "9e66bb212c0c854d5a38afdee060489b7d316095e889e5c424a895778a306c5c", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540639, "uuid": "290f569e-6c5e-4513-b8e2-a8521ad8e584", "comment": "Malware payload (Gafgyt)", "value": "33059defb56a4ac9aef4c8c5f14f4a0580b3eae1", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540639, "uuid": "c89f4b23-c389-42e1-99f0-c831a541c7f6", "comment": "Malware payload (Gafgyt)", "value": "088d2a8f38e697c30b551c73fca45607d8beb8fbf1b9e9a565badd1a8289b1ba7731ad3bb3df39e08fac685c3aec5b4b", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540639, "uuid": "e23a3c25-7745-40dc-98ef-e66ed2294dd2", "value": "T1459318A2FD01EF66F00A8A3A45C707346630FF660B931E7172577A669A723C47427F0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540639, "uuid": "74052f29-dde3-4197-9abf-fe7752d5ec5a", "value": "1536:tkkfhBv27sG5Qai8GDN0hcb8g6UDuYAXibxw7y3kiO3IHUIN:tkkJBuMayccIgbNbxw7y0ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772540639, "uuid": "a8f3cbf7-9888-48d7-94e3-39cdf398c78c", "value": 89373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772540639, "uuid": "956e7c0e-c98c-4650-a5cb-d07a4ef71cc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540639, "uuid": "bd84a085-556d-427c-bf9c-3cfd608aa438", "value": "pftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e800855-16a2-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772502285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772502285, "uuid": "bbab0810-65c1-45d1-9f7b-f7aeae105500", "comment": "Malware payload", "value": "e07c51439add6ee45daaa97673592272", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772502285, "uuid": "67c8cd86-6477-4893-901f-053984aeaea8", "comment": "Malware payload", "value": "9fcae173a7925f6b00ded4f5a4c79c998e0d1c280b11a2b160065a095d723d34", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772502285, "uuid": "ffabd667-9406-4f83-a558-5613ef09a800", "comment": "Malware payload", "value": "bbbaede762498187f7e7849926c676c823be6c0c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772502285, "uuid": "702c3568-2f6f-4788-9c7e-e756888f76ec", "comment": "Malware payload", "value": "fc71b6125ca9eff14b1285351dc2cc0ade7b0d29a4b46e92fd1ce5aa642109eead05c87e5605b3e31c71aff3208fe1e3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772502285, "uuid": "60a7c561-6761-4c31-a98a-0f1ba7509c63", "value": "T1EA924CB512896C79FBD1DE399F3C6F4CADE982C42124B3ACBA0F39205A1166DC70535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772502285, "uuid": "69949dac-944d-4e0a-8523-5f269b6f1664", "value": "384:ZOicuQpWx+BL0SWL0gezsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:ZOi8i+BL0SI0hzsP4cbddr7zsP4cbddo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772502285, "uuid": "aae9c54d-3a09-4f20-8578-eafeaa4c872d", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772502285, "uuid": "c1b69a7a-14a5-40eb-857f-d764aea6e5f6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772502285, "uuid": "696b34f6-e87e-4960-ac77-67ab92a2e068", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a23dae15-16d0-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772522075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522075, "uuid": "d264f8e5-7a31-4578-82ba-d82fd1a65baf", "comment": "Malware payload (AsyncRAT)", "value": "b327d2ff7fc3759ca1a53943c535d832", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522075, "uuid": "a4596a21-299b-4e63-8378-97dffbc7c881", "comment": "Malware payload (AsyncRAT)", "value": "a0148beac0f18eed5beb051824a1a7ec307ba13be44f4808dfc1c15e628452ab", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522075, "uuid": "3377162f-36eb-4fdc-a8b3-eef9ff1317ba", "comment": "Malware payload (AsyncRAT)", "value": "652714651986c03bf9060ed9a21bfb4ab30ceca0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522075, "uuid": "d8180be5-0095-4972-9c96-ad41a8cee294", "comment": "Malware payload (AsyncRAT)", "value": "9bad9174916a4fd6b13f016b650c21fc8b62322d360060e6beca6becef520120f987db157430eb11e7ee1415952968a5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522075, "uuid": "ea6e391f-97f7-4cc5-95fa-3eac2090d678", "value": "T101D23B09B3D88561E1FD57B94C7292048775EE4BA963DB9E1FC440AE2623B88CF15FE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522075, "uuid": "289b1a36-7afb-4be8-bc3a-1d31f489bf0a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522075, "uuid": "e437ef74-dfd8-4678-9669-ab186e595cfb", "value": "768:xzCiRXbBJYMgsg/cIRGqou/Rb7fB/dTw/+:x+iRXFJYMgN1igRbN/q/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772522075, "uuid": "929cfa26-3b7c-4a57-8990-a19d727c64f3", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772522075, "uuid": "82d12ed5-7ccf-4815-8b09-06f3e272b9d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522075, "uuid": "da337bac-788d-4d6e-8ea8-67e66b310eec", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afdb0a2-174a-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1772574220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772574220, "uuid": "ea76e8d9-32a5-4095-bc00-440833dfa7fa", "comment": "Malware payload (Gh0stRAT)", "value": "ffa4ef8f837f06f91c7bde89008cbc5e", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772574220, "uuid": "417030b3-9b92-433a-a525-a11436d524eb", "comment": "Malware payload (Gh0stRAT)", "value": "a0fe984d89805965f654a0ab6baa43aa852a7cec93bfb49dcdc48d412914c748", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772574220, "uuid": "92f79ece-b61a-4c31-85f6-31ffc3cb46b9", "comment": "Malware payload (Gh0stRAT)", "value": "491d09ab2fc0c017d4a20dfe281a0f15ea1438a9", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772574220, "uuid": "9c17e666-86dd-4005-a03f-4b1043e9aa55", "comment": "Malware payload (Gh0stRAT)", "value": "7040b25ed911d7591cc73c45dede0a55235c28a4fe1059d0b729d73b27cb74c0c7c0b00219efda78ee84cb48d0bef63c", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772574220, "uuid": "e0ab9c51-a5b2-43ca-9035-f7f489441be1", "value": "T1D027337BD9DCC6F9E64B2558E184684880CC76A81B700466A95EEFF3302EF432535FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772574220, "uuid": "7ea85e9e-91f3-4236-9bc1-1035b794d2ae", "value": "393216:AwQGBYAbYkaWbfXSztJ9nC1kZ1FsK65KgXRW6XZawqnm:A3/AbY2Div93FsK64gXR3Mnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772574220, "uuid": "cadb72a7-71f9-4145-a84e-f9b99679565b", "value": 21104014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772574220, "uuid": "5f4ed777-2289-4262-81be-e6df13474372", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772574220, "uuid": "0f99cffc-a20b-40db-b3be-00ad501b1713", "value": "LinePC.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d0a44d-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772548836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548836, "uuid": "1a4b913b-f7eb-4e77-bf03-9730421b4df2", "comment": "Malware payload (RemcosRAT)", "value": "38ad0b93ca4218010f5c95b320fb4b5c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548836, "uuid": "9ba0301b-44ce-42ea-a0cb-cf38331cd10c", "comment": "Malware payload (RemcosRAT)", "value": "a20c0d8c528213634c00f34a21d192cb91998890eab02db5d60a3f12560730ed", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548836, "uuid": "68e7714c-adc9-4314-91fa-db10546e8512", "comment": "Malware payload (RemcosRAT)", "value": "ac8f4d779c1df20e8964f11582791ecc5f514d2a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548836, "uuid": "1d2d2e9c-a699-4525-82a3-103124fedb4e", "comment": "Malware payload (RemcosRAT)", "value": "efb9a6ca9583206ae7200a060d03e73eb427e18753fb8881c61d71e345ee3502c6bd80c6411bd1273e4ac1d1015ab89a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548836, "uuid": "306e34b7-8fc8-46ee-9a88-177da06824a0", "value": "T183B23F3EC9859FF40B2A31A2A56F7A12A5140363B8382A5CBDCFC5993B35514CBB10ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548836, "uuid": "e4cdd891-a9b7-4460-b25c-e375828e71a6", "value": "384:KRBQ7s9wPixpIJ66cehPYn8Tk9BcfhioPmGOXaMsmZpFco3/anstVqw16O6mgyG0:KfQ5sFfoROgcFH/aMgwuZyOoiFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548836, "uuid": "2759af52-39ca-4ba7-a357-3d03bdea7e52", "value": 23647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548836, "uuid": "3ba0a809-98fb-484a-9605-cbb781fe447e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548836, "uuid": "300eb550-5168-486b-8088-3d67287400f9", "value": "38ad0b93ca4218010f5c95b320fb4b5c.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd2a1e5-1729-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772560323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560323, "uuid": "307fee96-cd58-4836-99b0-11d1cfe203e2", "comment": "Malware payload", "value": "98c88c4fdde85a3813a34032835773ab", "object_relation": "md5", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560323, "uuid": "42070762-9596-4de9-a493-7b5a32620810", "comment": "Malware payload", "value": "a2159e9c0a147025b51772501d21715e3eb215836f17d23d32e44a4c803c7925", "object_relation": "sha256", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560323, "uuid": "e13182b2-309b-46f6-a0c1-2fe9393e46c6", "comment": "Malware payload", "value": "1a2796d35de9795bcffffb715860b5c08221a03b", "object_relation": "sha1", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560323, "uuid": "d719a684-43d8-479b-b62a-b6d7bbc7c319", "comment": "Malware payload", "value": "0a9f133dbc12a95728be12e6e2b63b9d25ea10bdcd5912f7fb67ff88bf110f9508e752b2005f4f46f23a929c87bf9791", "object_relation": "sha3-384", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560323, "uuid": "046d99e9-3828-48fe-851e-bf894cc0ff72", "value": "T139D0236C55B3C427D2E3723F3840EBADE93D1F434C01A98461342DDA3D095D0061A0D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560323, "uuid": "01d94681-c331-4f90-ac26-856be3f6a396", "value": "6:5j6OuSvb9P19OnoteyiXT+tiPx6It5EnuS9mt+lh:5j6Mvb9bOnUkTwiMIcgtah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772560323, "uuid": "17fe62f6-2d7d-4343-b40c-fe87585bc252", "value": 245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772560323, "uuid": "9b51eccc-c84a-4e51-89cf-ded6e8bc2460", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560323, "uuid": "49f4c984-d801-421c-98cc-d8cb8141b833", "value": "a2159e9c0a147025b51772501d21715e3eb215836f17d23d32e44a4c803c7925.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc0e62dc-16d0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772522118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522118, "uuid": "6a51b2cd-746f-4bd4-a8d5-997322465a8a", "comment": "Malware payload", "value": "009e8d25b32a5889a8dc66d0400d15f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522118, "uuid": "2109b7f1-8116-465a-8569-d08485fba433", "comment": "Malware payload", "value": "a24833b1f28eb37a7927dfdcfb2d27986e84b461ab7c6e57f1d89d2127a8bf3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522118, "uuid": "ac3f16ce-7d53-4b0c-8586-da5e5e53b0a7", "comment": "Malware payload", "value": "70ee530b2490a58d0da5cc3a9c4f6e7713286821", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522118, "uuid": "62c43a14-af28-402c-9a4d-0f662ee6c0aa", "comment": "Malware payload", "value": "f44627b9db4e16ac2d04a8c6bb7dc4ee0355fef3ac2d2ad2f34d95b565b00d509a78c9f31bd5cb9687eebb93ead5cde8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522118, "uuid": "83f75553-a96f-498b-8535-67d55cd0cef4", "value": "T17AE63317EAD1C872E8290535096FC4F2DA77BD3357A4C0E367D4782C8A63AD2AA35317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522118, "uuid": "8874f681-8bf9-45c6-b576-2597b9ccd02e", "value": "d619eda1a774da262071361b928bb2e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522118, "uuid": "5bc7e65b-91d8-40d2-8f32-191c6d30cec1", "value": "196608:6f1V40q8E6JEOygCnbGHOZm7V1E45B5Z6gf5JyuUF8XMoyodi57HQLK7QEYhEa:6X+6uMkbGHTp1t5I+yB8Xt6w5zEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772522118, "uuid": "fb4e89be-3f0f-44e6-9d19-8d0a34593f44", "value": 14146955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772522118, "uuid": "7b16d463-b619-478a-9939-8ee82f07b949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522118, "uuid": "4cc7e119-5f35-4eed-8a9b-2d30fe6c57e8", "value": "009e8d25b32a5889a8dc66d0400d15f5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5c5f5a7-16f0-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1772535905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772535905, "uuid": "c6906abf-86f7-48ee-8059-428983767a7a", "comment": "Malware payload (NanoCore)", "value": "61bb1b6d672d6ce0f7331fee7de6f553", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772535905, "uuid": "c4877811-fa83-43e2-9594-4392d0c0f105", "comment": "Malware payload (NanoCore)", "value": "a2d004f78528c839119532cff09cf6f777baea9b1680d69eeb82d6a7700690db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772535905, "uuid": "a4e45283-a7a6-4af1-bd8e-10a2ae6e7d26", "comment": "Malware payload (NanoCore)", "value": "3f5723fb17af1da35846ecd6c6e7e4402e231d5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772535905, "uuid": "0d588fc4-e512-4e92-ba64-9c8054709fbf", "comment": "Malware payload (NanoCore)", "value": "2ef54b2a54abc2deafb44dba631f20007226f1fc8eb3d98453055f993a6636f6a134c2959828574aeaa1d8718a44d2af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772535905, "uuid": "995c7769-e0db-401c-90ad-1e6b0d1caa39", "value": "T11A451211B7C180B2D5B32A325AB68660167C7C212F61CA8F53E07DBD6B756D1C632FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772535905, "uuid": "83a94556-47c6-4d94-9526-1637666737a5", "value": "99ee65c2db82c04251a5c24f214c8892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772535905, "uuid": "ed672b1d-e4fd-4483-9428-4816cd4b1956", "value": "24576:hN/BUBb+tYjBFHL68K431bB8n+S/Dk0Z74Q/iX1zJ54D+qN58:jpUlRhTK431lSLkQqX1zJ5w+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772535905, "uuid": "46ac9b85-2788-442c-ba71-dbfc3770f7eb", "value": 1186257, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772535905, "uuid": "028e4e6c-deb2-4851-9490-3324d7284242", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772535905, "uuid": "6ca71ae7-e970-418c-a060-c48e0224a065", "value": "61BB1B6D672D6CE0F7331FEE7DE6F553.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7996cb83-1708-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772546059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546059, "uuid": "f1b10347-1240-40d2-8251-f19e2f1acea7", "comment": "Malware payload (Gafgyt)", "value": "cfabe5c5738ff56221629a89d5eeb066", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546059, "uuid": "888c4a1e-c176-4890-b450-af907fe6cb71", "comment": "Malware payload (Gafgyt)", "value": "a3a0dcd8d8a9bc8a4172589724f2969cafdb7942ab83f23f918338e7f8df9e2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546059, "uuid": "33d55bbf-11b3-4691-8ea8-54cbb31ceb2c", "comment": "Malware payload (Gafgyt)", "value": "95d87ca1d337b010d595a3855d815e6dec9d9ac3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546059, "uuid": "2c921dad-2429-495c-a337-0e95e85a61c0", "comment": "Malware payload (Gafgyt)", "value": "b765f47e4cddf44479bd7d7ae52335680d39c1b282baa2fd2dd52ddc3d651b6c184f6701b2f9cd7b07dd82f92800447b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546059, "uuid": "e4a44611-ff8f-4c37-80db-f67c01588e49", "value": "T1F3F31945FC919F26C6D612BBFB4E428D3B1A07A8D3EE720389255F24378B85B0E77152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546059, "uuid": "b8cafe75-6b37-4556-8323-662fc739c111", "value": "1536:hzYg/WnMNOefLIP6xzpzg+ISAAU7TmPMnxHvADpMVT/Ey8KifUOHYiMI9V/l9LwF:X/boefLZKd7qeAyVwy8LE/Y9oj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546059, "uuid": "0228717d-263d-407e-86a4-f7fb56a130c7", "value": 158432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546059, "uuid": "84251a86-d001-44e8-be4b-bc20f050aa73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546059, "uuid": "331eec1e-a54d-44f0-8a18-f2c48b3f2803", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82222fce-1700-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1772542637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542637, "uuid": "7145821d-6ff7-4232-b3e9-e0d032789925", "comment": "Malware payload (GCleaner)", "value": "4030d6ae880380fab20d3fb04122bba4", "object_relation": "md5", "Tag": [ { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542637, "uuid": "01460087-ac21-43ce-bad2-5bd85d0d0b28", "comment": "Malware payload (GCleaner)", "value": "a3afbb6771a771ea61ccb77d4618f1003071a9b337bbfdfeaad46a0a3d6ce58a", "object_relation": "sha256", "Tag": [ { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542637, "uuid": "ffca4306-bf7d-4ade-af99-5455a5c62136", "comment": "Malware payload (GCleaner)", "value": "b8343eda8ff1911553ba8f7eef9353711ebeee28", "object_relation": "sha1", "Tag": [ { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542637, "uuid": "40e2055f-3668-4cb7-a1e0-dc3f39ca091c", "comment": "Malware payload (GCleaner)", "value": "8c96dddc01c40c110940eaf57fb210bf990cd84da4198446f3bf3f066abb8a1e423702ea6686bad841842658be01315f", "object_relation": "sha3-384", "Tag": [ { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542637, "uuid": "4fe6443e-c952-45ff-a532-f4a28a5bb34e", "value": "T171850219E7E405F9E0B7E575CE834906EB767C4A43B1D6CF03A4A9661F232908E3DB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542637, "uuid": "edec3e57-2974-488d-96e8-3cc328eca63f", "value": "7c75a83e117d2bdfb2814c53e840c172", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542637, "uuid": "0bcad7f1-3d81-4bf4-b0d9-c983ac8ac5b2", "value": "24576:Xb2+CvRSEHiRkTJrpxFn2J9LzPqZHHUDpGfSZWacCo3WGPJ+RxcjalcIa1CcmEIR:L2hvRhHukNdn2jeHH3n+om+J0q6q9mD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772542637, "uuid": "a49ebf67-6a7f-4508-a9c5-4cb9410ecc68", "value": 1710609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772542637, "uuid": "2a597a66-d4a0-4eb1-aaf3-580087152920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542637, "uuid": "cc4cc44b-ca8c-4396-9127-22b0bcaf4064", "value": "a3afbb6771a771ea61ccb77d4618f1003071a9b337bbfdfeaad46a0a3d6ce58a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96d7584b-16e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772531075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531075, "uuid": "2823f0b1-ca27-4644-9eb5-07e4003b909e", "comment": "Malware payload", "value": "89b9d19efd3445045b64266d303364b6", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531075, "uuid": "da47c13f-6166-4ac0-ad09-bc4e045df59b", "comment": "Malware payload", "value": "a48397a17606f701f5be19960eb1a3a84c8939f838d294672f85ca9a906b2d11", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531075, "uuid": "9bce54db-e8fc-4bdc-8f77-6f90657ab43e", "comment": "Malware payload", "value": "a8355ab29542bf807b1c2deb893f7971e92e3f0c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531075, "uuid": "f4fcde51-8949-4e53-b4af-c7f3659ab1e4", "comment": "Malware payload", "value": "e924f63053498c9317e4507294286ff47bfcbb0a8264a99d9c6a19c3f0895a3f7ea5515cbd406c8dbc9750d405c52491", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531075, "uuid": "ef02f032-c244-4cfa-b259-cc3ffe422e49", "value": "T10A31548B328A91BD06224669D51C01FAFA4C5753831464B835F1C485BE013DDCADB7CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531075, "uuid": "559658c8-a597-4cbe-8763-306be4f426f2", "value": "24:w1lzUUIxdMOfl89r55uxIfF5GABkldXayhmFrvruoqOLqfD38AviBRY:mlzf0dMOmuyfFzkldXvATatOLqr3MY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772531075, "uuid": "adf1005e-d484-4df5-a472-0fced266a855", "value": 1685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772531075, "uuid": "3a4ddd98-9351-46d7-b391-9bf07cfdfd61", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531075, "uuid": "a2e95ad4-3d62-4f16-b99f-2a8d7f35c33d", "value": "Zoom.setup.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2bd6d5-170c-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772547595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547595, "uuid": "e3945e34-eda3-4ad0-a7f5-a6d760980bcc", "comment": "Malware payload (RemcosRAT)", "value": "90f2d3a75cb86c76be8d01bfd8867693", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547595, "uuid": "36962c79-bfc0-461c-b126-a4b518b0460e", "comment": "Malware payload (RemcosRAT)", "value": "a4b51abf49ed79024d44cb91205b233892e69b58b6a60c36c709f0037ee5b36e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547595, "uuid": "41bc16bc-4a19-4482-91a0-cbd0fb99f287", "comment": "Malware payload (RemcosRAT)", "value": "3bb7eeb293a7859100d71af3c649e837ae0eef27", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547595, "uuid": "ea8cebb3-53e2-4dac-8279-eb72bda53646", "comment": "Malware payload (RemcosRAT)", "value": "69920833b1eaaebc4c4c12c16bb15b51eabbb6675dd0fbf93d3a9b763a9c8cb96e700733e5a84b827f8df037cdf40d01", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547595, "uuid": "2d556dff-7703-41ea-af52-1728eb03918e", "value": "T1BCD40213A3A6BDDBF81A53351CC05551A20BBD70472E881F7986736A5D7F2E3A4A332C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547595, "uuid": "86f515ac-becc-44c3-bf00-b6a64f2adced", "value": "12288:og3GhVuLccGryQlg3GhVuLccGryQObLg/Yp/dCBWCx:ogGuLc5lgGuLc5Obs/YbS9x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772547595, "uuid": "f5b73286-3deb-4962-8d7b-2e6adb33619d", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772547595, "uuid": "513b027e-2c1b-4d97-8e73-e67b96bcfe34", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547595, "uuid": "bd205808-9879-4b90-a707-96e7fbe205b2", "value": "90f2d3a75cb86c76be8d01bfd8867693.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cbd225c-16df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772528267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528267, "uuid": "c0eb4ce5-b863-4047-83b6-b3a6dc2ece6a", "comment": "Malware payload", "value": "23aa65a21718bc893bd62c8f0c761e7b", "object_relation": "md5", "Tag": [ { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528267, "uuid": "5b723a7b-d166-4d27-9cad-646379f5a4ee", "comment": "Malware payload", "value": "a59a22edfbfee459c6d8bbfb15f1f462207ba1d0a7ea0da4813b751130bc4e5f", "object_relation": "sha256", "Tag": [ { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528267, "uuid": "f62a1f0b-58e6-41d2-9698-58e01caa2ea9", "comment": "Malware payload", "value": "c4e6b4b415acddb7bbc93ca428a58bcc68dcde9a", "object_relation": "sha1", "Tag": [ { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528267, "uuid": "9db7f2ad-1e13-4097-8f75-c0169f7c76c8", "comment": "Malware payload", "value": "12e835308b13bc3d232cf4dc4233af90d33b25cc1a28330773beb82d5a2864812cd20c981ab24f4ba9ed8c5096a6635c", "object_relation": "sha3-384", "Tag": [ { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772528267, "uuid": "e5656568-ea7c-4691-a79b-ce2b69e07a0e", "value": "T17C828D7252AD6B895E793B096AB015BF42F7D15B03B25AC83E02AF0FDFE9410431A589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772528267, "uuid": "90cc0f80-299e-4fb1-9d5e-6f811b7d8574", "value": "384:QR8j43euzL6b6YKwGRh/MLqLfXmDjkfrUXoe4DfbhZz/6tykd8HgxjHewFb:QR8G+b6YKJMLpDjkIYfFl6tyVAx7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772528267, "uuid": "1cf4fe65-13a6-4fb9-8994-403bd028ca43", "value": 18685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772528267, "uuid": "98ef2986-decf-43e5-a919-0d96c86e67de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772528267, "uuid": "70e721f8-4935-4bf5-89fe-809f6c531bba", "value": "a59a22edfbfee459c6d8bbfb15f1f462207ba1d0a7ea0da4813b751130bc4e5f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc6cb95-1708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772546062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546062, "uuid": "11077768-f1fa-4055-a507-f1f8d36563bf", "comment": "Malware payload (Mirai)", "value": "cf2d3188f6fb3ab87ca7113bc2792016", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546062, "uuid": "60d2976b-b669-41cd-ae81-afd631f440ee", "comment": "Malware payload (Mirai)", "value": "a6747f2bdada0b7313d94228b65f04442cf5df09c3299605efec6994bf305886", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546062, "uuid": "6677a468-1849-424d-a1d1-f7d913fba35e", "comment": "Malware payload (Mirai)", "value": "ccfda5d60b34ea477b8d81f89f803d53b5a767db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546062, "uuid": "116289d1-6f38-48e3-baed-19b406736cb9", "comment": "Malware payload (Mirai)", "value": "661e50afa9fe84d8d0adb96fa298e99870e7a65dbb959fc60b1161ee90dbf82cc2aa591a46e2ca89e341108c308792f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546062, "uuid": "e44d63af-0fc7-401e-a597-02816f4a0aff", "value": "T10D733A55FD819613C9C512B7BA6F028E372627E8E2DE3203DD262F21778792B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546062, "uuid": "2259812d-6e6e-49ee-b9f1-0113fa9a5ddb", "value": "1536:k1wtlHYhF95ZBPODE+OLmw92s9w7MBGSlr6yAV/RxY:kGvUF9HepOLXIsQMBG2Wy4/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546062, "uuid": "1fe44356-bed1-43eb-9eac-ed291f50f607", "value": 77280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546062, "uuid": "c82acc36-a18e-4688-8a87-eb053949fce0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546062, "uuid": "0ca9c6ac-8a67-4679-a016-3a5eee81885d", "value": "titanjr.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "840d9f3f-16a0-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772501409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772501409, "uuid": "fc6c1b1e-de5a-4606-94f4-ff46f003cb36", "comment": "Malware payload", "value": "3539471c2b312631f45f293ac5c48746", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772501409, "uuid": "5ce01d5f-c0a6-4147-a402-0a1545bfef48", "comment": "Malware payload", "value": "a763da40a16ed0531c8877ff883c93aa3a22df4ee1cf4e63fd674350ed03f881", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772501409, "uuid": "7f07ad15-e0ce-49aa-a0b5-ef35f858885f", "comment": "Malware payload", "value": "0d735f24095056143e016a0c2af28c0ac58ea629", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772501409, "uuid": "4dce0dd4-f648-4fea-ad69-3c44b4dea17e", "comment": "Malware payload", "value": "f7f27bc801f3bb9df06a47937313dc0d329cce7b343cc7c79158364a039c019665babae18118d1a6bb3a3deb4704c0da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772501409, "uuid": "c12d7246-7d18-41ac-a582-2abf622fef4c", "value": "T124058C0EFAA1C876C1524731A9D2DBB5E227BD100E618A4723D0BE1F7B316C1DD2EE65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772501409, "uuid": "00d02646-01b1-4fa9-a670-1a6c33701df2", "value": "95288a963cd9d54334022e8855b20b80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772501409, "uuid": "cc5b434f-25d3-4a20-a4fc-8052557a74d3", "value": "6144:5d94PS09OxD/i4rfM5yymzSMKNkB6dBL3jsr+AqT3EtcHqQMb3MP0pD8+V3q:W609O04rfMkGpdSrdqD3KFL4A8+V6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772501409, "uuid": "022022e4-58ca-4f3f-874b-1b6dc6414965", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772501409, "uuid": "96c0e0cf-4ea7-4481-8f3b-b10f95f6b1c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772501409, "uuid": "18ed76b9-8e49-4744-9910-37c7a9f11b89", "value": "rComunicationTest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ff8e0c-1758-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772580412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580412, "uuid": "0806fa98-5b19-42c4-b5f1-576cdcde2e53", "comment": "Malware payload", "value": "c3a9c64c1da331b642240fa19920b381", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580412, "uuid": "863dd2a9-4e84-4d44-be84-b6a8a2b51213", "comment": "Malware payload", "value": "a830f94d77024ffe6a407ba44d6f5abacd4b91a5e0df9b6998cf7c0b76521132", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580412, "uuid": "7ded57a0-144d-4316-ae10-b5397116bf95", "comment": "Malware payload", "value": "ca2592a4d47b3cc1320067cc8efd55cb7738b33d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580412, "uuid": "92766258-b197-411d-9961-d2469d4163cb", "comment": "Malware payload", "value": "cd3d438f088896b63d4a52c54ed2499b6947cbe0b4d15515d3b70ce1a6f63a118268e89f2ea0470dcccff2c04ab2e268", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580412, "uuid": "ca3f16b6-48c1-427a-a984-97a0d54f45d2", "value": "T14F54CDCAD3BD178E71E5E91E9C723119A3934FE08D0A851D108BB3CA07DD1E29E19E76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580412, "uuid": "9a6ba9c1-39f9-46e5-91f3-8fbe63ecc047", "value": "6144:RCA/YrGolZPRZlBTMikoFKqjRcMM33bBWRfXQa:oA/cZZDwQFK23M3314Xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772580412, "uuid": "d2372fd2-2857-433d-9339-e7fe611f628c", "value": 299748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772580412, "uuid": "0985f6d4-c258-4b42-882b-0c254a62b084", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580412, "uuid": "9a88d9ae-46df-4d41-8e2e-45ba4b333c04", "value": "Client-built.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8f95c9-173d-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772568830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568830, "uuid": "7214b9dc-f2a8-4c82-8899-69916cc1ed16", "comment": "Malware payload (CoinMiner)", "value": "dcb6de04f727aee7c6794b19af03824e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568830, "uuid": "79263246-b8ae-4eff-b479-7ffec75dd8df", "comment": "Malware payload (CoinMiner)", "value": "a8f0697c54d7c3785c420c892ef36711977917f93c8dae3687fe8643428c94a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568830, "uuid": "50f8d897-74db-4167-9111-70ce68b626ae", "comment": "Malware payload (CoinMiner)", "value": "2de25f971f867532da2aa0d0902ed5707ec95bc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568830, "uuid": "c991cca1-bd15-4810-bfc7-f1799eb9b172", "comment": "Malware payload (CoinMiner)", "value": "1bcfb5036a8c82881385a2bab573684f2a33b6c99835763c0decddb5cf7577ffdb0232cefb9ffdcdd69ee39bba37b1b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772568830, "uuid": "41390300-0cec-45d0-b617-241ebb76b438", "value": "T120973371AC64D817D6E80873E8519530BD38A7342B5FC87BCED3980938691E5AFBF216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772568830, "uuid": "20ee80a1-72c1-45cd-8683-bf2907701441", "value": "dc78060b861de085d3b25326d5393553", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772568830, "uuid": "c4638e34-184b-4e7a-92a7-7f97a31a4a52", "value": "786432:hg+PBKO1C3YUiT3MTcM6rVWRBxxWUXgdYNtj7EnK/IDUZ1WYNIdL+:KpO1C3FiTGp2cxQUoYNx7aWIQLWYNIdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772568830, "uuid": "6337b2a5-1332-4045-b276-3c6f9978ad3f", "value": 42954516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772568830, "uuid": "5f663d8f-e4ff-4fb4-be8d-ababd69687b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772568830, "uuid": "45d023ac-7fd1-4761-a303-f5e63aeb09bc", "value": "Installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9546fb0f-1758-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772580465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580465, "uuid": "2d1808d0-1431-40b6-9636-f1306be95bfb", "comment": "Malware payload (SalatStealer)", "value": "00dc4eeb2e7fee9342127e91227b6e2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580465, "uuid": "f6e27240-14dc-44c9-8165-9d30a6123825", "comment": "Malware payload (SalatStealer)", "value": "a9e86ac2e01cd4efa4a7e5ba3a46feed62695b09f3a5c4a226d8f2df85af9e3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580465, "uuid": "7e9beb86-0753-4ce1-b5f3-f511c887e704", "comment": "Malware payload (SalatStealer)", "value": "4139a866de2067a4f70358d14deeac331b7996b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580465, "uuid": "e1ecbca5-e49e-4746-a3b3-3ea384c10459", "comment": "Malware payload (SalatStealer)", "value": "c65c9d230a1e915ab31652f76caf35cf746605e06103e2849f564e0d2aacef0d8bd66c5765627859b9030f13d3755531", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580465, "uuid": "66d18b97-d4ab-4b87-ba56-2294293f502d", "value": "T183E533EB5E7A6BC5FD7F8E758983530680078344B53DC852C6B77224268307B65CA2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580465, "uuid": "0b175c93-0b70-434b-900a-d6892199df51", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580465, "uuid": "1c2c802e-f100-4591-8cdd-c7eb505b8ec6", "value": "49152:VIUwBfpz92DuR7+EkUJQuBR1MXyUyCQGTZQE4zkRzUeF9+E0hNm+n95pCDJXgbWH:mHpZ2DCKCXzUyCvcz2weF90hU+9k0vB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772580465, "uuid": "cb0a8224-b981-4544-9d0b-e520a5e68243", "value": 3298304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772580465, "uuid": "13cecda8-dfb2-41ef-a58e-91480ed3040c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580465, "uuid": "25f5378f-089d-474a-8548-ee6eeb1aeeb5", "value": "FlowHelper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18fcc286-16ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772542031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542031, "uuid": "3a114ed8-adbc-48ba-8447-44743ee29c3d", "comment": "Malware payload", "value": "ed5c280fbd057c23a809c070c6cc51a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542031, "uuid": "303d7359-2b50-4a3c-99f6-1ef8ca6e1134", "comment": "Malware payload", "value": "aad8c636482191726caefd45585949710c9c2d7640670f3f2179617d53cc15a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542031, "uuid": "e3ae8da5-2110-4660-b960-575cc40c0a6c", "comment": "Malware payload", "value": "94c04bfbe1feef73fe54c0355791bca9b5506dcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542031, "uuid": "c80ca2ea-0d50-42f4-9812-c4cc7099871a", "comment": "Malware payload", "value": "9639cfbdffa3467dfa02e94612e1b63cf82e54666fa3f9a11dfb301202ebf45385d66f6416efea8fed71e4e172289cd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542031, "uuid": "1e198656-4ced-47db-ba0a-0eff5a72256e", "value": "T1F2C56B71B686C12BE9720A70662DCEEF115A7FB91F7160CB52C87D2E14B64C35232E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542031, "uuid": "a908ebdb-80e8-49b8-ad7f-a23ef1bda9f6", "value": "2565cbd2a560c6b3554de2985322d883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542031, "uuid": "229fa939-866f-446f-b73e-cbed686f2e54", "value": "49152:5fImZfi2k8XXSSRrHWaVFuHT8xyMdVi5XqlUD/Va+FN/BJ9+mIY:5ImZBk8XXSSRr2aVFuHIxgxql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772542031, "uuid": "a1d4422d-8a82-46f2-8bf2-250dc9508868", "value": 2678832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772542031, "uuid": "601dfdfb-76f8-4e12-931a-5e9d868138e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542031, "uuid": "a6b31e44-c4f7-4bd8-a6eb-facb02405759", "value": "DDinosaur.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db9fa022-1723-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772557820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557820, "uuid": "5b669902-4010-4ecc-94e2-3d9b45aea26a", "comment": "Malware payload (Vidar)", "value": "52fd5efc155010013f0b51fe55a3ef74", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557820, "uuid": "88b116b6-d3bb-4c70-ab31-ee5c047ed397", "comment": "Malware payload (Vidar)", "value": "aae5335b89c8655cffbd9e2e8de1726be6bc38e68dcbb048aabb03a2012640aa", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557820, "uuid": "3d8e9e14-7610-4332-9538-1fde56edcd37", "comment": "Malware payload (Vidar)", "value": "13b062ded24b76278123a82caa620328c9680b70", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772557820, "uuid": "06f6846a-e74f-4938-b99b-d89997820ac3", "comment": "Malware payload (Vidar)", "value": "aa2e60dce30f9fd8947d582ba0f2973fb2245684b84f4bc92940ec711599533b1d4de420fa2d22f9b0ab9b78c14cced9", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557820, "uuid": "465d3f84-3c7a-4398-a0cb-c65a80458829", "value": "T13D958A07BCC425B6D5AAD23289B152A23B31F85E0B3177C33E95A7B82E763D41E35784", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557820, "uuid": "845a4700-50f0-4bb7-b443-03e843d00f71", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557820, "uuid": "ec1bd2d1-6e80-4d02-9e3e-8e612fe76196", "value": "49152:GPpim5rB+40T7DYEwM/YtkbUQMYgtUDK1:eoYEwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772557820, "uuid": "12bc428c-683a-47a8-b7e4-9afa7d3791f6", "value": 2032640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772557820, "uuid": "514a7e76-2480-46fb-bb1e-269a74ba8319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772557820, "uuid": "e81a283d-4046-4b6f-9ad1-208b6eea8df3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f333254a-170e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772548840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548840, "uuid": "4ab0472e-1c7d-4b31-95da-0fcdf4f566b2", "comment": "Malware payload", "value": "0346d12554f26322f5dfe09c74a81382", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548840, "uuid": "16aa7930-37f5-4c9b-b35c-e3e789b51d9c", "comment": "Malware payload", "value": "ab09c9b045c6793b8c44e1479accee6d8d99fb5e39f33999cbf4e27c3a9ed711", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548840, "uuid": "7a9470fd-3c08-4f02-bff0-0864ca3c38ee", "comment": "Malware payload", "value": "3f21f31ee38675ec520f0f8b2d9a76877e068844", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548840, "uuid": "ae1923da-4956-45c7-b58c-8d32f08ce997", "comment": "Malware payload", "value": "f5f07d9b5438e418b98c623288be3e6b47975e87320f47c1af038b753dca4525f0e756840dbd23dc4247d0c09001afa9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548840, "uuid": "cc8dc600-41dd-49de-aad1-6ebde2e106d3", "value": "T12A35E51D697ADC78A18FEDEAE8CFBC5A54CC0FA81708E9431851B6600CDF5E837E1466", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548840, "uuid": "f3d675d3-8971-4750-a841-472768f17ab8", "value": "1536:xsssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssse:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548840, "uuid": "161636d7-a672-4746-96eb-149fea126ec0", "value": 1155265, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548840, "uuid": "05d6215f-371b-4a82-b5e1-a1e82ac67a32", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548840, "uuid": "6eb1534d-02e6-40a4-b8bd-ac7a38dfade1", "value": "0346d12554f26322f5dfe09c74a81382.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a64f40f-1704-11f1-a769-42010a9c0008", "comment": "Malware payload (Neconyd)", "timestamp": 1772544288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544288, "uuid": "cad4cac7-d39e-4033-81d7-0f8dbb3e735f", "comment": "Malware payload (Neconyd)", "value": "95f53f2681e9f9d8866c785a94202eb5", "object_relation": "md5", "Tag": [ { "name": "Neconyd", "colour": "#FC7553", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544288, "uuid": "2d5112a8-b3de-438b-b5c9-80a0d919f9b2", "comment": "Malware payload (Neconyd)", "value": "ab8a2dea295d6d377736c9c1ad3a56f04025e8328e5dead19ccdf180fa20d5e9", "object_relation": "sha256", "Tag": [ { "name": "Neconyd", "colour": "#FC7553", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544288, "uuid": "bcb6d776-9f17-42ae-81d3-408238fafeef", "comment": "Malware payload (Neconyd)", "value": "4996e09de3fdd4ae47f72498924715590fce95b9", "object_relation": "sha1", "Tag": [ { "name": "Neconyd", "colour": "#FC7553", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772544288, "uuid": "a5a5ee5b-0533-4f54-9623-f713606b6492", "comment": "Malware payload (Neconyd)", "value": "c521a0edd2e1e78717961762c33a11117f30c85a646b69bed71b749a968b22b4aa0847281b3e4835efae4f76144e6ded", "object_relation": "sha3-384", "Tag": [ { "name": "Neconyd", "colour": "#FC7553", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544288, "uuid": "c9b5caab-4f8a-4ae2-85b1-2b3628fa7dba", "value": "T12DD3BE0BB091C632C43600B8095990425E3B6D322B768777FB98F17E1E31E9F3B29E65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544288, "uuid": "1d0fe0a4-73d7-4d9b-81d4-ebfd75bb7152", "value": "404361c37a0fd175e596a2bb117ba8b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544288, "uuid": "516518d8-319b-40be-b503-4453ed4e4a82", "value": "1536:hDfDbhERTatPLTH0iqNZg3mqKv6y0RrwFd1tSEsF27da6ZW72Foj/MqMabadwCia:BiRTeH0iqAW6J6f1tqF6dngNmaZCia", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772544288, "uuid": "c8552c53-9b67-4a8c-bec6-5389220b92ef", "value": 137216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772544288, "uuid": "e6af3dca-3a9d-40b3-a1a6-708c0b10d7b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772544288, "uuid": "a545706c-db80-4bfc-b963-c2990c4ed696", "value": "ab8a2dea295d6d377736c9c1ad3a56f04025e8328e5dead19ccdf180fa20d5e9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df1379e4-16e4-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772530767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772530767, "uuid": "f778f1c7-6edc-4635-a384-ff0288a3693e", "comment": "Malware payload (Vidar)", "value": "45bb3a259c36f008a8c25ff89ec9b0ff", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772530767, "uuid": "74ad3e30-90e5-468b-87ea-108adef1e497", "comment": "Malware payload (Vidar)", "value": "ac16b746beb8102fa45b69901a5f88d5c4289da12428c4e2fb421bc6418c45bf", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772530767, "uuid": "eee26908-4c86-4a79-9ccc-cb92711c6753", "comment": "Malware payload (Vidar)", "value": "3ff04b9ba2919bf0e47611d015d09629e9a25fec", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772530767, "uuid": "eb5a49e7-cbf8-44e8-9c14-db86d85884ea", "comment": "Malware payload (Vidar)", "value": "d85bb44b1d85fef79ed1051746bb205ea0e67bbe7166835d3481ba16d22ff336f8649867b2502d4b0444146bb258e0e4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772530767, "uuid": "989078c0-82a2-429a-9794-2708e632a6ed", "value": "T1818607AB72B9816BC21D853BC096CF40F4F771755B33C5E382AD03699A428C58F7A9E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772530767, "uuid": "6141df08-6b01-4f49-b645-3d63a8da7cf9", "value": "98d407ce7cb1a3b4203bb905c8b5b3cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772530767, "uuid": "2f47ee83-6c56-425d-bdbd-54bc49342e03", "value": "49152:3BWw3ljiKrjRxjeJXQaaD1QSy5G95iVOtD+SbZPurqwsjfLaRm/wjpkkJmxMj1D/:3rMepL1vL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772530767, "uuid": "08980868-2503-4355-b90e-b3f5036f0fce", "value": 8115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772530767, "uuid": "d6201902-7972-4293-a251-8e4cc4bb50e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772530767, "uuid": "a3cab44a-1870-479f-aa26-ebe368980150", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c192ce-16e1-11f1-a769-42010a9c0008", "comment": "Malware payload (KarstoRAT)", "timestamp": 1772529351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529351, "uuid": "e0bc9674-5517-4936-9c17-29822a3f37cf", "comment": "Malware payload (KarstoRAT)", "value": "a5bef919eb260af5bb8eba243ed4fd75", "object_relation": "md5", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KarstoRAT", "colour": "#8F853E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529351, "uuid": "7f99201d-f0d5-406d-8461-8e28fbc06277", "comment": "Malware payload (KarstoRAT)", "value": "aca3f2902307c5ebdb43811b74000783d61b6ad29d7796bb8107d8b1b38d76a3", "object_relation": "sha256", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KarstoRAT", "colour": "#8F853E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529351, "uuid": "8438c697-e166-4ce7-a264-fbc60aa4c2f1", "comment": "Malware payload (KarstoRAT)", "value": "c6297eae6d141d5f803aaeb2cec08328b4ac4183", "object_relation": "sha1", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KarstoRAT", "colour": "#8F853E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529351, "uuid": "cbbe31fd-a470-474c-aeb5-869717914990", "comment": "Malware payload (KarstoRAT)", "value": "ad3a22e00deb3d6da8e701d768af0f7d080dcf1418745fbc7dfcca43f3d19a33c2bbf15ec4b83df225094f54cd7b1d30", "object_relation": "sha3-384", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KarstoRAT", "colour": "#8F853E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529351, "uuid": "0f07f336-2834-4d75-b3a9-07fcfc0424e7", "value": "T17E93182ADE16607DE16AC6BDCA868D91DF32BC8547D1ABDF47900CF14D622D06F3A603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529351, "uuid": "a76f356f-b620-4840-b5e7-7f0bc370e7fa", "value": "5cfe20f47877b1211f4d273ca14791b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529351, "uuid": "3a698ea1-e0ef-477a-af4d-abf861043e3c", "value": "1536:UcFeNvAR+haMKxkIYrb7cLDhN+3AD+X2aiDOWfD58p+xbDLua:myCaz5AXcxN+QSGfr5vu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772529351, "uuid": "92954a8c-3f25-4742-9a65-0a7f798e4e8f", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772529351, "uuid": "9a7c52bc-cde9-4b3f-9c63-f5d97fd42628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529351, "uuid": "e5867436-b289-41a9-a910-5c72f7400462", "value": "Project1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b22b3fc-171a-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772553792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553792, "uuid": "eb38ed55-86b9-4f99-b7c8-a203267af244", "comment": "Malware payload (AsyncRAT)", "value": "907234ac22c7e501a5f8ccf86606628d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553792, "uuid": "28a724fd-4931-4d1c-89e8-39762a8bad4a", "comment": "Malware payload (AsyncRAT)", "value": "aecfabd96b0551eae1be95dee23e6028d3d3eb04dcaf8fbdb55783d219a40731", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553792, "uuid": "af2e4daf-f9e4-42fe-8316-aab9ec82f88c", "comment": "Malware payload (AsyncRAT)", "value": "ed11aaf0f4bde5182fa71a2e0355afdf96f32fa9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553792, "uuid": "6cb7859d-3070-4914-aaef-5353c0668d85", "comment": "Malware payload (AsyncRAT)", "value": "cc3d33e90b3a7eb4d7426b42966bb8936e60c783f4fb9b1d3ce26ae5b549cc1100b3a672fb956a7637242d2aa02e92fa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553792, "uuid": "58809ff0-2d3f-4bb0-a6e6-89e76b9c285a", "value": "T159461313162D04F1419E1DFD0BDCBE2D8B3695E76AAF743A64820EF691F41C8E9730A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553792, "uuid": "a3bc1468-81a3-45a2-87ce-351b89e4a3eb", "value": "192:C8J+EJoJAPoJxGJl71AU/zGaQ+0iUJ/J34DXN:9zGaQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772553792, "uuid": "4ded8f0e-3288-4c91-91fb-8bd2d4fb8fd9", "value": 5775793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772553792, "uuid": "906f1d83-a033-4de0-aba8-7ad1a87f1abe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553792, "uuid": "0a445301-8788-4809-a760-8b8b879d8b3c", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbfde3ee-16fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772540640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540640, "uuid": "79e6d270-d8b8-4a0b-95d1-544a3d9783c6", "comment": "Malware payload (Gafgyt)", "value": "17274eabe1d1bf5afc25cac429b057f6", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540640, "uuid": "869bec61-48fa-4261-8353-5deccbafe342", "comment": "Malware payload (Gafgyt)", "value": "aef78dbe3c77c1264b24229a2ebda2373fe90d007b42d8570a43a9ea3340e246", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540640, "uuid": "80dffa0f-e041-4aa3-8f2a-0823035a43cf", "comment": "Malware payload (Gafgyt)", "value": "1ed3b7c550bffd69b92a84a373cefea086eb701c", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540640, "uuid": "b631e424-c658-4325-a2ae-4cd76cebec5a", "comment": "Malware payload (Gafgyt)", "value": "83f7b028bd114a58c422d6e156c7bb0274e4893e6450fe0562fe532e25bd7139d583fb961b4b9d5cd4d5ec64779bbb83", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540640, "uuid": "1fd51fc4-e84b-4d9c-ac60-465434213a83", "value": "T17D83284794A25FB7D04A6AB92DBB45B0075BAE510F0F1A9B716CB6B4033F8CDB40E724", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540640, "uuid": "43e5a9ee-2364-42b3-8e95-c433f0a513a9", "value": "1536:bquvdjii2M359rbmNPUBkAiAKJp0rrvCOL7oCCceIHUJa:2uI8jbkHJgvCMo9cP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772540640, "uuid": "187bcf5a-c70e-4939-a19a-84331b979fe1", "value": 82844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772540640, "uuid": "0cb39580-16f7-45dc-9204-09022edd699a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540640, "uuid": "54a89b2b-0b96-4188-95fc-56d7d0c9b4c3", "value": "openssh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cefb9b8-170f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772549098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772549098, "uuid": "988e9a40-8e9f-47d6-97dd-20de262c62ba", "comment": "Malware payload", "value": "c5f2d2b93d890b3ab9aa96f5aa168c26", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772549098, "uuid": "b8a84a79-31fe-49ec-ad9d-a111b8babc0d", "comment": "Malware payload", "value": "afb7b489250ca4a066d5cfc906f7bbbfbd3075fe77db9f773dab10e6c6d4a1ba", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772549098, "uuid": "aaa8460f-ee2c-4965-a72d-891100a0566c", "comment": "Malware payload", "value": "7b095816df26502f658bf45a8398acae6188c58c", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772549098, "uuid": "23bd4079-a366-4440-a164-ca0ebbfa6261", "comment": "Malware payload", "value": "fc06fbe5662dc076a390cdab9c65ea619e87b20eb87282847ba01da66c493dd2d356a4fd3e1829951b7e1851dd231137", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772549098, "uuid": "61d58629-1c6c-45e0-b0de-55ba34c2d37c", "value": "T14E924CB506497CB9BBC0CE799F3C7F0CAEE582C42129E39DBA1F39705A2065DC609359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772549098, "uuid": "68bfb9f1-7f08-4cb3-bea8-5d4251b85987", "value": "384:n0ncuxOLnVYMSFnzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:nfuQL+FnzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772549098, "uuid": "9146d366-4030-4079-97c7-1a8c31411e9a", "value": 19491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772549098, "uuid": "d69d8655-0f84-4400-a3a0-ab3d9b17f119", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772549098, "uuid": "00f24f6d-8f1b-4085-b5ee-31504ee06155", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d37ca50-16df-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772528321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528321, "uuid": "eae4c39c-3aa3-4b7e-b5e9-fb6cf885a085", "comment": "Malware payload", "value": "758eda88db2f25f0dcd79c39e923986e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528321, "uuid": "ea48ed79-8c86-4bf2-883c-f08c57edb476", "comment": "Malware payload", "value": "b01290e662a174d1747926c180036ce772dea2ca31d2998c6795631740d4fd2d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528321, "uuid": "63a5bdb0-4671-4b99-b805-adc3260306a7", "comment": "Malware payload", "value": "7b687113128c4c7456cde7b8f819df64ec319864", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528321, "uuid": "b4c8a721-8a06-4b44-b686-02f583091ddf", "comment": "Malware payload", "value": "40c92aeaef3ea9230d294514674d6aafb22094d83eea2b495017db1614cb1c3b4b9107b5b18e291232859e528e86e9e0", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772528321, "uuid": "ac74cbc2-59c7-4d73-a06e-ee9f5118c6b2", "value": "T1DBC02BA0370C5D01400EC122011383C1B800C98E4810BC6030EE401ECB6013151E83E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772528321, "uuid": "326962b1-a0d8-41d4-b506-6a04518a9329", "value": "3:mKDDVIK2wxzwXfDBFrDFXlF/cXfmx+TIoDjrxyX:h+bwAfDLNX3cXfmx+vXxyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772528321, "uuid": "9f9457bc-214b-40f9-b345-aa9d7f9f2e92", "value": 142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772528321, "uuid": "e29d4078-00b2-46f9-923c-3fa03556e73b", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772528321, "uuid": "921d01d1-3540-4dd7-8a8d-cf2f4ae57011", "value": "b01290e662a174d1747926c180036ce772dea2ca31d2998c6795631740d4fd2d.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6b2245-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772548798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548798, "uuid": "f56f3248-7623-4a3d-8200-05e607c790ad", "comment": "Malware payload (ConnectWise)", "value": "3804769b61f6f1ab0a26ed25da9e01a0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548798, "uuid": "6aff0f57-2fbb-401e-8f84-a5a581cc0d34", "comment": "Malware payload (ConnectWise)", "value": "b08979c2b15b948a3400e116920e46fc20e61583024f49944cc0a61ddcc55fa6", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548798, "uuid": "52340591-6f14-4d75-8af4-93af3da74051", "comment": "Malware payload (ConnectWise)", "value": "6ed09614a89412df49dc23aadcf54a1b4e887cea", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548798, "uuid": "fce2c137-7f79-43bd-9943-9241554cef2b", "comment": "Malware payload (ConnectWise)", "value": "3eed57f1e8910225ef44ab8add6bd82fa12e1b986abd1187c4a96742acb887f83a68504a9802df7200f8b63ac49c3133", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "rmm", "colour": "#07519C", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548798, "uuid": "afc1fe92-8683-46f2-ac01-94db9367fc81", "value": "T154E27D17CB1BC20EFA8BE3DFDD108E528B25105A66B14F056DEEDDA53A47054AE6C02F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548798, "uuid": "ba3a88cf-204c-4924-83f3-0e36d80fb554", "value": "192:M4jjO6Wf2a9RvsZ6rVom5Lzn1luMhMNukW1c1P015nhMkPa/1B1rTlmaeKFTP5ML:zOjf2a9REZO/GTee9CQv58QT2SDa7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548798, "uuid": "d18d932c-8477-4d23-9f77-a5f6dfb456ae", "value": 31991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548798, "uuid": "293f8d85-cb3b-4e32-afa2-170b3875381f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548798, "uuid": "3ae8c031-5ca6-488d-8472-cb8a6be07047", "value": "3804769b61f6f1ab0a26ed25da9e01a0.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6719b3-173e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772569308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772569308, "uuid": "a516971e-e8ce-4c3a-861e-432452575cb0", "comment": "Malware payload", "value": "6a498349afad7ed29c77c2d9896df31e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772569308, "uuid": "560e1bd3-9fd7-4d7d-a5e1-9fab51438d67", "comment": "Malware payload", "value": "b1746a63625247e0e2dc5a383ba366878e3170e56c8bcdf48fac58faf34cdb7e", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772569308, "uuid": "d40f2c86-5827-48eb-a029-43e4d7136781", "comment": "Malware payload", "value": "358b8048b37392a656f1c7a62dab64fd58ebeac0", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772569308, "uuid": "1731a567-fb52-41b6-8257-ca2d2a69e9a4", "comment": "Malware payload", "value": "cb1d829f3ae0ade296da7b27f9d8add36e578e135843bf2b4d700ef7650619a3aa84f2db7af7818fa190a768a569fa3f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772569308, "uuid": "5a28e1b5-05a5-4cab-9f7e-dc19ac53a251", "value": "T1F9119848D5880CD8C42F64304A8889F8CBD55F5399E1BA2FCA564E1566D39694FBD4C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772569308, "uuid": "9282ab0d-519c-489c-a370-25c8ac7eb2c8", "value": "24:9G6EJmzzZri5QGTwbssRqntyWHcLNfKsP0odC/RfPz/EJmWc:9nEMz8sbssGtGLNfYOC/pPz/EMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772569308, "uuid": "c1908fc6-5fef-4767-abb5-c2476edf5a9e", "value": 1012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772569308, "uuid": "ae950f31-88d0-4d5f-909d-3062cb15687e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772569308, "uuid": "80f0af1d-9b53-47c3-b99a-ca319f931f33", "value": "cb_db75kver3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8db116c2-1708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772546092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546092, "uuid": "8346f2a8-ebed-4230-b3fe-d28a4d7a23e4", "comment": "Malware payload (Mirai)", "value": "d8fa0904548edd9bcad3c0732ae0b172", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546092, "uuid": "dbe4c055-5bf8-4744-98cc-a03bd9b11f5c", "comment": "Malware payload (Mirai)", "value": "b1b48c59277897110710f78544943f8495a3cda4c907bd38c9aa5abdf0bb6fa7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546092, "uuid": "6a2215da-f4d0-4801-a9da-41253966e8ec", "comment": "Malware payload (Mirai)", "value": "d975acf91fdc4cd4122f76510339dc515cda7e50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546092, "uuid": "f9e819aa-f408-4efa-83a1-5e075246542c", "comment": "Malware payload (Mirai)", "value": "304abf0e5515ed5737440e35279f5ebd448d5bd09cca9c265232bf441ad011e639c88fa19a324ad3ad354afc9ee927c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546092, "uuid": "8190ff73-9d86-4248-a592-09938ee2322e", "value": "T129C36CB3C8666F58D559D1B4B0608F792F53A91182871FBE2977C2B68083D8CFA053F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546092, "uuid": "54647f35-9de9-4b05-b62a-b3584c720fec", "value": "1536:75KpJ/jGeQvZzfXn0FyCucKsEYoeTiT6Hk9pAWvuoFPocdOsn:75EJLGes0Fy3DsHiGUpAW2QP3OG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546092, "uuid": "f002c6d8-2602-4e11-809b-a1abc6f9277b", "value": 121664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546092, "uuid": "db036081-76b4-478b-a1a9-251c3c8e2072", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546092, "uuid": "9518507a-c960-4c61-81a1-6831700d1b02", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "788850a8-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (VIPKeylogger)", "timestamp": 1772548634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548634, "uuid": "86b8108a-9e68-4c65-a816-4a1344e52855", "comment": "Malware payload (VIPKeylogger)", "value": "0797416cb011d664c4ce429b3c4825d3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548634, "uuid": "04f23b45-b504-47c7-8917-cb86752767ab", "comment": "Malware payload (VIPKeylogger)", "value": "b201a03fc29a92568f2b8eb6b1e838f6f219113c0b523dae531ea737ab9da912", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548634, "uuid": "80684061-8616-4530-afb4-c4a538fc9849", "comment": "Malware payload (VIPKeylogger)", "value": "a410b0f747a2ab2c807de74522bd6f0166cb21af", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548634, "uuid": "73835b24-7d25-44d7-98bf-3685947aa35c", "comment": "Malware payload (VIPKeylogger)", "value": "95b029801aa347b3108f3d3344f0835d463ea1a3d9c58415e76365b01c5e7142d46f877df9a75c6bd0d291e3f2733358", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "VIPKeylogger", "colour": "#EC6989", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548634, "uuid": "42f5d673-5981-4efc-9ad8-502325e31404", "value": "T159F1E012A6A33C2FFF8DA10EE6149CD69E15EF1042FEDD44191A7F12D6334096A2E4DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548634, "uuid": "d6f3f975-78f6-4168-aaaa-2221ce170f33", "value": "48:rvwB+acBQgzmBl2DxAUhrTBiHjacB7T2eBG5MSWBtacBuR9R4uLBA5SMwacB9T5v:r4OUi9brT2DLg5DWXgzR2OBv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548634, "uuid": "2d995a05-1c6b-4460-9773-1ed91ff4733f", "value": 7935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548634, "uuid": "12091f4e-1424-4800-a06c-1ab34e95d504", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548634, "uuid": "9f0d3e91-39d3-4fb7-9c88-9c7093ae5d5a", "value": "0797416cb011d664c4ce429b3c4825d3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7795a24b-16d9-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772525869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525869, "uuid": "0dab938c-790b-4235-b142-ce78f0654caa", "comment": "Malware payload (Gafgyt)", "value": "9b66b9695c91e3bce11318dbcb445a2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525869, "uuid": "e0adf569-5f0b-401f-950c-27d91d88ed74", "comment": "Malware payload (Gafgyt)", "value": "b27aa6b9e6596c2a5b699c66c924187c9440a1dcd3051fbf1fa5430c2bfa47ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525869, "uuid": "1ff471b8-aeaa-49d2-befb-53e165595f98", "comment": "Malware payload (Gafgyt)", "value": "58a6a78021324a8db6825795cf123c72d2bbc36b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525869, "uuid": "71c23ddc-284c-4ba1-965c-b8acc32096ad", "comment": "Malware payload (Gafgyt)", "value": "8cbe7f3eee8d6cf0e36a136ea23ff0a251e5b949bbf510a7ea888df55a469435a2d5864685ddb3058c1bbf9efdfbcd5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525869, "uuid": "401dd5a0-92ed-40ab-8644-1f2d22803656", "value": "T10293D60ABF604FB7EC2FCD3705E91B09258C651752E97B3A7A34C918FA4A50B49E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525869, "uuid": "5039deaf-136e-4ca9-b052-7fcdfb87788d", "value": "1536:pUD5iHf3pgqUIvwqdzRv/P8C9nKRmzqjSd9oM+aSOR3Ns6CZkyZNn+R:qD5iDwqdlv/Pr9K3YbDRyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772525869, "uuid": "6c628907-c8bb-4c39-babb-c30d35409017", "value": 92644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772525869, "uuid": "a51c9167-eeb6-45da-8d86-5ac533525f13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525869, "uuid": "4fa0aa26-4029-4d67-89fb-5066642ecc38", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501d39e6-16d7-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772524944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524944, "uuid": "f077619e-d520-4a97-a4fa-b82265e5d8ac", "comment": "Malware payload (Mirai)", "value": "52159cd6f88398609c668974cf015d3d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524944, "uuid": "c77d47c8-dec1-4097-9f4a-1203652b5c89", "comment": "Malware payload (Mirai)", "value": "b3c8b25e686404fae397488ef865e8f263c7128f8f29ce1ce9cb5b49b0cd1ee2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524944, "uuid": "5c2bc6d8-af1d-4f31-b209-ad7d0d365d1a", "comment": "Malware payload (Mirai)", "value": "1bc24ed4637a19582db2c0ca6b78b36e98f11757", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524944, "uuid": "a1ca826f-621f-4b35-b013-81e003ff1d80", "comment": "Malware payload (Mirai)", "value": "7209099249868ff16810dbef4bc2dbfbce0ee70fe2c8ca70cf83b8b339d505a3a378f94476873094fef794fd6f81c063", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524944, "uuid": "9e39f798-45f8-4956-8f20-268b35a147db", "value": "T19E531745BD929A13CAD4533BFA5E42CD3B2623ACE2DE3217DE155F6132CB82A0D7B441", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524944, "uuid": "d6fd15c5-7cb7-4fe5-bdff-d40d70606824", "value": "768:0REzKPoCWvu52kGScPOJbOTFW2OwE623TdFlhBo+E2+a9iNC0Y+xTIQBmq+U1wQB:fzAkFzjPOBe1ELJlkJa9WNRCQBmeBDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772524944, "uuid": "5f52283c-5579-4283-ae36-f0f8c103a341", "value": 62688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772524944, "uuid": "465fa970-e9b2-4ed9-bd1d-c1f0258bf3ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524944, "uuid": "4fdac44a-f64a-47d5-98e3-3021d1611a29", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea40a5cf-16f3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772537228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772537228, "uuid": "e124388a-b7e4-46bc-870e-dca44a5e39f3", "comment": "Malware payload (Mirai)", "value": "b4f9177e8f2f5399804e7c4320f43dd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772537228, "uuid": "b9115834-d479-488e-aeef-3e1014463c59", "comment": "Malware payload (Mirai)", "value": "b3d9717080eab48acf86d7de5a1079b5cdf944903c746f0b67cf1695e6745ddb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772537228, "uuid": "b71c3f43-ac78-4ad3-8de5-e03f6487c4ec", "comment": "Malware payload (Mirai)", "value": "4710d71db17010b8f4bb88cd55886590fd5770d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772537228, "uuid": "42283d43-7072-492b-861e-37d020df7cd5", "comment": "Malware payload (Mirai)", "value": "90f0b49bde662ca2d398434279f2b0be95b721915101f72d71707f222e08c6a47e6ba1869d59f26eb0f635062fb9e900", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772537228, "uuid": "10de95d7-ff2e-4acc-97e0-d883c7a271dc", "value": "T13A5302112A6CE43ACEE2D53D0B2C41F546DC59A8A8D2901E53CABDF48A06D74AFEC5C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772537228, "uuid": "ef9ffe90-09bf-4e09-b8b1-60844425bb84", "value": "1536:Mdcqm5iERozq3p7o8FwOA4zCKOFGUfKbeH6UhV/VRxpe+AQL:MaHJgMo8FwOA4zUFGUO3UhbRxpkQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772537228, "uuid": "8cfccb87-2809-4d16-ab5b-6faea9076279", "value": 63928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772537228, "uuid": "4a31f543-b90e-4978-a068-0958148786d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772537228, "uuid": "7d86b032-5a6d-4205-b185-006434906fe6", "value": "xnxnxnxnxnxnxnxnx86_64xnxn", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d980249-1700-11f1-a769-42010a9c0008", "comment": "Malware payload (MeshAgent)", "timestamp": 1772542656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542656, "uuid": "039a4faf-8e45-4d38-b7c8-d72ea56c4b46", "comment": "Malware payload (MeshAgent)", "value": "e81a49528a1714cfc61a3dd18c3d6250", "object_relation": "md5", "Tag": [ { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542656, "uuid": "213f9a77-ff5f-4af4-95df-bbe35bcfc3ee", "comment": "Malware payload (MeshAgent)", "value": "b47f2b7b70affce64de8f66fd1f2ee162969f6022b083be1060f55f3808c0b05", "object_relation": "sha256", "Tag": [ { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542656, "uuid": "d424f41f-ec66-4d78-bed7-779e34adcfc8", "comment": "Malware payload (MeshAgent)", "value": "2cff009d2381a0ea18b37116c60c77f9077148ae", "object_relation": "sha1", "Tag": [ { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542656, "uuid": "53e184ea-8d0c-4cbc-b748-b6017414da86", "comment": "Malware payload (MeshAgent)", "value": "88d10afadc2f02534ecdc28f6acc220a9664322b41e50de45443013ce9be62ff805b39da1d71a5a0c6e2926188994b7f", "object_relation": "sha3-384", "Tag": [ { "name": "MeshAgent", "colour": "#778693", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542656, "uuid": "70caa2d7-2a7a-4500-a8d5-bc90bae18417", "value": "T116F58DD2A3A600E8E9B7F23C85568517E7F2B81753709BCF15A44A761F236D12B3E702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542656, "uuid": "2d8b7b77-e5f8-484b-b818-5023d1886779", "value": "fb0a8b4a81655f744a37af985e009476", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542656, "uuid": "2507d0d6-92e6-4875-bd44-b394c7e8318f", "value": "49152:sdZEy2B6vflQf6X8uZQoy3vR6QVQy5Z+bm4M/HMFvfGW0/7Z7Ib3jxw5bD:4HvfGfZvZj1/N/z/owJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772542656, "uuid": "c4cae4c0-18f6-4181-88b8-c30243a7af92", "value": 3484136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772542656, "uuid": "a46e377b-35de-405d-a46f-17decb8fdd72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542656, "uuid": "dd50331b-7ced-4feb-ae9b-17b986edd650", "value": "b47f2b7b70affce64de8f66fd1f2ee162969f6022b083be1060f55f3808c0b05.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda1b067-1700-11f1-a769-42010a9c0008", "comment": "Malware payload (VertexRAT)", "timestamp": 1772542791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542791, "uuid": "86f85631-8874-4bf1-a426-3796a2198cc1", "comment": "Malware payload (VertexRAT)", "value": "01bbac7bbc6550ea7b40304e1d8848d7", "object_relation": "md5", "Tag": [ { "name": "VertexRAT", "colour": "#2E8349", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542791, "uuid": "ea92343c-1a47-45a9-8dc0-20f45794cc40", "comment": "Malware payload (VertexRAT)", "value": "b4807ac87af8589488b6ef92c54827bca32ebc0df56adb66355b235bc67d4a55", "object_relation": "sha256", "Tag": [ { "name": "VertexRAT", "colour": "#2E8349", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542791, "uuid": "4d5a808d-739e-478b-8b68-79f3590a90d8", "comment": "Malware payload (VertexRAT)", "value": "d1f74aff5478684e8fe015b64bc43a2330af1606", "object_relation": "sha1", "Tag": [ { "name": "VertexRAT", "colour": "#2E8349", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542791, "uuid": "616695b5-e7a2-408b-9acb-8d98d5e9169f", "comment": "Malware payload (VertexRAT)", "value": "08f84d07921facbaae99f1af2f40dfa88d63400cc387c57f5ae33d392dea9b848ff7d4a7a09a65ed51e9099ef525f12b", "object_relation": "sha3-384", "Tag": [ { "name": "VertexRAT", "colour": "#2E8349", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542791, "uuid": "463e4b4e-7dfc-4125-ade4-1e2bf1a749c9", "value": "T19DE38C227AD0C032D06B11715AB9D7B5996AFA33177484C7F3840FBD6E612E09B7E34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542791, "uuid": "97201faf-fc7a-4b01-a781-1f35a2d2e65d", "value": "eb6f4bdf978fc07ec2cb56d40474a6b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542791, "uuid": "87f232d9-a001-4747-98b5-d6fef69011c8", "value": "3072:BsD2ADkpFGkTXlDJA6ba2esDetNxVgbTGV9X4:BplzpTVDVa2en/V6Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772542791, "uuid": "7655e376-b1b8-4baa-b397-f4d37d233bc6", "value": 146944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772542791, "uuid": "049324da-8489-414e-9907-d2918bdac2bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542791, "uuid": "01c19b58-c8a5-4691-b4f2-bcfa017cf250", "value": "b4807ac87af8589488b6ef92c54827bca32ebc0df56adb66355b235bc67d4a55.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f587f32e-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (QuasarRAT)", "timestamp": 1772548844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548844, "uuid": "12e68675-3bca-4e40-bf9c-1a5e1850d9c7", "comment": "Malware payload (QuasarRAT)", "value": "9b3d925eeb5488f72dbf4b5ad5a050ca", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548844, "uuid": "fbeb29f1-6685-4750-90d0-834f584c18a6", "comment": "Malware payload (QuasarRAT)", "value": "b4dc756f8f3adc8f7f54328a4f3add3cb875b9ff4236fb3175a758bdea84dbde", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548844, "uuid": "9a438af2-4005-4ade-861f-c7e2b7801de8", "comment": "Malware payload (QuasarRAT)", "value": "c82b413995203c1c4ce5c844436d20b76ffc823f", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548844, "uuid": "cad7312f-dfb0-4072-8e3e-bf13c953dbfd", "comment": "Malware payload (QuasarRAT)", "value": "4fe645c2a30441136f7a587755e42972bc31c4b3d66193cee2bb77227e1486eda1e7cd97b956ec65af289d9de020cbda", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548844, "uuid": "c016997e-bb3e-4b88-afc2-6dcd44baa343", "value": "T1A272763AFA48DFF40B2E51E0118B7C0650545796793A4EACB4CDC458BF2A7508FEA8E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548844, "uuid": "ce50a370-b693-4bd3-a960-ac3b7d6d0c4c", "value": "384:oq+CVlTi21kI1/M6HvBthM0LwdxialC/qP:oQn1jYmHSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548844, "uuid": "c4ce0aa3-a45c-4923-9913-98e5a7b9d73c", "value": 17207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548844, "uuid": "367c01ed-483c-465a-9bcb-8b9571b23ab4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548844, "uuid": "099cd0ae-4bd4-42e5-b90b-28a58fe31953", "value": "generated_file.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935073cc-1708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772546102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546102, "uuid": "a4ee4931-3cc4-46cb-88de-ff84938e56ce", "comment": "Malware payload (Mirai)", "value": "d22ef56994b0ed2d4b23e01504aeb87a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546102, "uuid": "9a22e78d-1906-46b6-b4fd-f3947fb9738a", "comment": "Malware payload (Mirai)", "value": "b5a1f53cbbe3b42f2b421684beed17cdebec185fc26931d930efdd4718cf86fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546102, "uuid": "d4663dfe-ee45-4b71-886a-097daf31b830", "comment": "Malware payload (Mirai)", "value": "f9669f857a1fa6df442ef937e11723f1327a5cd2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546102, "uuid": "15bf5ebf-2a8e-4c31-adc1-da7639ebd658", "comment": "Malware payload (Mirai)", "value": "d508dd16a9635fb5fbaa81e535881cc20e8fcbf7f7b743b46729f199ee68f7b31636627082bc0d8574be97e331f9de07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546102, "uuid": "8241f53d-e107-4523-b9f0-c768086bfd85", "value": "T1D9735B85EB57D4F0D94609B011ABFB39DA30DD362014DD6BEB98FD72BC32642901A7AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546102, "uuid": "29c78f44-e12e-4a37-beea-bc714c0dc0a7", "value": "1536:YpdkzMvvGvNXHf8fq83cfKodtauUU31AAasr:8yzuu5Hf8fLWRKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546102, "uuid": "edd2249a-2a0b-4a99-ac1e-e94b4518c9e3", "value": 78900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546102, "uuid": "b63962c7-fdd7-4585-92b9-c00479bbfaf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546102, "uuid": "028a475b-2d93-46ad-ba0a-e40813c02525", "value": "titanjr.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c3cab9-170c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772547656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547656, "uuid": "e1dea2bd-e0c2-40ac-88d5-486a0d31112b", "comment": "Malware payload", "value": "e457cb42ca5a6ecd8b99d89ed2958b29", "object_relation": "md5", "Tag": [ { "name": "DEAFTICK", "colour": "#91C2CB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UAC-0252", "colour": "#63B372", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547656, "uuid": "614683ff-bff0-4550-885e-4bbad0e94825", "comment": "Malware payload", "value": "b5e685e57c625032ec067be94a2854cce1b7c5a51e8d6bd833841a893d5d88b7", "object_relation": "sha256", "Tag": [ { "name": "DEAFTICK", "colour": "#91C2CB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UAC-0252", "colour": "#63B372", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547656, "uuid": "f9a7a23d-81d4-45bd-a11d-959adb6cfabe", "comment": "Malware payload", "value": "dd28c8b179ea1d92abd7a911096680ef448dc29e", "object_relation": "sha1", "Tag": [ { "name": "DEAFTICK", "colour": "#91C2CB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UAC-0252", "colour": "#63B372", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547656, "uuid": "01adba83-1170-4f94-876c-6b55727ee5a0", "comment": "Malware payload", "value": "b09bc8093fb310c6e5a897e5d861c0c3fae024db523dcf07a397e4420fdd8167a8609b8eb04c9ad6a83ac7cb7c1ba4e9", "object_relation": "sha3-384", "Tag": [ { "name": "DEAFTICK", "colour": "#91C2CB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UAC-0252", "colour": "#63B372", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547656, "uuid": "6fa483d0-f646-4162-b1ce-977d2a307d52", "value": "T116968D03E89515E9C1EAE33189B69253BA717C456B3223D72BA0F3386FB77D06A75310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547656, "uuid": "757ba808-5eeb-44b1-81df-212c55daa388", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547656, "uuid": "45247008-dd60-4682-9755-bbefd6b9a140", "value": "98304:iKduH3AZoSfMHw46pLEoOda/R/rmIuJPLKv0doVwFUqkCDOw:iKm3koSkHwRYLd0N2PddoVm7ka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772547656, "uuid": "e089ee21-c646-47f1-8c52-1595fbf680b5", "value": 8909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772547656, "uuid": "f0abc37d-1ca4-415b-a073-6e489df4ddcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547656, "uuid": "dc8c64ae-763b-422d-a5ad-bb2435b3fefa", "value": "Diia_Update_4.7.1_Official.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2692330d-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772518861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518861, "uuid": "5522ce14-2837-41b6-8fcd-9b55da077d2d", "comment": "Malware payload (AsyncRAT)", "value": "f1752ee62888c477340309a53b8d2b9e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518861, "uuid": "a13b77be-71c8-4622-aab5-d70d7a500540", "comment": "Malware payload (AsyncRAT)", "value": "b6e57d8a08b0c90588072b0dc4d153f393a3587e6e5e1b38a6c025bb4c7c9d92", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518861, "uuid": "63472179-10e3-446a-b433-a15f6be21ac3", "comment": "Malware payload (AsyncRAT)", "value": "41c3e284e1feafea49bff9759e8b845647567591", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518861, "uuid": "caeed004-54d4-4477-9080-1393ba717e4e", "comment": "Malware payload (AsyncRAT)", "value": "08d14965fcf8c9d99a45ee9ede209ba5bfdc625a9f9c9c991e0bdb9f5c55f90e46e217c4d3ca5fa062af7c52a601e0d0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518861, "uuid": "e97e38c9-e3a4-49b5-8253-bd0d98d5ac79", "value": "T1E4D24B08B3D48562E1FD57B94D7292008771EA4BA973DB9E1FC440AE2623B88DF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518861, "uuid": "b1cac5ac-5bed-4ba9-b2b8-b12034c8aa8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518861, "uuid": "9e162e2c-a4e4-4a1c-8c17-037f2ab10cb3", "value": "768:vW9RX4ca98J3KEQg/cIRGqom/Rb7fB/dT5/+:e9RX4398wEJ1i4RbN/b/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772518861, "uuid": "8f6deb7b-3ef8-4c5c-8bfd-6c203bf4e6b4", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772518861, "uuid": "b443fea4-f251-4601-ab1a-8dd06d82a0c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518861, "uuid": "c7e3491f-baad-47f8-8eba-5fa6eaca8740", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cbc15d-16cd-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772520928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520928, "uuid": "d20f2780-da67-490f-9981-70c1b9c04f47", "comment": "Malware payload (RemcosRAT)", "value": "de6f8bebf69c293ca7adfb1c42eabed8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "manchidodemainehdero1234456htdfihgfdsdsg-duckdns-org", "colour": "#4B45D4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520928, "uuid": "83239861-d3ae-4864-b1f2-39d683ecb454", "comment": "Malware payload (RemcosRAT)", "value": "b6fda8d53d0c5d1a306ff410785e991980389f28c6716190f03f99d868928c5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "manchidodemainehdero1234456htdfihgfdsdsg-duckdns-org", "colour": "#4B45D4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520928, "uuid": "bf9572f6-f7d1-4970-bca9-01d18544ef16", "comment": "Malware payload (RemcosRAT)", "value": "a3ff5601b9111770f44dd839da8fc3fbc05aa0ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "manchidodemainehdero1234456htdfihgfdsdsg-duckdns-org", "colour": "#4B45D4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520928, "uuid": "af9a2eb0-5d1a-4bf3-9739-df5e8978d1c1", "comment": "Malware payload (RemcosRAT)", "value": "46d79f79b66890e3c7766c3352e985309adea875a8eeed2fdd63566e159d175ffe3e3a07011d63abe00e4af4fdd49587", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "manchidodemainehdero1234456htdfihgfdsdsg-duckdns-org", "colour": "#4B45D4", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520928, "uuid": "fcaf442f-75f3-4613-a7d3-d11cfd49bd77", "value": "T17DB4B001B6F2C172D976A4300935E774DEBCBD201835997BA3D61D9BFD30190AB39AB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520928, "uuid": "75362d2e-5d85-4441-8724-81f9cdf5da8c", "value": "737fc4be4f9f7d7c06c790667c9f7669", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520928, "uuid": "1aaf1386-1abf-4241-930d-3c88af60753f", "value": "6144:OXEE+QEZJvHVdFjl0WGYB+cvbWvpB+qADnN8XIniCrVSMXcvOsAORZlAXiBceS:kENlHV9FGeDWv3jADnyYiCNrsPZlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520928, "uuid": "6daf88d4-8cea-4ce8-9497-1c96387b7ff5", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520928, "uuid": "7eb090fa-7fe3-4bb5-a977-a293f67e5703", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520928, "uuid": "6be80d20-65d7-4771-b8b1-03b9114d9b4c", "value": "b6fda8d53d0c5d1a306ff410785e991980389f28c6716190f03f99d868928c5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4f520cc-16fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772540682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540682, "uuid": "ce89d62a-6098-4485-b481-36c4770d435c", "comment": "Malware payload (Mirai)", "value": "7b16df63ca6573486a51c225edecbdb4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540682, "uuid": "8c18ddbd-1863-48f3-8f27-b72714505190", "comment": "Malware payload (Mirai)", "value": "b81bfda8d43efd7769afb657651550211551dec09cd9774f559eec809647012f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540682, "uuid": "1de9689e-5d17-4d05-8b6b-23ff534817b3", "comment": "Malware payload (Mirai)", "value": "a8e6cca533824dc05299d1a25416753d42299306", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540682, "uuid": "d8cd9dc7-37ef-42a3-be11-77e112d78d5a", "comment": "Malware payload (Mirai)", "value": "6ec7a1002bb4cf245942268305768a7a6b1262ab85b654cd8fe56c1eaf45cfc289f3ca01bd81f2b038c86efb6c713b8e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540682, "uuid": "ba884441-7d1c-496d-a52b-f654cebcaf92", "value": "T1061301D11361178C8361EB7538BE702A8538252B32E51E003D97A64EF60F715987BEFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540682, "uuid": "092af2c6-4e41-49ac-9120-962f38b1754c", "value": "768:/kAKuobq1rduMGAXSEYEYv6DjbChaAUKvNvy0OQT23MTGL:87vbq1lGAXSEYQjbChaAU2yU23MO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772540682, "uuid": "6453551b-3ced-4c56-b23d-384b12de0a77", "value": 41944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772540682, "uuid": "587a0dc9-9448-4f57-b273-b2999fbfa5e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540682, "uuid": "5c113285-9c8c-4b5b-ae27-e38462de2a81", "value": "Mozi.m", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917443b1-16d3-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772523335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523335, "uuid": "369e4880-3e62-439f-86be-cbcdfca7a315", "comment": "Malware payload", "value": "259519ce52744bc34c83d684d6d60df7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523335, "uuid": "b5c3691b-c347-4377-a536-965ba8c664e5", "comment": "Malware payload", "value": "b878c46357fc18a5c92a4934016fcc8837b4faeb0af16bd4f77c683034a1783c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523335, "uuid": "ad69c825-dfd8-4d20-a2e1-f938e65cd77e", "comment": "Malware payload", "value": "46d2b8af74a53397e08a83f0beb6cb8f41b16316", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772523335, "uuid": "25854dde-23b1-4b7d-bb2e-914c4661345d", "comment": "Malware payload", "value": "7a3cc34d2af3be1fad2529828f8a721f2c625fe0771acceb8bf01141f578fe5132f3b2773e93477b3d022086fd1394c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772523335, "uuid": "693ffe54-d362-4a94-a290-f346948256ae", "value": "T1E666AE18A3C85594D176DA78CF16E233CB72BDA3166AC18F4ADFD6160FB7B100F2A905", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772523335, "uuid": "f14de875-f264-4fdd-abbc-040aa64cd28f", "value": "0b343470fd96a4060bc286b2942cafd6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772523335, "uuid": "0b91f20a-5f36-4574-b504-6cf692b682c3", "value": "196608:ph8zoSQ29TeRSj25pQI7DlNdX5msO6vmKmEZT:ph8cSbySj2AaNZvm1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772523335, "uuid": "2c6122ba-4234-45cc-970a-f2a9fb5a5a9f", "value": 7110144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772523335, "uuid": "9697aa4e-83b8-40a9-bebc-bb3afdaf9fd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772523335, "uuid": "7fcea091-cfaa-45a7-9fe0-0855f9fbf324", "value": "atom.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d2e5cd3-16d5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772524187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524187, "uuid": "912b8143-b6ce-40fa-a0c4-03a37a6298c3", "comment": "Malware payload (Mirai)", "value": "b38786d6050917e71b2ee182079397ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524187, "uuid": "7c4ea567-78b4-49e6-a5e1-5b0b3bdea287", "comment": "Malware payload (Mirai)", "value": "b8b60a5af170ade4f14b344da059ebecda89c9e136c42f33e588cd480a63aad1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524187, "uuid": "ff79903b-0f8a-4f96-8a50-668ddfb88a3c", "comment": "Malware payload (Mirai)", "value": "29dac347c7efa20d455b1354c0244af5493f27cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772524187, "uuid": "737f759c-0a29-43fc-8db8-f9d40cb10eee", "comment": "Malware payload (Mirai)", "value": "5a3824de7c5aa23140c95f225dc35537bf53f52ec78520e9cb2d5711cfa2800ecb67bc3c09725ce411839b2df0396edd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524187, "uuid": "6fb5a770-6d53-429a-b3f4-0fcbb9b1d736", "value": "T147632942FC81991AD6D013B9BAAE60DE332173DDE1DE760BDC105B247ACA91F0D7B681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524187, "uuid": "37493430-68b7-44b3-84ef-104c2f6d8491", "value": "1536:OtMQ0s7M1v2F5L+HdLT5/qR6YHFYmfoqyg4Thfm/7P:O70s77Cf7YHFDfooqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772524187, "uuid": "d97a6c48-cd90-41df-994e-b45ff59d1b99", "value": 66808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772524187, "uuid": "5e0dae11-cda3-4d56-b34a-1375a33c60d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772524187, "uuid": "ffc39c29-fe80-4785-ad38-cb48d959862b", "value": "nullnet_load.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f82a058-16db-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772526607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772526607, "uuid": "8dc49f45-20fe-4e3a-8b3e-358d529bbd7b", "comment": "Malware payload (RemcosRAT)", "value": "eff917e9c4e3c3c1d08e9f20ab23894f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772526607, "uuid": "dc65cb28-f1db-41ae-b48d-3b98f766fa2f", "comment": "Malware payload (RemcosRAT)", "value": "b8ca134d9a591243423531d4617faac7792011191aa05e3360a601aa34e0cfeb", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772526607, "uuid": "e26db1d1-2cc5-4665-b246-7211d034373c", "comment": "Malware payload (RemcosRAT)", "value": "dd67507d488a7d698eb52f709218cd7ba2875dfe", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772526607, "uuid": "4e6c11d0-1e27-4ed8-a7ba-3ee6a67774e3", "comment": "Malware payload (RemcosRAT)", "value": "440d13f7e5b0daf5fef801007f612fa0e81443b4680835d522636a861f0cfbe2a6ba47adcba5b04afecb2cc6922712b0", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772526607, "uuid": "41fb26ed-66b1-4d71-b72f-2e1d7929f517", "value": "T11881B8401EAB85E9535B0F24E8CE049E9D33030BECA137CE2B7863971D48959D72F8D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772526607, "uuid": "1b57b951-58a0-4b68-a24f-f141a2cb5beb", "value": "48:JQBuGoFReC7+WQQzs9+EinfdHmQeRN7y3Op6HVzMEl6U/hq0jqG4hz6NZr8jFlPg:JWuHkaA8sxCNeRN2FKElPhHj+zGknm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772526607, "uuid": "a03d6816-f45b-41e9-9f6c-e0336521bfb7", "value": 3835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772526607, "uuid": "236b3977-78be-42f0-b9fc-4b7426d8f890", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772526607, "uuid": "c82bf86a-962c-409a-911c-5ae173a51233", "value": "rNBTCGROUP-NEWPURCHASEORDERS300499754.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9053e42a-170d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772548244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548244, "uuid": "c73d89ba-c478-47b7-ae5d-9cc2c56a9b5e", "comment": "Malware payload", "value": "cdc1919fc612772b34daecbcf2e38a05", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UAC-0252", "colour": "#63B372", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548244, "uuid": "747b0055-8bbd-4e80-9d12-b970d46ae35f", "comment": "Malware payload", "value": "ba1498476b0613d0b25224deb44130c642467653ec475a47c3fa3024bcb4d7f4", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UAC-0252", "colour": "#63B372", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548244, "uuid": "99c4e29d-0754-4f2c-b255-2c5e7cb2aca2", "comment": "Malware payload", "value": "1e141d145610815150a49e826fc009f67f06c9ee", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UAC-0252", "colour": "#63B372", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548244, "uuid": "c00e6906-3d7e-4aab-918c-b4006d358a28", "comment": "Malware payload", "value": "4324e19b7e609996076b9a6ae636d64b2d70f91febf914363586a8d62ca28634e00e863b22a5392f9a8395c46dfec0e6", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "UAC-0252", "colour": "#63B372", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548244, "uuid": "37a5976a-8a12-41e7-b7c2-b01ec4ea3e71", "value": "T1E316333AB5DBF83DC0BA9545B11BC8DD151DA1CD2262C6B1C49C5D1EF763AAB70C302A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548244, "uuid": "659e2056-1d4c-4e73-aea9-835cf6c7073a", "value": "98304:aEI6jqRPoL2WSWCPMEI6cA4FiXbxvJth7wCvDc3PRo:aOjePoLUWCZI6LvXlvR7wSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548244, "uuid": "5e880fc9-826a-449e-a1ad-d2d5da0bfac8", "value": 4029436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548244, "uuid": "96364f64-f07c-4cb1-a34f-cc78f683eaab", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548244, "uuid": "7ba684a1-ea39-4c87-8f5e-804fff823ae5", "value": "1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9390e2a0-16e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772531070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531070, "uuid": "39c59fa9-22d7-44b1-8e51-64d54a7f1f80", "comment": "Malware payload", "value": "bc24fbc8fc7ca5d1264f133a69e42bb2", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531070, "uuid": "ccff9e08-965f-4f43-a439-00d8681e996b", "comment": "Malware payload", "value": "ba98397db3a64b70825a4decf232fb000f3ba3ef4baae8c0519ded6f2153820b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531070, "uuid": "693c42d0-4f82-400e-9f45-1bce7f69c676", "comment": "Malware payload", "value": "556c81d57671b2e473adf7b4f6f82bf3f2a7fbb1", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531070, "uuid": "89b4fbd2-0bdc-43af-b741-d4b971b03de3", "comment": "Malware payload", "value": "c83affb25533605308f720eb0216aa72ad984af4bcb575d023647438c79d713d09dbfcc3d8fb9008c20d66f8722af8c5", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531070, "uuid": "7fb6e2fd-6939-428e-b7a4-4088a43e1743", "value": "T1CEC423511362A9BACB3F09FC55E27AE0A5E72DD11F524F68852AC3DD3E2B7C1221C784", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531070, "uuid": "f645ce0e-4bb9-4a5b-8f29-e62c82106d21", "value": "12288:qbMyAaIew2A1XaCriCnErgX07vKV9CUPGAcSGqdJjacgWfIdmO/QD:uMVOKZ+FrjiV9CN6/dJjwLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772531070, "uuid": "a5098ae6-4193-4b9a-a42d-f69f07d0e2f7", "value": 595752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772531070, "uuid": "8c4a1f4e-f7e8-4c09-b53f-0d0586fda1f0", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531070, "uuid": "4673dc45-fb2e-4e5a-8a75-e87bc66e14ae", "value": "Pemberitahuan Penyesuaian Gaji.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd9a167-16c7-11f1-a769-42010a9c0008", "comment": "Malware payload (CountLoader)", "timestamp": 1772518281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518281, "uuid": "d999356d-e3d0-4cdb-b9e5-44243f59c55c", "comment": "Malware payload (CountLoader)", "value": "f310ab5780a5c30c6ff6c7f3c8916544", "object_relation": "md5", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518281, "uuid": "aa52f5e9-889d-40fb-ad4c-b4e4d6f7447d", "comment": "Malware payload (CountLoader)", "value": "bd47fee1efdfbff5fdeb571e8a93463dec3123e57d2b4ea7879158923c9c33d4", "object_relation": "sha256", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518281, "uuid": "471f7ed8-d8f0-4b19-82e5-1bebe78c7bbb", "comment": "Malware payload (CountLoader)", "value": "84777246c5a6b11ac018dffd19788b0768a5d0a4", "object_relation": "sha1", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518281, "uuid": "10d83d9f-fbc6-4676-be34-22fe3a15ba70", "comment": "Malware payload (CountLoader)", "value": "0eb026fe0709d08e21287c73d9e09209fc6f06787760556b36f86efca628ddd64c3a418404a2e4ba2aeadd6333775638", "object_relation": "sha3-384", "Tag": [ { "name": "CountLoader", "colour": "#105DB3", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518281, "uuid": "01c610ea-7509-463f-b685-b9dfa2bb929a", "value": "T1D395381ABC9458EAC46E93728CB366A17BB0FC590B3223D32E507A7D3E726D45D35708", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518281, "uuid": "6517c09c-aade-4ffd-b11b-0df5e0a564a3", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518281, "uuid": "3b4dd23c-1f13-4fd5-bf33-712f16a11dc6", "value": "24576:jookNZyIhNhu/A0uPpHiyU7kGtZ9iU4gz/tPg+X0uziE:jook7yIhNhu/AE/7kGtZcU4gzmbuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772518281, "uuid": "4c27ea7a-6918-46fe-9810-0f6cff44c71f", "value": 1981952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772518281, "uuid": "1222dd4e-951b-4ca1-a0b3-dac4371ad9c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518281, "uuid": "cd4c1656-4fa0-4726-8f3a-19d4bc4e288c", "value": "source code of carbanak backdoor discovered.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e70bd75-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772518901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518901, "uuid": "5d367fa3-6d36-4061-a54c-b1a35b162868", "comment": "Malware payload (Mirai)", "value": "4ddd6f13299504ac03676d223d9065fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518901, "uuid": "7cfbca1d-c069-4302-8da0-f6c36e2cbcc5", "comment": "Malware payload (Mirai)", "value": "bd75aba3ac6d7e49132934d944b445c27bba058d3b8fc5ed24c871741c44b067", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518901, "uuid": "13767d58-5aa5-4e5e-af41-3971806dcc53", "comment": "Malware payload (Mirai)", "value": "2d94d14a4c55b4e89b4916f2745ab5952e04ddbf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772518901, "uuid": "8805afa0-c39f-4f95-a5b2-2f0ceab901fc", "comment": "Malware payload (Mirai)", "value": "35b0670f47ac88b9b1728b9a9733eca2f9c998bce11ea432914645402ab386465a703dca602096ce6c116cec92ace117", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518901, "uuid": "40bbef57-45b2-4a78-85e6-65df6df397bd", "value": "T10F733B0133588F07E5AA4EF8242F17D483FEEE9011F5F1856A0FAB5A4235E33595AF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518901, "uuid": "288eddb4-7bbc-452d-a999-04def540bfef", "value": "1536:1TJVyLEhqJ7ocdqW6K5efvTVeGXR/7Ei/:1FsarKIheU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772518901, "uuid": "9700f65c-528a-4f2d-814d-9e1810772356", "value": 76912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772518901, "uuid": "95c43b0e-4808-4c80-b509-2c330fa2f24c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772518901, "uuid": "394eadb6-c45d-4218-8977-3652652bcfb6", "value": "nullnet_load.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054be6d3-1709-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772546293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546293, "uuid": "157ab250-460a-419c-9670-54e41a59e473", "comment": "Malware payload (Mirai)", "value": "1b8edbacefe36a48d301d8c22b57a548", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546293, "uuid": "e73c2769-81d8-46d5-9ab3-05ba9ca4eb59", "comment": "Malware payload (Mirai)", "value": "beacd3c4fb5b099e917368a0cf3da91c63e740ab299b1d8c1158cf8466d7b5dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546293, "uuid": "f52dd01a-44ac-43a0-bf31-6e3412b12b5c", "comment": "Malware payload (Mirai)", "value": "ddd1bd0274c25a55dda6c4f8b08916f87bc163d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546293, "uuid": "f36f69eb-4945-4be8-80e2-632aae7039c5", "comment": "Malware payload (Mirai)", "value": "2a716246afe147c560ce48284e116c9b4c927675a529fb76f48ce82fbaa1cb0e4dd8218f4ecc89005594b55b549a09e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546293, "uuid": "e505540e-d351-42dc-93af-f504b5dfb6e7", "value": "T135D32A45F9404F27C6D612BBFB5D428D372A17A8D2EF72039C256F25378686B0E3B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546293, "uuid": "42d6f5da-e702-4776-b5fb-05f8fed5cd82", "value": "1536:K1qNEWQs5j9vlxHBha8OAJuu4VqZh1TmjUThScVnO7DIjdxKwWuAcl3/wyw8YBFu:K1q5NPo8Ou4GvCUThlykY2nYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546293, "uuid": "4b9fdc0e-5baf-4580-8bbe-aab53b9af328", "value": 138016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546293, "uuid": "892141d3-e62c-4ddc-a7f7-cca06defc18c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546293, "uuid": "40f661e4-d7d6-42fe-aff8-0ecf4048654b", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451edcee-16d9-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772525784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525784, "uuid": "f6884e62-9bc3-49e1-ba11-a27df7940974", "comment": "Malware payload", "value": "def446a30fc6c5e8f6943376d5ad7ed7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525784, "uuid": "cd15605b-ed3a-4aee-a77f-a1b28615f262", "comment": "Malware payload", "value": "beda579c0dad38ea8e694bd2c38ce2df655dfc2cdd1d12bf63ee6d2cec190ffd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525784, "uuid": "e667277d-d33c-4c5f-858e-21c1ffca28a6", "comment": "Malware payload", "value": "fb66dfebe007c201fa7ff08499ddf395ae703957", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525784, "uuid": "d9727795-57cb-4ad6-97fa-0d36db9e8eb6", "comment": "Malware payload", "value": "f64a56c3c4f582c1fd74214bb990a30c5dab1f93bfdedaca6fe734e20603eb094d0ef030e454b6835eb5d4da6e57d4c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525784, "uuid": "257856e1-ff05-4e92-bb3a-da413b72c8cf", "value": "T179D733F4FC0BD902FEF5CABAE704E964625CE13C2A390017D161396B6D4892766BD237", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525784, "uuid": "fe718c7e-28ae-4772-8c98-f1b050cc8876", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525784, "uuid": "80d8a277-d1e7-4bd8-a230-f909b9a64543", "value": "786432:oIJkhNkt5bWFj2YM7Q7DAVQa0/TxNtn5+kTo7Hdyfk2NQKuE/uW41MBcNVyhfikV:oIJkWNWVM07DAUrJjb5KWRWC6qOP01", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772525784, "uuid": "0f010c7a-7f36-45b8-bc7a-121191e1bc7c", "value": 59678258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772525784, "uuid": "32c9d474-424b-4241-90f3-663787b5bd5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525784, "uuid": "37cb9cc8-f581-4881-9745-2d8322b25dc5", "value": "InnerEvilSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c3a9313-1700-11f1-a769-42010a9c0008", "comment": "Malware payload (Bdaejec)", "timestamp": 1772542627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542627, "uuid": "215cb80e-cd2c-4d69-9097-f88fcc44a3fa", "comment": "Malware payload (Bdaejec)", "value": "5e7bc6dc85f394b52bf2a1ca6b20839e", "object_relation": "md5", "Tag": [ { "name": "Bdaejec", "colour": "#4E7B07", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542627, "uuid": "a9d7c7b7-8452-4f95-b9f1-87c7432419d0", "comment": "Malware payload (Bdaejec)", "value": "c02ffd2ec3650b02208fb7db5f64909d7b288930252fd827f70eb6de8dfeced9", "object_relation": "sha256", "Tag": [ { "name": "Bdaejec", "colour": "#4E7B07", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542627, "uuid": "a45e0f7a-689e-42b8-8975-ef1d780482c9", "comment": "Malware payload (Bdaejec)", "value": "2507bd93ed94ea8363c034be688a2e1bf5dfca9a", "object_relation": "sha1", "Tag": [ { "name": "Bdaejec", "colour": "#4E7B07", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542627, "uuid": "38c80e99-9797-47e8-a754-c8744873fdff", "comment": "Malware payload (Bdaejec)", "value": "eaa95a4e20ddf6ae80721a911c58b2477b2fc6136fe7bc82241ab60afd2631c8e85483afaaf7c6d50fcac959d503eeef", "object_relation": "sha3-384", "Tag": [ { "name": "Bdaejec", "colour": "#4E7B07", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542627, "uuid": "c5938516-ee6a-4b82-9f2d-b9cc55b929ae", "value": "T1DEB4A63D2CA08814EA614EF2A6705BFE880DFC35065AAE93FDD63B39D4354DB043D996", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542627, "uuid": "594b77ed-aaf7-4203-ab6f-fd1189ccb629", "value": "f5c532817b953c035161a2a983cfbc46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542627, "uuid": "58202fce-92d5-4cea-a465-21d83ae07861", "value": "6144:JTfwxqaO4jqpJ57Zm9LqwbuF/p/uwONct43j92U7CU1o:JF/Aq9aLqwS9pGHNu4B2U+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772542627, "uuid": "fb9de40c-dbfa-4683-a128-7808fe201682", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772542627, "uuid": "493c8d49-2ac2-4d4b-ac1f-6497da1b2320", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542627, "uuid": "324ea305-3d88-4c04-a9bd-2afcdd497539", "value": "c02ffd2ec3650b02208fb7db5f64909d7b288930252fd827f70eb6de8dfeced9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e75e51a-170d-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772548080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548080, "uuid": "1e044e42-2368-4555-9bbe-49c7ec32ac8a", "comment": "Malware payload (SalatStealer)", "value": "974cc318d509301be0966cc1b397076b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UAC-0252", "colour": "#63B372", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548080, "uuid": "28939070-d4b9-442d-8a40-db08ba6fef18", "comment": "Malware payload (SalatStealer)", "value": "c149a236ddf07fb96de1a893b8d09cdfdd2c28abfc4c3c17bb3ebd8c3c7b5cef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UAC-0252", "colour": "#63B372", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548080, "uuid": "c6ec9a12-bac3-4357-8edc-83c7ac8cc118", "comment": "Malware payload (SalatStealer)", "value": "11151ae5dd3274e558b3faf76c592f3f4c23c471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UAC-0252", "colour": "#63B372", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548080, "uuid": "634e8c35-d98b-4177-80fe-41f980891afe", "comment": "Malware payload (SalatStealer)", "value": "f196468977359ba3e65d83cf6e02b7375d37fe3890ac505789db55d6ff8d275051995d1a847afdebcc2ccb127d268758", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UAC-0252", "colour": "#63B372", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548080, "uuid": "c68e5e1c-0dcd-448e-8862-0adb66619b49", "value": "T144E5330CE0C2687BC8E10733A5A66552056446B7CEB6B7F60C76B07F7D5B89AE384878", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548080, "uuid": "95f140d2-e302-48d2-a8fe-b6f7e99ffa8e", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548080, "uuid": "51952c11-0026-4d0d-97be-fc61b088e837", "value": "98304:hSDPTxxejszQiN+6ER6gPg9wER8vZ0VjuEf1/s:QDe40x6gP/LvaVjuE9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548080, "uuid": "52cd3589-b536-49e9-9c25-3a7f23371f43", "value": 3297280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548080, "uuid": "7fef4a4c-9f73-43b3-849c-ea0b354e5002", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548080, "uuid": "967e778e-4853-4aa4-b4bd-d333e397b4e6", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15dfe85-1758-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772580485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580485, "uuid": "1ae3f62c-852f-4312-bc14-ddb1a4d0ab9f", "comment": "Malware payload (AgentTesla)", "value": "76113b8f05523a655a65359f3078cc9d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580485, "uuid": "2fa53239-ef1e-4f10-a9c8-5a2b16a716f5", "comment": "Malware payload (AgentTesla)", "value": "c16dd95a81fa1744dcfedca5e5bd9b77b1b621af213b1c1c8595f67494d0f5bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580485, "uuid": "d6b3f415-e36e-43ff-b013-35e6c6ec942b", "comment": "Malware payload (AgentTesla)", "value": "696cb6675ebd905f9842032f39ce3c8eb71345c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580485, "uuid": "e9a7f088-f15f-4767-9e44-b952339adfcd", "comment": "Malware payload (AgentTesla)", "value": "bb01231d2d272b3f6bb0f997fed996c936f728ac63c51667279c91d5e866440bca25a189e1b3fa37ec7df30cdeea7e38", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580485, "uuid": "2e12428b-3d06-4c2d-b115-5a5593eeb9f4", "value": "T1762512185698D907D5B653B96871F27847BDAEDA7500D3678FE8BCEB7E32B1008083D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580485, "uuid": "1abd44df-f730-4081-a4f0-c1cf9c00f934", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580485, "uuid": "ec711e11-4626-4f1d-b4be-f11f2a164207", "value": "24576:cXI5aOQsHMWcjkL3kUaAfqcOVQHR0hY519fe5Ia:PUDGMpK30oOqxL1hp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772580485, "uuid": "b93549dc-7066-4d04-a11b-1eb1830a0edc", "value": 1011200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772580485, "uuid": "d96a1e31-4237-44b3-99c1-3b6ba5e2990f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580485, "uuid": "3c115c34-29e0-4cf7-8b62-6f2e2b8d0fb3", "value": "Safetech Trading NewOrder BOQ_Specification#202602.001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd99d8b4-16cb-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772520027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520027, "uuid": "a3d3b81d-c87b-4978-ae50-ef4e5a706949", "comment": "Malware payload (AsyncRAT)", "value": "88adb2c2c8aef0688c0ab5dda1c94f1c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520027, "uuid": "d601b7eb-4468-4841-8ae7-ec3d6284d09a", "comment": "Malware payload (AsyncRAT)", "value": "c1bba56272310ef2b72d468b811c85cca4b0df44107308c4cb6d2f041ae4734e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520027, "uuid": "83f3e8a4-b751-476a-bb38-60eabc7f0503", "comment": "Malware payload (AsyncRAT)", "value": "2d9655d61536b9d4b17c4ada9f26a64d7899527b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520027, "uuid": "8efff090-abd8-42fb-9aca-2936f3984bc3", "comment": "Malware payload (AsyncRAT)", "value": "c7cf964a4bb10d190b5b534f27974951def62b80e1259bd8a4b82e2fbe342602901ad6020b15ebd39b18cc06543557f2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520027, "uuid": "277dff75-fcb7-4020-a6c1-eb11ee9199f2", "value": "T14074CF00DE843597075C743AB8FBA46E83696A01518FB781757BFE99FABC300759B82C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520027, "uuid": "6095121f-5b43-459f-a344-6d1684d0ea4a", "value": "6144:cscVzfzLci7ypEC6DLB930zTUbWYO3VgTVoeDmTkzljZ+d3O9VNOR:csWzLLciCEC6DL3kUbWPJ8fzljZ+CA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520027, "uuid": "274f48e5-9cf8-4405-8a15-edd9af6e459a", "value": 353864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520027, "uuid": "3adcf14c-191c-4823-b626-3afce417519f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520027, "uuid": "60d2cc88-307f-4276-8b5a-6d0282d4a989", "value": "88adb2c2c8aef0688c0ab5dda1c94f1c.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ebc51d-16a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772504844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772504844, "uuid": "537fd696-5de2-4b1e-a0e9-af1c3fc27690", "comment": "Malware payload", "value": "affa001399444ce31377948ed63953b5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772504844, "uuid": "b0658b02-fc71-4540-acbe-e3e52ce18d23", "comment": "Malware payload", "value": "c3c107ff3419beb378d3e26727aad8089c42bc688b3c79fa981260e93b66ca73", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772504844, "uuid": "77d53869-f90e-4d33-8bd2-18c234966570", "comment": "Malware payload", "value": "949f9fb852112569882f138772f5efc91a2083a0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772504844, "uuid": "152104bb-bf38-48c3-99c5-67c9fe2bb3ad", "comment": "Malware payload", "value": "2bbeccaab887ed31db22589087e64105cfdb79e4eb02d1fc55c08f9edec7ca8c9010fa046c380113cd559b6d92d484f9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772504844, "uuid": "b5eefbcf-8d1c-4a6d-a8c6-453a72929ebf", "value": "T1110623C3B329693FE87B80364D6AD7311B146D128B9AA70BA560763D8C333D90F497D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772504844, "uuid": "181dc816-cdf1-4049-a4ce-a23ec0a1540e", "value": "98304:qyehNeBFkgTecbF+lewlQVFYHBaRy89xl+C0:q/FcaeLAkRF/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772504844, "uuid": "a6c8ad89-2a35-4f1f-8fe8-31b3856cf9d5", "value": 3960729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772504844, "uuid": "44aff472-71e3-4657-83dc-9bff57ef9a2e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772504844, "uuid": "9e974a76-350d-47b4-8e23-79191485c23d", "value": "c3c107ff3419beb378d3e26727aad8089c42bc688b3c79fa981260e93b66ca73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b8c0388-171a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772553659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553659, "uuid": "f0472e57-7de3-4033-baef-fe47a164fc84", "comment": "Malware payload", "value": "5e48d10b75cfac3b37ea8c98a4e10a8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553659, "uuid": "93f07845-8f87-451c-8b24-6d56d3cea469", "comment": "Malware payload", "value": "c43f3ee26014523f61b8063da026994a51e5b9402ed51c0bde2991e3a82b02b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553659, "uuid": "c7548506-3648-4779-b1d2-5499da403925", "comment": "Malware payload", "value": "172b0b606ee16145fef3fea94ac18b2d464ea0e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553659, "uuid": "5a6d47ce-8b6a-4110-89cf-c3e76d1a365f", "comment": "Malware payload", "value": "1fad59f59492b0f1294f3aed03f8d25637c502464d48802edb493b30344132f81882a461aea919f886f0a8ae3e220cf8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553659, "uuid": "0320c9a8-c2bb-469f-8b00-5cdc2d2fcbc1", "value": "T169B5335B561139F3C1F2D6F5486A0122A37EF0FC8391478856D850AC7CCA6787FA78EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553659, "uuid": "af73dd2b-53b7-434d-a676-89e0fed28adf", "value": "e5bdf5af66eb2c67134415dfca30a576", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553659, "uuid": "fa37230d-273d-4ba3-a705-016490d8a36d", "value": "49152:x1s6TxWlXTiaxQNgbSx94LX9PRUocfVAmHvJxEltBOelBCM:XDqTiaxQNyKa8oke0vXkyefd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772553659, "uuid": "119290d9-7ee2-4120-9976-4816b68e5761", "value": 2402304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772553659, "uuid": "bb41c727-80ec-4952-991c-52b3dc960196", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553659, "uuid": "05d19dee-41c8-4aeb-aba9-9d03497d5503", "value": "agent-f2e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8516fa54-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772519020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519020, "uuid": "abbf9fb1-1f78-4dc5-b278-f81b1f8e642d", "comment": "Malware payload (Mirai)", "value": "705e117ce824411e4440a2854063274f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519020, "uuid": "20865470-7fc3-49b7-819f-52c5fa401e64", "comment": "Malware payload (Mirai)", "value": "c4b6aa1c64c5d8c9f13d154fc58ab9df29a52b332c5c008603e802309575a01e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519020, "uuid": "3dfa5cb9-7ca2-4d0f-bc96-6d642b2e9c36", "comment": "Malware payload (Mirai)", "value": "80986289191d4de1f15986cedcd41e9dc6ebe15b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519020, "uuid": "52842a6e-6679-4091-83f2-9347118cc79a", "comment": "Malware payload (Mirai)", "value": "e1f9bd4d93ef68153b237f297a10ad493d6da2b24164ea769ecc83f96e9b117a28375802a4736c7feb2246de5e7ebe13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519020, "uuid": "65492e23-2060-44b3-87fd-8cf5a3ec9848", "value": "T1E1E35D86EA408A13C4C61776FAAF414D3322A755E3EB73068D185FF43FC6A5E0E27646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519020, "uuid": "91904aff-0f80-4bba-bb2d-d6b162edf2a3", "value": "3072:PkMK+xRQ4RdWNQKHYqZGnIKkQynAeGYpZ0mfiJqaM/9SDM8l:sMxRtdWymLKkQynAzYpJfiIaM/9SDM8l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772519020, "uuid": "76859ab6-995c-4449-b6ec-2c5a34812835", "value": 157007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772519020, "uuid": "4d277652-6b62-4546-b3ff-80edfb1e7611", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519020, "uuid": "81d8e25e-9d33-48ac-8ef1-f11b460e1604", "value": "nullnet_load.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903aa7a2-1728-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772559841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559841, "uuid": "96e0ff12-6a02-4a57-ae48-5113738973f3", "comment": "Malware payload", "value": "59baf87b2ede52cfd220638f427d033b", "object_relation": "md5", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559841, "uuid": "191d2329-a06a-4016-8907-191cf2928084", "comment": "Malware payload", "value": "c5c640dd7343a0243ba8ddd47c3b34811334ef161da85a07238857a2f33f490e", "object_relation": "sha256", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559841, "uuid": "ef2234be-07e2-4c4c-9be6-ba1878e5b5f4", "comment": "Malware payload", "value": "f909facf9fc5b27abab58f57fe1dda305e61320c", "object_relation": "sha1", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559841, "uuid": "ac522186-5231-46a9-a693-961268f1845b", "comment": "Malware payload", "value": "951396e945e96829e61faa3cc6a0373d20d380b1e0e482afab59406262e41d99793db7a67f1ebccd158a5a91dbfe6e11", "object_relation": "sha3-384", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559841, "uuid": "a5e51aae-8f02-42de-bbb3-21370f27f803", "value": "T112D0A73490274503D353E03E3C14A525810B4246DE5570DF16E68C9614414404B5AA6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559841, "uuid": "41df9830-6643-45a3-b324-25c561072387", "value": "6:5jSQ2qK5etoCdIS5kfo7uiFxdSQIt5Evq77t+lS:5jSQ235etRZcQIGm7taS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772559841, "uuid": "2d68d158-a7a9-4b9b-beeb-2e0b133b8a55", "value": 242, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772559841, "uuid": "bf34e61f-1c17-4c28-b674-6ea34891c00b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559841, "uuid": "5ce0a1fa-ce76-4654-a29a-6f35cb52f86b", "value": "Fac_2026_57840377900.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9be7901a-1712-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772550411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772550411, "uuid": "43e9ce5f-c71e-4b93-97b0-8f0eb442cbfc", "comment": "Malware payload", "value": "480b964728d4c41acab710130acfe08c", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772550411, "uuid": "6dce0278-9082-4242-b86d-ff110b4b801f", "comment": "Malware payload", "value": "c5cbcc786d5f4c5a53611f9c1738bdeaa3e76e0aa91f459438f79b099d5d7064", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772550411, "uuid": "137ada74-151b-41c5-94e0-b71df3a03bb5", "comment": "Malware payload", "value": "9b32e1bdbd520f3b6c6d21c1d1999c5cb8daeaba", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772550411, "uuid": "bb0b1f97-b105-4624-b8ab-92322e84183e", "comment": "Malware payload", "value": "24efd2326c780d5debb2bd1f1e24eeaaf1ffc894baa9c87feeacf57884867754e999af19013fcda916ec4858d483294d", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772550411, "uuid": "e61a6494-1fe1-431a-9df7-108141c4e67c", "value": "T131334AF143769E6ED9715A04CC35BE1EACF889B64F8BE12E681B7884CC7D6E00784359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772550411, "uuid": "51f151b6-2117-44d5-971a-83d3c38b5f14", "value": "768:ZtYs2NwLG6cG4nwY3I8kTCEXqE7q9SSH2yOueHvKqxHvA8FNdSxVOIFE0UIYL6D9:Wvr8HRYGMjdACn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772550411, "uuid": "34cab512-6e57-4fd6-b225-e5b382aef3d9", "value": 53943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772550411, "uuid": "d6de8795-ee85-40a6-9e45-9e82ccc884c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772550411, "uuid": "73ad3645-e25c-4f4a-a9b6-f3dbe24321fe", "value": "cfchallenge.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b3db84-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772548716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548716, "uuid": "7d92076f-3987-419d-8dad-39dde8c94104", "comment": "Malware payload (PureLogsStealer)", "value": "a612a7016beb1fe09f0d74043c7b3e8b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548716, "uuid": "25957f45-7d17-4852-bcc8-04735d6bf897", "comment": "Malware payload (PureLogsStealer)", "value": "c6834fa1fb339ccf3e55691ab27b6b38fbf4b984b237b86b307e14f4b192bc72", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548716, "uuid": "756e793f-d5a8-4226-87fc-0d9202d96568", "comment": "Malware payload (PureLogsStealer)", "value": "2b135c28cd55498fe13fcb1fed82e150ba838e63", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548716, "uuid": "fa0ffd56-e77e-4715-a4e2-cd8a6f55cfbd", "comment": "Malware payload (PureLogsStealer)", "value": "1c14ec37b594da4d2a6fe9c6e40e0e11594824d4a611dea8c25e5a0d3cf7954b2abe5317ca51fd2516fb29cbf55a0722", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548716, "uuid": "6697c083-49ce-486d-902e-58eac420d759", "value": "T19006C03808D67E1D515B9F7040EE959DA3F0A529302FABBDBF623ACA8DC47D08530B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548716, "uuid": "eae239d4-919d-4d09-8552-42975bdc0d8a", "value": "49152:HhN1wijKTwwzqXCehfgBccGe1HWER4HtMKdTJdaqWWPchDsqj:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548716, "uuid": "1819a3b2-d531-4302-8f58-0bc6b455816c", "value": 3973333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548716, "uuid": "358dc5f4-b61b-450e-9784-67de610311e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548716, "uuid": "dc31867d-7614-44b4-af26-2d9d65591aaf", "value": "6534567.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80fdec08-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1772548648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548648, "uuid": "f33d534b-0ce4-40a0-b514-a86259c4edb5", "comment": "Malware payload (PhantomStealer)", "value": "691a941f1f3ab53b77e37ef738228fc7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548648, "uuid": "230cda9b-d892-4956-b25e-01a9f3eba763", "comment": "Malware payload (PhantomStealer)", "value": "c716c851360d431825608c8aacae13aa6e29dea6d2f83efa51294e4fc1fd2d6c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548648, "uuid": "a0335ba8-36ff-4953-b951-aa7714ceb914", "comment": "Malware payload (PhantomStealer)", "value": "a9928cc713aee07f312ac26f4a1296b88d1d6361", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548648, "uuid": "40b6d617-5c9a-40bf-a8fd-70af7e64b551", "comment": "Malware payload (PhantomStealer)", "value": "b237216a6be8b6a3652eac8f8d72b502dc59194a93f376922d60372dd6f6291fcbc59152beb038e544edb75b578184c6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548648, "uuid": "b3f6eca6-7c49-4329-bdb8-1734b4205b07", "value": "T1C726BEA877E453EC0CAF5F29D8E8121F42D1A87D503A3EDD6953BF51BA86300E781E49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548648, "uuid": "9e6ffb57-9ffc-4b7a-9a88-b5b904e14b7b", "value": "49152:m977V8ratu6N82MWdhi1NSLQH/TgreqsxKr9KLmw+j:m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548648, "uuid": "6cf9a55b-0cd6-4577-93c7-6ba6cbf91b24", "value": 4674305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548648, "uuid": "cbd6f95c-752f-44ae-8abb-eeb861d22c58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548648, "uuid": "3d74f7b4-ce0b-40eb-bfa7-885762f38dea", "value": "691a941f1f3ab53b77e37ef738228fc7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62cc2eda-173a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772567495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772567495, "uuid": "1b3bcf28-876b-4d2d-8614-94e445c31e60", "comment": "Malware payload", "value": "104bb2481a95e3210a5bb3963c04b455", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772567495, "uuid": "fa44214d-ff15-4772-b247-45538073fdfe", "comment": "Malware payload", "value": "c76197716275cc0f0e6db94b4540cbd72ce1469a92a8e387512d10f5d12a71f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772567495, "uuid": "88093d52-5946-4a37-be89-9f28fe1ddf04", "comment": "Malware payload", "value": "a872e9bde88a0639f9003b80d7ce8bce8286ddca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772567495, "uuid": "f11e8702-83c5-4135-a786-9abca4f86a05", "comment": "Malware payload", "value": "a0b9732d53ebe920ec591a1347698a9479021c42b83f30299be9a61a31605a49ad7a5c3cdbab8e77225a251ad70adfa1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772567495, "uuid": "8ec4f98d-bbc5-45a3-9d69-93fc59546310", "value": "T17AA68C02FDCB50FAEA031A3005ABA27F23315C058F65EBD7EB407B29F9BB5951936149", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772567495, "uuid": "84f018b9-d204-4e63-9709-2d825d9df235", "value": "98304:66spIP+fncJrBIzpHdRoSMI3skz1gEYED0a7UeTlDjmyHunywM1QQE:QJfQyzpHdRGIL1ZWpelxH+ywSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772567495, "uuid": "859aefbb-73cb-436f-bb65-151a704a330a", "value": 10269009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772567495, "uuid": "1a4b42ea-0f3e-4849-99e3-4208756273b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772567495, "uuid": "09e2827d-f9ab-4972-a584-fbca7faf1a8e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4a25a1d-16fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772540118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540118, "uuid": "c18c8e17-455e-4bb8-b56f-6f9f6ee53820", "comment": "Malware payload", "value": "ac083aebb6794c5139632404d75513eb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540118, "uuid": "3e6b2b08-879c-4551-b8c4-1860160ebb05", "comment": "Malware payload", "value": "c79cba3383e61de35be280eb5cb0e103d24b58df36cf96ab4558b9466a500618", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540118, "uuid": "cb21c01c-72b5-4cc0-96a5-10f674c421b3", "comment": "Malware payload", "value": "21a2a518bd1778c7f950425d57d9f542842064fd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540118, "uuid": "2d9b9edf-b624-4afe-ba62-da08909921b5", "comment": "Malware payload", "value": "45fbe7b5de873cb784c8a6fa0391a4e1adb0d477bdea060e5458564bff642899d72f940df2f65a5007ece3b3b39f81d6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540118, "uuid": "ed2c632f-a1f7-4f23-b56f-79e1d2ff9a77", "value": "T194F72356E2F900E8D5BBC0B8C6575517EBB1345913309BEF66A48A692F33BE06E3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540118, "uuid": "014b73e3-dfa8-40ca-ad5c-8f653332767c", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540118, "uuid": "70f06511-1acf-4513-9802-ab1903cee592", "value": "1572864:e5WJo/Q6fhXUqH23Vxczp/FwWcMzFBbLCpRIv0D:eCohuRlSzptbcMTbLCpRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772540118, "uuid": "8ea95b41-41cb-42de-a95d-3c8c7f3e5422", "value": 73505480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772540118, "uuid": "492f17e4-bcda-4928-9162-7155d9a115bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540118, "uuid": "e31dbbb5-2c6c-44fb-b2e6-196a89d94e70", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8827b9a8-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772519025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519025, "uuid": "99f7896e-3b12-4024-b8e7-943a15143d3e", "comment": "Malware payload (Mirai)", "value": "f123052fd54157a1affcb2406209ad33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519025, "uuid": "c2a501fd-bafb-4052-8b75-158d7d6ebb21", "comment": "Malware payload (Mirai)", "value": "c9ed0fe34f868bf7ba8463532892385622a316a02576e7f82ddb774b58d310bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519025, "uuid": "734566a1-bc90-4d1d-a953-f95c57a317e5", "comment": "Malware payload (Mirai)", "value": "57edddc7ee1e64705ca14175bfc3168a67f88091", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519025, "uuid": "8e8ed066-7652-4b90-accc-25e947749d23", "comment": "Malware payload (Mirai)", "value": "fe05efe9d58355667e3f230d585027322b15805efc9183e5807af9cdf3d5fcd5b0bf69ed6fe089c58c1070baab501893", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519025, "uuid": "6e5450db-3764-488e-9859-6c4d068e3f30", "value": "T139735BA9B4019EBCFD9BD5F941210F0EF42163055B930F2BA66BFE937C630A49E07946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519025, "uuid": "9e2cb378-eae1-493b-b096-4e59bcb3f693", "value": "1536:0wezSXzy7yTidtRZX9LHNpOPYgXWLgDtyezJa4K8d/Qfz:k7y2dtRh9Ltp2tmWJHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772519025, "uuid": "764ff2e3-dc40-4ba3-af6d-634739150064", "value": 78220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772519025, "uuid": "69cac255-3d2a-4f36-aaa0-fd6ccc7245ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519025, "uuid": "4c0a21ae-1c39-4dcd-b966-bdd270c521ff", "value": "nullnet_load.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f1e20b-1728-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772559795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559795, "uuid": "8ca3824b-aa35-43e8-be04-0b3dc2d91ba3", "comment": "Malware payload", "value": "b228d08959d2ec79793a89d1345c4974", "object_relation": "md5", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559795, "uuid": "6df3c7da-e58c-42c7-9a00-0432b14c75f5", "comment": "Malware payload", "value": "ca77c6649ef53da5aad895634912c72c82a9920c1c5a3aa0f8c2866ea0a0ef98", "object_relation": "sha256", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559795, "uuid": "c9c7fa26-e47e-4415-ae83-fe56ee1fb8c4", "comment": "Malware payload", "value": "85470840c82885ef086a24f28364135bce927478", "object_relation": "sha1", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559795, "uuid": "58ab90b7-2478-4585-8d7b-99448ec7b6a6", "comment": "Malware payload", "value": "afe362167fc7b06fd7e85c3129c931669d45cf39d74a4ac2be6f684187fffae1ff2699a9e27daf7f1f6f1725881ba049", "object_relation": "sha3-384", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559795, "uuid": "d00d1701-cd6a-4ded-a532-00614fe1e89e", "value": "T12AB01206E68FC1F79401302D9354C7A0B883A8CEC113D5FDA742871F21C29E1428D19E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559795, "uuid": "d6f08cd0-8842-4618-8d9b-ec02d8287451", "value": "3:HRAbABGQYm+KXOCRIPGETJL18PKg31zv:HRYFVmM7+IJL2yg31zv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772559795, "uuid": "a1d60c98-7cbb-44fe-a637-17321788578f", "value": 102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772559795, "uuid": "610a5d06-a764-4473-abc1-69a487a0b733", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559795, "uuid": "286cf6b6-8f7f-4995-95d2-735eca59c298", "value": "ca77c6649ef53da5aad895634912c72c82a9920c1c5a3aa0f8c2866ea0a0ef98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20955cfb-16cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772520569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520569, "uuid": "c187d1af-4c3d-42dc-b7e3-c2e37bd6cb5b", "comment": "Malware payload", "value": "87c5a811b8ea6e55cedd1d8e371eaf6e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520569, "uuid": "0224323e-05a1-4d77-8f45-d8323facf488", "comment": "Malware payload", "value": "cb3226cf63a44d5875ad73836372e9535a5a20105101845f22e73d56a22b854d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520569, "uuid": "949ed284-c428-410f-b06b-3813c817a192", "comment": "Malware payload", "value": "59f458f0ef345b1f3cae66c5838c7ae620473f99", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520569, "uuid": "784e53de-4e5f-40f1-91dc-613c2ea2ad63", "comment": "Malware payload", "value": "02949f85a93127cf021cc49649ddc2587053267674016942b502e6447c8240635f2870640865d9232eec580f6fd0c92c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520569, "uuid": "62420922-4bc9-4c67-a088-3bb62089d8e3", "value": "T1A865F45572005706D98188928F9FE759EC1414B2BC4B29C63C118AFA5EE3A3DF9E3F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520569, "uuid": "1318843a-8247-4c12-b131-ec4f637d3244", "value": "384:8QyfQyVCyTN+y0skhayFQ9QkyYYySyhyJyeotDyvRy/yjjynyG79:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520569, "uuid": "b722b1c5-eba1-4934-9515-1d08355245a4", "value": 1469869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520569, "uuid": "3e5f451f-9acc-4982-ab44-721106f5b920", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520569, "uuid": "415de08d-983d-4ada-91c2-483a25331ba4", "value": "cb3226cf63a44d5875ad73836372e9535a5a20105101845f22e73d56a22b854d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a9ca778-1729-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772560207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560207, "uuid": "8db194a1-887f-4205-929d-f894b78307c1", "comment": "Malware payload", "value": "617062e8f25bd49544ee1f676b99eaaf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560207, "uuid": "f083df56-c744-417b-bf57-432bd2a9b6ca", "comment": "Malware payload", "value": "cba53b99fb9e5b626353b3dfd4f6f9d7135f1e987901aa5df576353fd9c6b6cf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560207, "uuid": "dba23fcf-c33e-49d4-9136-20eace96088b", "comment": "Malware payload", "value": "398262f5e44340d3dba586e4164769419e1e7444", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560207, "uuid": "d56280ef-2234-4fab-8e2c-a45ab21a8201", "comment": "Malware payload", "value": "2c9a3e277253760cf7de7edd6ffa43f978ab9c1ea8176c64cc5fb34959ab21617b89e34dcbc8fe568d91bf43d61fe38f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560207, "uuid": "30620957-41a8-48cf-a6d7-dc79bad7481c", "value": "T1FC967BB817A2D87355DC68A23D82EC1EBBF3AD395D0895095CFFE702B16E5EA10E54C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560207, "uuid": "53252309-322b-4aa5-ab67-f999f1c7178d", "value": "768:nTTw4jJcskq7HS95o+s3oKR87uaUTTw4jJcskq7HS95o+s3oKR87uavTTw4jJcsd:Tr4SvtBFnlC7K2J5DmZm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772560207, "uuid": "2b6ff46d-0415-494a-92a6-0bf9b3dce49c", "value": 8697468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772560207, "uuid": "39addc25-d53c-4679-ab20-5f6b574a9a0f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560207, "uuid": "d923f4f5-f7b5-4a67-9f59-06cf6334f8c0", "value": "BID - Packets - File - Document.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6704bd18-16e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772529277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529277, "uuid": "82b7c418-dc5b-4fc3-9ea0-96dfb0ea896d", "comment": "Malware payload", "value": "a4bb5bad691b64d5c4874953430d332b", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529277, "uuid": "d36e34a7-4d75-4850-8d25-42ee90ebe8fa", "comment": "Malware payload", "value": "cc263ae006381c1104a4bc9b35e0e5932e15b67430b2a8481ae9bedece775d31", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529277, "uuid": "9d9941e3-c049-44c8-81c5-b05ec6940eaa", "comment": "Malware payload", "value": "4e8999acdf1f58a4450b72880ca83a4434793a11", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529277, "uuid": "a4217d1a-d786-4cfa-ae78-ad2255ce0266", "comment": "Malware payload", "value": "96da703dc53d84339ca70a942b20aeac1db9e8eebfaa8ae6d2e7feed496db1f1bd52c7fb4b31ffaab6a511643c56701c", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529277, "uuid": "c617c078-ec69-49a7-8683-8b72d3e355ee", "value": "T1879633B444922BC8A8A7E3C3F57317C7D1A00B2527C199D1CE64BF12AAD61B77ED8C91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529277, "uuid": "a2edcea2-c0a7-47ad-ad8e-f9ce38c9a665", "value": "196608:JRvJ1sSYXKL8epFULaF6RxtOR20eMR1E0uJgEXH2bVBrm:7vTYXC4La64751E04cbK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772529277, "uuid": "15be149d-b194-41b3-b2b6-30de7a7152b2", "value": 9030869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772529277, "uuid": "ef2f7892-dd9e-4868-ad36-b0003445f35b", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529277, "uuid": "2abf09fa-e884-4ff7-b630-3e4a03c23fb9", "value": "cc263ae006381c1104a4bc9b35e0e5932e15b67430b2a8481ae9bedece775d31.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af92718c-16e5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772531117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531117, "uuid": "903807c8-3871-4a29-9e19-b00b9468c3c2", "comment": "Malware payload", "value": "4cc745a712e5017199a395b9dcc1af3c", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531117, "uuid": "875390cb-b142-4141-9dd9-3bc4212239d3", "comment": "Malware payload", "value": "cc43f32a5174b2f88e9688a4ad9d41ade0000f9326a741f7a3ab56dacb977129", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531117, "uuid": "656a1e45-b3be-4ebb-8d69-b952c32efda1", "comment": "Malware payload", "value": "53f8438d22508ccef617f8c5a98220cf91b121a3", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531117, "uuid": "450fd8ea-33ab-4d0e-a36f-9cdef4f2eb94", "comment": "Malware payload", "value": "297adffbc3fd3974bb952dff0e4bfe9b40b618b9b7de1d4537df92400332b528a022a28f80424d161980ac689a8d9eb5", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531117, "uuid": "1ba9d21a-b11b-4b62-b3de-3825fe657a19", "value": "T173E17ED73AC1E0ABB79D14636D827DD153A861AFC045A047935C3A1DAE7AC53E030C90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531117, "uuid": "67b714ff-d741-4af9-a589-eaf1d18795b0", "value": "192:9/WhDlXp6psISGDJsMNKcZjP8f7zOXp/r:9UlQRVsMNLj+vqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772531117, "uuid": "7d10aa19-89a3-4f5e-bc4d-8461ec15c575", "value": 6978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772531117, "uuid": "09d449bb-398d-4046-b03b-5e514e9faf7f", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531117, "uuid": "7a6ba133-9383-479a-9d25-7b646baa676d", "value": "script gokil.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8447f756-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772519018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519018, "uuid": "44606687-2baf-4c7a-848b-e6d25013b54f", "comment": "Malware payload (Mirai)", "value": "4109a3232c81b0d8163732262d7e3bee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519018, "uuid": "4a5fcd35-d4bc-4b53-a4fe-225860bf2bcf", "comment": "Malware payload (Mirai)", "value": "cc59f6724dd5232bf2625e59ddf2c88359a35b494d05e5440054322348651d31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519018, "uuid": "592d5079-45b0-40dc-9fc9-935f32777015", "comment": "Malware payload (Mirai)", "value": "d3e8d475a34ade27ffd63aa526f7e8bc59b64f9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519018, "uuid": "42833f8c-26d6-4f0e-baef-436e6e485e5e", "comment": "Malware payload (Mirai)", "value": "8dfa8cc00557bb5145ade87ce412c8a9e7bdfc8111b99d7726e306ed10ea3313e1de28c048b1b9dbd60c7f0f7ed83ae2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519018, "uuid": "9ae9ad8b-a9d2-4eae-899c-e9d081a55d74", "value": "T1F08308792885F66CE5F640B8F45329E629120A083FDCD1E36883143BFF71B48B56DE5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519018, "uuid": "4bf53e73-8fa5-487c-bbd0-c0c6d57875e6", "value": "1536:Mx7k9rzR+34KwvwT6ErOzJcVBIVCCfy0K9vzKJc:x9rzR1vw6E6zgu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772519018, "uuid": "86d15133-0e93-4f74-82f4-09f854e7a406", "value": 83328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772519018, "uuid": "d44a7152-1893-4941-8409-60a573d7086a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519018, "uuid": "f35d3296-44dd-4811-820f-f37fe72c8ad0", "value": "nullnet_load.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f72bdc6e-1720-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772556577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772556577, "uuid": "b4abe730-b42a-4f63-ad49-f74e481227fd", "comment": "Malware payload (ConnectWise)", "value": "6927679d09c622752900b46ea263a9c0", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772556577, "uuid": "d57c09a5-15fe-409a-bd77-1f3b29dac449", "comment": "Malware payload (ConnectWise)", "value": "cceee71fd3161c6e939762bfba9de09e96e54d6cb771d02b3f9f3b761576c8ea", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772556577, "uuid": "9584933e-d225-46de-9aef-b89d9fad8db8", "comment": "Malware payload (ConnectWise)", "value": "4e58b48f0999d8b65eb15567579e6ea2514ab720", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772556577, "uuid": "7cb48845-6e1e-401d-8dc1-20e6ac15e773", "comment": "Malware payload (ConnectWise)", "value": "42833039fcc0b3bbb54701326caa47279b96bd762d92a504eec03d7e7729d76517e22adcd4007b4c71858c941471c872", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772556577, "uuid": "e83d10d3-f498-4ac6-a214-01cf5479f357", "value": "T100A6232153F9D028E0F35B35EE7AD165AA32BE618E12C15F1354780E39B1E8196B373B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772556577, "uuid": "16e5e67b-c13f-44a6-a01d-a0d854746a24", "value": "196608:SBn2hg5kEWmXhcfKjSVQh7vGeKBn2hg5kEWmXhcfKjSVJBn2hg5kEWmXhcfKjSV6:ugdEEij5DGbgdEEijsgdEEijkgdEEij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772556577, "uuid": "ccbb6a6e-9de7-47ac-b50c-1dc60c390f06", "value": 10121216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772556577, "uuid": "723fcb4a-b3a9-4df6-b12f-6d41527a1ada", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772556577, "uuid": "57bb8250-3701-427b-ab82-1534af88e10b", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faee6ae0-173c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772568610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568610, "uuid": "c0b217ea-1951-4dc2-a591-f6e43f67e7f7", "comment": "Malware payload", "value": "09128657c72fbc86cfdb9f008232817f", "object_relation": "md5", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568610, "uuid": "74cace57-9e25-4c8a-8d79-9d5ecae7793c", "comment": "Malware payload", "value": "cd72b847a00b79697cf21844243e8ddf58994b4104501f62fbbffdd812f50777", "object_relation": "sha256", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568610, "uuid": "93b106cc-d293-4b8d-85c1-14cc40b8dc7c", "comment": "Malware payload", "value": "1b45395796d22b5797484bb424d52f17dbf7bf0e", "object_relation": "sha1", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772568610, "uuid": "3f23a23e-c501-4c0d-a65a-eb07a5c7c6fe", "comment": "Malware payload", "value": "3743c1c5f10530f6f80a8c96ff19adf0ea4ebe4d95b2a3e44c84ceeee76a5cd6fd34289f6f798e1bde0acdec9577a447", "object_relation": "sha3-384", "Tag": [ { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hailmeinc-com", "colour": "#29C77C", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772568610, "uuid": "a7818a3c-84cc-4146-86bd-61d81cc0ae5a", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772568610, "uuid": "c4805da8-c274-4449-9ea8-be9810f4b1ed", "value": "3:VSJJFIqF1F65IF3JAn:s8qF1FU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772568610, "uuid": "c6265923-17ff-46af-8bd5-a10115196e02", "value": 48, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772568610, "uuid": "40fb0a4f-e631-4e87-ac41-cd5895edd143", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772568610, "uuid": "35012aca-8df6-4da9-b627-f1db4819f041", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6030b1f6-1708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772546016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546016, "uuid": "23aa293e-c8d5-4a0a-80bf-2e5a6fe20732", "comment": "Malware payload (Mirai)", "value": "c5eb81eaaffddee49120158415473855", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546016, "uuid": "9c662a29-5681-4b17-8024-15f0fe3fba66", "comment": "Malware payload (Mirai)", "value": "cddb70e393860e2bdd7fa2f13bcd74275da178bf7c259b367a24668b45ece143", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546016, "uuid": "8a983c1e-6af4-4550-8991-c6cce06cd341", "comment": "Malware payload (Mirai)", "value": "bc9ed0266496f55573c99596a96ceb30ea69c3d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546016, "uuid": "09979b44-4134-4413-92b7-f66e7970e4c4", "comment": "Malware payload (Mirai)", "value": "eb91d364824a61710da5b559045218c964868ba49f4eb73cbd39f151244d792e1c01d6085b3bb1e368077350a025bd63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546016, "uuid": "4d239c82-80e0-488e-a796-7127117a45cc", "value": "T1B7736C13758084FCC495C174979FB276C873B83D4279719AA7C4FE26BE8EE201F29585", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546016, "uuid": "b8b42424-f420-4b91-badf-d8e4c7da3117", "value": "1536:uU+KJ9mKIaLJL9k69j7TjDWnrMuiB1WMF0UYXFap+zu2:uNMLJLG69jDDWr1U1WMFoFap+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546016, "uuid": "ce1195a1-d22b-416c-8ecc-d933f7338037", "value": 77536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546016, "uuid": "2e9590ca-51be-4c41-ac52-c2b530315e27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546016, "uuid": "82dd5d6e-8f58-4d91-8737-409951e05822", "value": "titanjr.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "012e15ca-16d9-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772525670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525670, "uuid": "fecd23e6-d872-4cef-aaa7-4e5c09a7497c", "comment": "Malware payload (AmateraStealer)", "value": "58f87c46711b9b74a6e475b5ef3274b7", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525670, "uuid": "5173eff7-e8ed-44ec-9267-840ea0a9b1d2", "comment": "Malware payload (AmateraStealer)", "value": "cecd2b97cae3e23e80543330a027a66ace71e521c8961d9bbde33ea063d0801a", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525670, "uuid": "96b868c2-80fe-4d64-aed6-ae7b11033a87", "comment": "Malware payload (AmateraStealer)", "value": "a64d8fc67313a39c6634bd679a62ddcfeffc92f5", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525670, "uuid": "8ca3745c-866d-421b-8394-49620a756a07", "comment": "Malware payload (AmateraStealer)", "value": "c24eeaef8a9d5e0773174c30e4d33d3a4abca054293c4a06774c42640fbd12447d6a60e94997b6a3eeaa1bedadb7e157", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525670, "uuid": "86543bfe-5d7b-4570-97be-dad193c69824", "value": "T14F267D3221ED284AF273FF3546D3B567CBCA7EBB1E3681894481076A446B890DE54B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525670, "uuid": "1f642d38-2a55-4e52-895d-8b5d76fae361", "value": "768:QqvNHD0JW/w7YLQ5+F+voGKDmzzyvVxFxr2/OOCCDHcNH8zL8WnfWYfsQklGaRrP:1yAUs2UIkboWZ3zLCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772525670, "uuid": "85bb53ce-9d9e-4ff4-a308-00dc9cdfe8bd", "value": 4738940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772525670, "uuid": "6ad1171d-7954-4512-b1e0-daaa596b7fea", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525670, "uuid": "46874b5a-220b-4dfb-9145-efee092c4d4a", "value": "great.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db66cbf-16e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Smoke Loader)", "timestamp": 1772531087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531087, "uuid": "91d87e5d-003a-4573-99ad-2e6195f3b630", "comment": "Malware payload (Smoke Loader)", "value": "af8cf0f822a95aa93e9ff5ac119ac71f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531087, "uuid": "b1db0116-34ac-4900-b113-f61f0ddfedda", "comment": "Malware payload (Smoke Loader)", "value": "cf79cfa83d7705b103b3baaa675cc56127e9a5a9f70684f42831886992901509", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531087, "uuid": "d67db49e-1623-4b01-93f8-26ea2593eb2c", "comment": "Malware payload (Smoke Loader)", "value": "7d852989beede7acf75570f351fcbf8e5acca0ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772531087, "uuid": "6350d155-e106-4c4a-8739-d5bf16ab4db4", "comment": "Malware payload (Smoke Loader)", "value": "0b4dc727ffa059f8f257c23b9b676bb769f546d4fc7c3f1b2f784d7d82b44b26424b6ad9ded419106566aae25ed165ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531087, "uuid": "d1a00f78-5685-422e-946c-fd64330cc085", "value": "T16585381ABCE418FAD06A637388B752827BB4BC490B3263D32E9076782F727D55DB5704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531087, "uuid": "a90e8873-3fa2-40b5-8aed-0e40a14e648c", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531087, "uuid": "3f5f2e51-30b6-44a3-921c-fab005f64bff", "value": "24576:BrKhIn1U4RnPSHNigpH0nX9CCKxZxFFnf+gWtPRccldKo9:BrKh0U4RnPSHNynXQCSDdf+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772531087, "uuid": "afe6e09f-070e-4169-a4ac-48982c95ea87", "value": 1772032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772531087, "uuid": "22ac35de-e319-4d8e-87b0-0875e985e02d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772531087, "uuid": "ea3183c6-5dbd-4216-a4d8-e67c0891b60c", "value": "tXmCLyGO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b9a301e-1718-11f1-a769-42010a9c0008", "comment": "Malware payload (SyncroRMM)", "timestamp": 1772552746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552746, "uuid": "3953b68f-2c5f-450a-8864-0b891162ed7e", "comment": "Malware payload (SyncroRMM)", "value": "2319fa1a0c840ba5306eb3edc194b232", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552746, "uuid": "2e489988-20bf-4265-9266-05671dfbfae8", "comment": "Malware payload (SyncroRMM)", "value": "cfaa0dfa8af6f986d348ae402fb519fd2dc59b63a01f400c16136273d721d290", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552746, "uuid": "91fc4ca4-dc11-44b9-870b-15e478f1d969", "comment": "Malware payload (SyncroRMM)", "value": "57b06041c27574fec81436f5bb1e5c189b46bb12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552746, "uuid": "97eb843b-d329-4ed0-b0b5-e3f4f7d8f4f9", "comment": "Malware payload (SyncroRMM)", "value": "75bfa4bbed58a39bb201377517f05b21fabe9b75c8aaf2dd6b427ee4a30ed073b29eee749099b64979429665c28bc3ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SyncroRMM", "colour": "#DC553D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552746, "uuid": "f442ca7f-1ced-4a4c-aad6-52f663769f0f", "value": "T1E1461204F7A5061DF466FAF62D21711146B3BE479815C649E3B33088EA76E43CE6C2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552746, "uuid": "6b83aa31-b8f2-40bc-b2ee-ed2eb5fc6262", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552746, "uuid": "4cb04103-7403-41b9-a6b9-86b6f6d36cf0", "value": "98304:fh/evJLeTmDDi9UeK7kqXf0FGxLCbD3ha5Uc6v6O3xUM3/L9LI/cbt7/Cp/z2OIn:fh/ev5eTeW90kSIbDoUcfOhzT9cEt720", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772552746, "uuid": "2be9c114-2876-4771-8734-ababf4077c5e", "value": 5858856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772552746, "uuid": "45e666b1-4858-4464-826d-31749f4d093a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552746, "uuid": "0606d2a3-d752-4a30-8226-dc21c8a9f090", "value": "ContractDocument-v1-4906582.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7531fbac-16cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772520711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520711, "uuid": "3c06b305-f438-4352-9b34-383744de9c17", "comment": "Malware payload", "value": "8dcd02633e230e41d864c6bac6056de9", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520711, "uuid": "5234eeac-32f1-456f-94af-9536bd9656aa", "comment": "Malware payload", "value": "d0f06f44c541a3d7e665e0cf7a9e4e3965a98af6ce84396de83acce7960ac55d", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520711, "uuid": "69cfb231-f9ce-469a-aef6-a0dd3d994ff1", "comment": "Malware payload", "value": "36339f752dec75acb93a03e2b0f805882cf196d6", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520711, "uuid": "f1e1cd95-7de9-4b5d-a31c-82f4d44d179f", "comment": "Malware payload", "value": "43f78bb84e4d824ac1784905560d38a3a5aa55738f9b67a0a6cb6bbd689539be79ea9a992bc17372bd65152457490a68", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520711, "uuid": "57da4fc6-df98-4b6f-8ec1-c1fc7d856522", "value": "T179941212B3B5BDABF80787364CC409067107BC914B5A482F2DC2B32F1D7BBA5A56676C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520711, "uuid": "8afec5db-87b2-4e64-bfc0-27ee6b4138cb", "value": "6144:fSOY+3HGjhFLsXI2qh+otq4JqG60M6gysf4dddEOLSejz1mPFHLOuM:F3Ght1gZGfs2dpt1mtqx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520711, "uuid": "a8b914df-21e5-46e6-ba21-fa77e030143f", "value": 420864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520711, "uuid": "0a1aa51a-8845-48d4-b4b0-3019968d9de3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520711, "uuid": "15e0dcd8-6398-4a44-99fe-bc8992163c41", "value": "d0f06f44c541a3d7e665e0cf7a9e4e3965a98af6ce84396de83acce7960ac55d.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebc9d78-16cc-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772520110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520110, "uuid": "a8fb0f15-e070-4a86-b538-5f3ec05e862e", "comment": "Malware payload (AsyncRAT)", "value": "396e15d704db0913fa71d6092a44cbf6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520110, "uuid": "777c3778-77dd-48c5-91f2-2bc90da3ee4d", "comment": "Malware payload (AsyncRAT)", "value": "d1335a524df21481dc23bdfbb6827f21854d2aa9c17cfc4555c57cc0135113df", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520110, "uuid": "3dc9f62f-eb2f-4096-bdf4-4254ed1b2885", "comment": "Malware payload (AsyncRAT)", "value": "6b64eabd214e051fb71846acc8b192c1bd918421", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520110, "uuid": "0e40afa1-c7a3-42f7-bf1f-d923e24c45df", "comment": "Malware payload (AsyncRAT)", "value": "c92c6faebf97df2c8d0dc139c552a916e13c1c747fe38e0a435f8ed0926be79b70e20a09bb672fe43447c8cb7f1408b0", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520110, "uuid": "bc97db08-9fd3-475c-95e9-76cd071b5ecd", "value": "T1B7D24B08B3D88561E1FD57B94C7293048771EA4BA573DB9E2FC445AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520110, "uuid": "56571bb4-7398-43e2-83cd-348dcdd74843", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520110, "uuid": "c96660a0-f06a-4c91-b62f-5f52fd78d184", "value": "768:+IjQRX55TOmqsg/cIRGqou/Rb7fB/dTS/+:VjQRXHTOmqN1igRbN/U/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520110, "uuid": "8301300e-e02e-4a95-b383-a2984538891d", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520110, "uuid": "95dcbe54-5696-46fe-8761-683689142271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520110, "uuid": "e8396de5-65c7-4a2a-b747-65b5d9c75c24", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f82dc2-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772519026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519026, "uuid": "4669d8c5-7826-44d5-93c0-1a2169faf5fd", "comment": "Malware payload (Mirai)", "value": "e9b01cc6e74b2d16d2981a288070648e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519026, "uuid": "14a8b27c-6990-487e-a848-b3c4f743ba02", "comment": "Malware payload (Mirai)", "value": "d1d459eb90d6b52d47eb0efc9e83a84fcb4d0f0275c86d8f1d5447805016102e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519026, "uuid": "2285d90e-cc64-4f8b-a6df-e61467616cad", "comment": "Malware payload (Mirai)", "value": "b19d566873fcc3052f58f5f5e967a95cc0fbc495", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519026, "uuid": "bfbd1708-19f1-4c8e-9c01-9b22bb15170a", "comment": "Malware payload (Mirai)", "value": "dd161ded1afba57f5b388f8878d644dfa47ca3c35f7da7d08b8dac03241b0136b7331db8253936c139d0ddeea7a75fa3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519026, "uuid": "18dc82a6-3070-4e41-85aa-47fb1c66d0fa", "value": "T1AA731982BC40A62AC7C0177BEE6F108E3311A7DDD1DA3246DC154BA47A8ED1F0D27B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519026, "uuid": "b7870fc8-46fd-43b8-a0d9-f4e737838c10", "value": "1536:zgWFE1fyvz0itFTSvcA/LRV5OY6v7gB8t46/UHnm24g:Je1fxwUAjTQ84sUHmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772519026, "uuid": "c0f3e9d1-d4cb-4280-ba48-efb00e08458f", "value": 74984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772519026, "uuid": "c905da62-702a-425d-bc07-1d33d0a81399", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519026, "uuid": "c75b4b00-2e18-40e8-8c26-87ded905190b", "value": "nullnet_load.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892b86a8-16f5-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772537924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772537924, "uuid": "f6704f21-1fd9-40ff-a8ca-be08a69ee342", "comment": "Malware payload", "value": "524e470174ab24400c0e206d92d05f5f", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772537924, "uuid": "f86ce9d5-77c7-47b5-ba08-7d44274f4230", "comment": "Malware payload", "value": "d28a25b42e4d103f33104fba823a3125d105ea363c2302edb16bf6ba848efd6f", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772537924, "uuid": "4db893d1-60ba-4b7e-9c6d-a3b3ea91cb33", "comment": "Malware payload", "value": "f77fe1862493526b28ee65078ea78d4b511587f3", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772537924, "uuid": "60967700-6710-46a8-a78f-1e68145ecd0e", "comment": "Malware payload", "value": "4f5e32bd2f290c8778697a5f68751744c07924f1c2e9ebe957a0e74f98f67c69fb9c6b8c4fe6f6419129ab3a989329bf", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "RClone-Stealer-Mega", "colour": "#D2B91B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772537924, "uuid": "c030f647-1975-44e6-b1a7-cf725736312f", "value": "T1B641711027DE5250F2B37EB5E8BDB1C379293DA9F731C7CE005465A849B2004D993F21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772537924, "uuid": "f1ad6631-9bbe-4c36-8a61-2f8a24f786a4", "value": "24:8r/Ol5v6YF+sGaN6/u2Yh5LeKkD5eYIQZViBfNcRmlvKOCF+K+cPWk+/CW:8rGjv5F8b/u2Yh5SKkDAY12MCvzCtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772537924, "uuid": "d2d22ed6-17ef-41c1-991b-c55a87d80c18", "value": 2162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772537924, "uuid": "beec43c2-886f-4ac6-a232-9e55072d17fa", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772537924, "uuid": "b658c2e6-e2fa-4783-a61f-7272d69a9193", "value": "d28a25b42e4d103f33104fba823a3125d105ea363c2302edb16bf6ba848efd6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38c83bf-16a5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772503609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772503609, "uuid": "ccc8d3bf-d002-4893-8918-5b59dad63659", "comment": "Malware payload (Mirai)", "value": "d13a727e366fef31ffd3160aae2968f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772503609, "uuid": "ec9da1ad-9e3b-4747-bb00-2a5b9000e1d5", "comment": "Malware payload (Mirai)", "value": "d40ddd30871943adb3c447e4202774d8baa8f820ef2606314232049f9ef541e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772503609, "uuid": "f5c47e1d-10ac-4b02-9ba0-cbadf142c396", "comment": "Malware payload (Mirai)", "value": "a63ef81bce8e769ac9dd2947369b1fcbe02a8a54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772503609, "uuid": "b3c29bc4-e804-4137-880c-cca848bc7118", "comment": "Malware payload (Mirai)", "value": "f35ec1b61349fa7bc22bdcad100731d6e50c646546f209ad8e4955b31b47aeef45264b41e41018ee2cdcd2f2e6c7e0b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772503609, "uuid": "2655717c-808f-480a-b003-b20db96ee3fb", "value": "T1E8F30745B8518F16C6C526BBFF4E428D772A1768E3EE7203DD256F20378B95B0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772503609, "uuid": "801989a8-9d96-4d14-ae10-36e5dd9900ec", "value": "3072:aHDCPFx5RmwfGlYhOj/uBDh9dzUz4LFuVv8u7vdtof9:eWPFx5Rh4YhOj/uBDh9dQz4LEVv8urdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772503609, "uuid": "3cec3289-165e-47cf-83b5-3e50411940a9", "value": 158200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772503609, "uuid": "48537bd8-0dc0-49b6-9872-25380a2d4651", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772503609, "uuid": "ac32087b-bed3-4b3c-9864-f99d79863306", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c22178-1748-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772573646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772573646, "uuid": "b853b8ba-5fd0-481f-8385-5bc9c311ff6a", "comment": "Malware payload", "value": "0009f4b9972660eeb23ff3a9dccd8d86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772573646, "uuid": "8408e323-5de9-4ea4-9ecc-00d9ebd8de84", "comment": "Malware payload", "value": "d484b9b8c44558c18ef6147c6ca8276a462fccf2acb2863be4ee9bf37942f11e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772573646, "uuid": "66a465aa-96a7-4ecb-b742-1bc6c0a0c5bf", "comment": "Malware payload", "value": "12180ff028c1c38d99e8375dd6d01f47f6711b97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772573646, "uuid": "fca79262-ed3e-4c9d-b621-4708cd8eabc5", "comment": "Malware payload", "value": "96179a81634d642667efa55b27614b56bd87b86248e002784cf4d3ed641533d0e7f1587ae9da3f9621ca66d7583585cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772573646, "uuid": "3e98512b-dc75-44e0-b571-3f8bae04e93f", "value": "T15CC7332364D2C03EE656A0728C6F8EA446A2AC274F318197B5D5FD282FF55C1B627F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772573646, "uuid": "a2f24148-6041-4ab7-9cc3-3c549ecab156", "value": "b950d8063774a26bdd19d96b6b3280f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772573646, "uuid": "c0cc9b92-7b8f-464c-95eb-629dbb2c9080", "value": "1572864:sA59t4XCWb1PpYFWqq+VuTMBGJ0YaX3SZQMPT:sA59uXt5P+V/BIanSZQMPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772573646, "uuid": "e0927120-bf57-4aa1-b8f5-9a2ce7dcaf2b", "value": 57763752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772573646, "uuid": "10c9774a-e7f9-4595-bc48-8cd1a2b6908c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772573646, "uuid": "ac655a12-67c6-4efc-be89-f029eb701077", "value": "d484b9b8c44558c18ef6147c6ca8276a462fccf2acb2863be4ee9bf37942f11e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42614b12-16a8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772504734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772504734, "uuid": "f188298f-2757-4890-9b11-8172059d252d", "comment": "Malware payload", "value": "ecade39de4d4681b7013721718744286", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772504734, "uuid": "87b82c89-af4a-4ab6-a7ea-25bee5c8e749", "comment": "Malware payload", "value": "d533427990f626325f536b738c6fcbaf6e49b163a1cc465302f889b7c4e26a54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772504734, "uuid": "dec873f4-21ad-44b9-9457-4e7a36ab8189", "comment": "Malware payload", "value": "7a208aa8f9ead4d4393aaf85232472a87a840012", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772504734, "uuid": "2dd4d12f-5b4c-4aad-95ce-2ee45ad3a5a7", "comment": "Malware payload", "value": "2a8c825517091d32b00b3f5763e61c3b33619b5109a9f47f303ad9ebf275eeffcda87f37b8f8993bd95e3e9a9ac6b65b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Kimwolf", "colour": "#045401", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772504734, "uuid": "e9e26c6f-84cb-481b-99b1-b271dbdfd590", "value": "T17AD63B9BB4924A82C9E43A37B8BD80C433620EB99F9756575D15FE3C3ABE4D90E35304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772504734, "uuid": "4594f4c8-b0f2-4d00-a529-8fcc964fa9c7", "value": "98304:5n2caKBjWBIWr4Q/VTmx3/Y4+a6FzvYsYcP4/YE:5OKBigV/+zvYBcP4p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772504734, "uuid": "919101aa-23df-4a86-9add-06bc52514d5b", "value": 13272760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772504734, "uuid": "67f31430-482d-4f0d-a951-8846a3a3f678", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772504734, "uuid": "97d81f30-784a-40d4-a12d-df5cc2abd115", "value": "d533427990f626325f536b738c6fcbaf6e49b163a1cc465302f889b7c4e26a54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f7559f-1711-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772549994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772549994, "uuid": "2cb27b90-33de-42df-8019-125dcd509f74", "comment": "Malware payload (SantaStealer)", "value": "5917168a0fa8c16e0c1c8f3a8dfbb249", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772549994, "uuid": "c3c446ed-e76a-42c8-9c2c-52da4ada9519", "comment": "Malware payload (SantaStealer)", "value": "d97ded6d8bf355a04f92a46401ac5b8ccf5eb290f2eec604a5aab6390985006c", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772549994, "uuid": "c740bd9c-5825-417b-b9a7-b1867bb5883a", "comment": "Malware payload (SantaStealer)", "value": "c8c234031cb11159e9d5d93ad7ec89b1d009795c", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772549994, "uuid": "3eac1c07-7e33-43ec-be7a-6b4b17ed3303", "comment": "Malware payload (SantaStealer)", "value": "e0aba78b3b79007dcdaa5df03e806bd1d5babe66b091f3efaee4c4c57e45352055b245fa0b9c5cbc71c0895ee46294f1", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772549994, "uuid": "b3330eb2-2723-4e3a-9dc7-d7a5fa4e8e7c", "value": "T198A1B62809CF03D5C662BDCC8EF4F85BF712091B9B38D9196772EDA064255BFD1E9A08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772549994, "uuid": "514e5ec5-444f-4c6b-85d5-91c88bd34341", "value": "48:0uxxHXLglmelCMdwIWlCuC9/SCka5wUDNKzowIN0+DpZlTQHVCTwCyCUCEsCxcal:0I8EucESVcKcie63eATZNsypv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772549994, "uuid": "bcd9ce4a-520a-440a-af69-4beeb36bfc4b", "value": 4759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772549994, "uuid": "4593c22f-9cb3-49c4-ba3b-292ce510569d", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772549994, "uuid": "27054ffd-d9fc-4b56-82fb-bdd3e3dd7eef", "value": "fix.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776ddb61-1749-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772573972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772573972, "uuid": "dd4b4b62-1b8b-476c-9cdb-fc31d1e2b7f1", "comment": "Malware payload", "value": "b1549dc141bad1ef7419b819f2419514", "object_relation": "md5", "Tag": [ { "name": "VortexWerewolf", "colour": "#683672", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772573972, "uuid": "4852f290-9958-4655-a5e4-9944c558d396", "comment": "Malware payload", "value": "d9f900fd7b7b2d81d396a23fa9ce65b78856e4be7c254bdcafd03c1f1a382187", "object_relation": "sha256", "Tag": [ { "name": "VortexWerewolf", "colour": "#683672", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772573972, "uuid": "b7c1e987-007d-4c93-aafb-fbc34810f48c", "comment": "Malware payload", "value": "02801b28d657bd3eab74538877b75b6f960c5663", "object_relation": "sha1", "Tag": [ { "name": "VortexWerewolf", "colour": "#683672", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772573972, "uuid": "0b15bbee-248c-49ba-93b9-a247000fd4e3", "comment": "Malware payload", "value": "9835036a4386648d5024a6a6e8731c97c1ed51580b0bb4f84bd4bc986068ad3db48a7083c316c7236f5db5fe1ee3a596", "object_relation": "sha3-384", "Tag": [ { "name": "VortexWerewolf", "colour": "#683672", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772573972, "uuid": "9c4d6d73-e363-43c7-8292-89ce1ff7a616", "value": "T1BEC6336C6E71C9E92B96AB510B4A3FF8B7440A243E91418FCA51344592337FBCFDE216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772573972, "uuid": "4afc3325-2aa7-4af7-bf2b-a9373d48f629", "value": "196608:T/N5JiLcabtbzRXqyg4EqSvKcagek2ss4KrKayHSegauoO+2ysrwkbwYmNnloMTI:DJ8cabtb9TxTSpewZuvegj+2jmlzh9eT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772573972, "uuid": "e76c14aa-a2f7-42a7-a058-27a11ea6b1ee", "value": 12325220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772573972, "uuid": "56510854-5b7a-4e49-8e46-baf20e19504f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772573972, "uuid": "8d0e9273-0e5e-4d14-bb92-2692f51220b7", "value": "6526_Predstavlenie_na_naznachenie.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8565493d-173e-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1772569271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772569271, "uuid": "e00a1422-ae88-47f3-825f-33cd569a8254", "comment": "Malware payload (CoinMiner)", "value": "9077da7cd22576198fabab99f0e572cc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772569271, "uuid": "d38ba0b6-c4c2-48eb-80a9-d0b0b005b466", "comment": "Malware payload (CoinMiner)", "value": "da2d172c8d2c8e6d53a457e6991aaaf5805e16fa216749a4c87d757050db2903", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772569271, "uuid": "e50079db-f471-4a26-9e7a-936fdcd90056", "comment": "Malware payload (CoinMiner)", "value": "0dee7d5d36e4d914cc7632aca43f89c32f248b5e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772569271, "uuid": "e2f14cb1-c51d-45b6-811f-859974e4ac9f", "comment": "Malware payload (CoinMiner)", "value": "97e88c8477c842736921d86e2f229473a364428be4f26d8dabd8654cdbcfdd0d1e68c299595cd6062024bacd34332edd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772569271, "uuid": "d98f6213-f15e-45b3-805d-ed50f9ae396f", "value": "T1E1363351F3CAD5BDC1A22DB6921847B18EE2FF152B8996D74B1079269D783C02A7C0CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772569271, "uuid": "022c0981-b8c1-4d80-b795-590160ffae36", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772569271, "uuid": "17b4f981-282f-4b08-8347-3a64eec575a3", "value": "98304:Jo5pB/b8fBiYjuWpQqMvHgWIGMKad3sNp+kcLDoyQ/jkNnz6WxG/:JopQ4YjuI9MvHguMKNp+RLD9796WY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772569271, "uuid": "63e391df-fe77-4ef2-b790-b2e60c5c61f1", "value": 4895984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772569271, "uuid": "854e9384-a223-4ccc-b41c-34945b36b05e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772569271, "uuid": "ba46ec91-11a7-4bf5-bffa-03b3f663188d", "value": "Printer_Driver_SSL_support_v43.22.209.99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912d2184-1700-11f1-a769-42010a9c0008", "comment": "Malware payload (MofongoLoader)", "timestamp": 1772542662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542662, "uuid": "67fbbeb9-1111-498e-b850-b4c83c472c5a", "comment": "Malware payload (MofongoLoader)", "value": "8aab08523e3c6940947cf15f9ca76cff", "object_relation": "md5", "Tag": [ { "name": "MofngoLoader", "colour": "#643816", "exportable": true, "hide_tag": false }, { "name": "MofongoLoader", "colour": "#FDE547", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542662, "uuid": "14505c44-1530-46a1-a48b-09d7d91dbd96", "comment": "Malware payload (MofongoLoader)", "value": "da53debbb1af2bced38f47f66c83de73f11407821bff7494598fab949d6dc3a5", "object_relation": "sha256", "Tag": [ { "name": "MofngoLoader", "colour": "#643816", "exportable": true, "hide_tag": false }, { "name": "MofongoLoader", "colour": "#FDE547", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542662, "uuid": "dda75b11-6081-4692-9337-bc0f8ab3db5d", "comment": "Malware payload (MofongoLoader)", "value": "2c616b87a635f0f22216462ecd2e253f2ae0efcb", "object_relation": "sha1", "Tag": [ { "name": "MofngoLoader", "colour": "#643816", "exportable": true, "hide_tag": false }, { "name": "MofongoLoader", "colour": "#FDE547", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542662, "uuid": "9186e89b-b746-4fa9-9b6c-ccfc7e9665a5", "comment": "Malware payload (MofongoLoader)", "value": "5896b02854f4a5a7139252984a3fa62c6e7887ac047075149bf35548b70538e472578facece1be841c489ce7b6fbfb34", "object_relation": "sha3-384", "Tag": [ { "name": "MofngoLoader", "colour": "#643816", "exportable": true, "hide_tag": false }, { "name": "MofongoLoader", "colour": "#FDE547", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542662, "uuid": "0b1def96-8f5e-444d-9b7c-96d70e7e1d19", "value": "T11BE46DC6EA610CE8F47688388D73721AB9617CB9432056C726917676DB336E4F93B703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542662, "uuid": "29b3c080-3574-42c7-a771-69b19159e8ab", "value": "a4c7af5b984e42905e48e6567ec22587", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542662, "uuid": "d325d084-6f75-4d27-9412-d1f21ee6421c", "value": "6144:GvZCqtNVfi0ZzEGFwMHViJ1bK+zjD+FM0kz6kUJYeASlF/+xZRtiKzvzaOchYg:GvZCCukzEGCMHViPbK+zWFPkzNzDKOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772542662, "uuid": "f60fff2f-ee50-4283-b6e4-b889b1205b9e", "value": 690408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772542662, "uuid": "fe0e13f6-6575-4aba-84b5-cba5985356eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542662, "uuid": "99a72ce4-9102-4897-9fd7-50bf1b317761", "value": "da53debbb1af2bced38f47f66c83de73f11407821bff7494598fab949d6dc3a5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "904ce46c-170c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772547815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547815, "uuid": "d9bdd11a-2900-4ea6-ba6f-dc96e80d7405", "comment": "Malware payload", "value": "cc6b7d9e2fd7202d55e8c06012f256a8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547815, "uuid": "82baab5e-cc23-4127-94fc-59c1c5c649e2", "comment": "Malware payload", "value": "dabe22d794a19ff71c5212c391ffe19caf0542cfd68b951a66d87aca55a300bc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547815, "uuid": "c543baea-203c-4f49-9c8e-40f799e2f20c", "comment": "Malware payload", "value": "06281bffa9aa4742aac5f56dbe08a74b0841f5e0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547815, "uuid": "dafdb597-2189-47b5-9674-c2132f24bfa8", "comment": "Malware payload", "value": "631b5e3a90e5fe2667ced29c375b3a741a415ec9a5c9707bc6c7a146e3f2b44eaed44c8d4692f8081bcec8b7ce44a779", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547815, "uuid": "5b2ae565-2185-4e01-b96f-9af68b4b6065", "value": "T13DD1F5202DEB20DD72375FA027C8B5FF0A96E4B5282DB1F420418A494774AD5CCB2F78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547815, "uuid": "42979732-10b3-490f-b08e-922cb6849df7", "value": "192:SZRbhQdI/bhQC9vTcOtcgn3KDeO42VCJcQRciVCF6GncMZ:+PtFFTcOtcgcZV2cQReF6GncMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772547815, "uuid": "58422096-d344-4365-98f2-17e77008283d", "value": 6304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772547815, "uuid": "24702daa-8231-4d21-9429-29a1ae5c3f4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547815, "uuid": "f0ae9b0b-8473-4339-88a3-fc8965f84b21", "value": "f.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869d4217-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772519022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519022, "uuid": "f71c9973-e789-4aa5-9e55-8b63daad8079", "comment": "Malware payload (Mirai)", "value": "59282b9e4e7f98c9fdfc2c576670301c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519022, "uuid": "9360dcf1-7539-4637-83c4-8c306f5535f9", "comment": "Malware payload (Mirai)", "value": "db2f885b765a0b3bb952ed936e407236142d68a30ec70839fd1f016cf3521f4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519022, "uuid": "dc9f4ca4-8277-4138-8b0f-df89890cbb89", "comment": "Malware payload (Mirai)", "value": "9b47adb77459bf79a49f01d03ca967c0a3063e4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519022, "uuid": "9ce8bb27-1dd0-4d6d-926b-9acc35089897", "comment": "Malware payload (Mirai)", "value": "eeff3997e11ec9f55b725939117ae86356e9a791fd3b8ac4d4a329e1758d3ec507379192073c1146ae57cbc983d66b25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519022, "uuid": "0023e5e0-b3ec-4512-815e-a21edb734f19", "value": "T161A3820E7E319F7DFBAC823887B78A219209339666E1C584D19CED026E7434D741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519022, "uuid": "49783e93-708c-409f-97af-1111ab2c02e7", "value": "1536:3F1NwgB0VavWbypFWsxZmtcBbVgPKpk/dEw6Dg6dMA85zAjNQ:1XwgBk2pFWImtcBBW+sEw6Dg6dMA8tmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772519022, "uuid": "96efc060-0182-4bdc-88a3-f27b096bcceb", "value": 105200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772519022, "uuid": "7c422021-094b-4316-858e-1a5f6bd450ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519022, "uuid": "291b5386-009d-456f-ae07-9e5d4c19f0cc", "value": "nullnet_load.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05890c53-1718-11f1-a769-42010a9c0008", "comment": "Malware payload (DattoRMM)", "timestamp": 1772552736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552736, "uuid": "de775be1-8e8e-4ce7-91dd-41d759562d2c", "comment": "Malware payload (DattoRMM)", "value": "25a49c98bbe33a9abb304478a3920a05", "object_relation": "md5", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552736, "uuid": "792e2e6a-8113-4163-ad8b-201dc814331c", "comment": "Malware payload (DattoRMM)", "value": "dbdacf9d50c31e2a1a216c1a59ec81e42766593a3f19339c89d8eec69009db5a", "object_relation": "sha256", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552736, "uuid": "971e6634-4412-4bf8-b7f0-536db3a95ee3", "comment": "Malware payload (DattoRMM)", "value": "88a7e423a5984bed9a88e8f43e04fc873ffd6a62", "object_relation": "sha1", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552736, "uuid": "48cd47b2-6aae-4730-a457-5cef0bc52866", "comment": "Malware payload (DattoRMM)", "value": "16db3b9238c3fb606f94c2fb4c914f8a665c11f62ce118461cb1ae673ff201a28ba40905f58cb36beba29a5f82954b76", "object_relation": "sha3-384", "Tag": [ { "name": "DattoRMM", "colour": "#2EF580", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552736, "uuid": "814f4da9-72b9-4e2a-881b-4af84fa0a3dc", "value": "T14DB63347D9778DF0CA330B3890D21A6B3205980E485BF4C9E509277ADEF35AADD2879D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552736, "uuid": "cba86c15-28f1-484b-9f91-b623fe5c458c", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552736, "uuid": "c2601609-ddac-472d-84a4-03480fd70e53", "value": "196608:waZk+weP+CHD4a+KFwUUUx9Y2NPFOsti7A95rIUsFp29XaIT030Hy0SarlZr8s2h:KnZmzZFw5S9pE7Asjp29qIT0jarlZr8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772552736, "uuid": "459e91cd-2a9e-4c8b-9e37-af0fce48a848", "value": 11056048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772552736, "uuid": "a1fc8e49-0b72-486c-93d9-559a78958fb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552736, "uuid": "4f76cdc0-662b-4c2e-bccc-7e114d7f6103", "value": "Review-DocuSign.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f794ade9-1715-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772551854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772551854, "uuid": "720f2b28-81b6-4e9b-99ef-ae606704e4ae", "comment": "Malware payload", "value": "d3728d932293bd74cccce36363f14842", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772551854, "uuid": "4984fafc-68f5-40f5-963d-09de45d5c7f7", "comment": "Malware payload", "value": "dc12ca4ee3130d738acaf56426bf2185f41ff0674d306fbb47230ad42e445690", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772551854, "uuid": "64269ec3-9def-4ce1-920e-9df2b3f20ab2", "comment": "Malware payload", "value": "dfabc423ee2101afd2b51b61f5e5be9478d2b9b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772551854, "uuid": "d0d32cd9-eb0c-491e-82b1-63167ffac9f4", "comment": "Malware payload", "value": "6ac5505bb576514490477b5de046432bcb3bd1f0cf2807af17e00138d6ec7c2293fff9364b3857145d0982e22f543853", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772551854, "uuid": "663d1869-5534-4b40-a47b-6d8d46f4f97c", "value": "T1A025F1A913F534AAC31F47B7811A4211ADB60870F70BF95C9F46E72231A13D2ED39D9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772551854, "uuid": "814351c2-b270-4fbf-90be-784bbdbe22cf", "value": "24576:aAIZLRSj/lLyRwM+6m8OkWLFWLPOzN86rXYqiV2XOai7:aGLy6LkcLFWr0r8Z7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772551854, "uuid": "c796fade-de76-4854-867c-3f15aff3e6a9", "value": 974542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772551854, "uuid": "06b9945c-f4e5-4e7b-b437-ee7f9837a854", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772551854, "uuid": "b07ddb0d-fbe4-4bf7-9374-a132b1cf308b", "value": "download.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b1d23e9-1706-11f1-a769-42010a9c0008", "comment": "Malware payload (GuLoader)", "timestamp": 1772545122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772545122, "uuid": "80df297c-1de2-49b0-af78-66453823fe3f", "comment": "Malware payload (GuLoader)", "value": "5e364c1e35445b655ca30ab0c5bc7a4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772545122, "uuid": "60a4438f-2537-4b37-8007-377de9ca8e40", "comment": "Malware payload (GuLoader)", "value": "dca40a0120ea176aa65b99c90d171761cb8bf696be4be026941f7f54e3c21635", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772545122, "uuid": "726bf9eb-714a-4232-977e-dfe8e0966905", "comment": "Malware payload (GuLoader)", "value": "0ac9950d00429ff4509c7fb9aa7320a45a0465ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772545122, "uuid": "e7bf49d0-9d16-4327-a1d5-cb295c74fcf0", "comment": "Malware payload (GuLoader)", "value": "40066ee2b6f5bb76b8dfa0f245b15cabcb6f91f7759858d76f359d04a763d1649056dfb13c8f2eb2f6ed6adfbaa4d3af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772545122, "uuid": "3cd33e14-beb5-4e6d-8985-77898af127f1", "value": "T19F3533B35F45C05FC9412539277FDF7DBAFA8E70120D248A13E0B9AB24725548A0E6FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772545122, "uuid": "67647d84-6783-452c-988c-a41586e9528d", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772545122, "uuid": "15d18869-fb46-4ba0-aeca-3b74f7d98006", "value": "24576:wf28/1N1Ou5SR2K1KuN5UE8w4a7ey57F7f:Q28dNuF1bkXwBX57p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772545122, "uuid": "9a06bfef-b0f0-4585-824f-f3038a4053ca", "value": 1082299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772545122, "uuid": "83255c59-ccdb-4764-8913-4ad090ac8ff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772545122, "uuid": "cfdfbe2c-8406-4a04-894e-015553a1dfe2", "value": "BL 3425005143.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f8d2796-170c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772547599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547599, "uuid": "3fc076c9-fb82-4582-a2f5-3a192939bca7", "comment": "Malware payload", "value": "7ae255a40b4d91d1fc9d4dee57a89be1", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547599, "uuid": "e2ffc652-d052-4f62-baa1-46b7db96240c", "comment": "Malware payload", "value": "dcd24c86c61fa88d37f17be33b8a047e565599885d467db29c571a6279ff4ad0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547599, "uuid": "f577e080-42b4-47e4-8081-c3e09b012fb9", "comment": "Malware payload", "value": "0b3f4942dc4391a4b12dc2d3bce69b859677e8f5", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547599, "uuid": "b138425c-9090-4bcb-b136-87f70da35c87", "comment": "Malware payload", "value": "0b9c755e11b99b7c2879276ba2f444897f8b274e4d66399a133760681e66b264de7d560db529fef3de7809db180ef930", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547599, "uuid": "19eb7ce7-4ecb-4d30-afdb-650f4717a589", "value": "T18A5412B76AE6BEBED81E41F39253F8B0B7011D09E9B47422184343DD0DAA69D05291FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547599, "uuid": "5e08dd05-c9aa-4414-8d0c-86853d1edf44", "value": "6144:JAsHxktl5lNXlEMsBkUK1pownvPo1zjMR/AK7d+EWK4cYqdAdSljG:dktl/NXlQBkUK1DvgdjMRz+EWKAqdhNG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772547599, "uuid": "87012d81-2952-4cbe-8a3e-38c67106dbc6", "value": 305760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772547599, "uuid": "3dd7c5ea-effb-4869-86ef-b2041bec12b1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547599, "uuid": "4b41d078-fa5d-49b0-b222-49359033567b", "value": "Remittance Advice 02.03.2026.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e42293f4-16d7-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772525192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525192, "uuid": "b786a000-f61f-46ee-8c0e-e8589588b583", "comment": "Malware payload", "value": "9d180552bbb6794dbf1bd1f038bd53d5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525192, "uuid": "606b6332-fcc7-45a2-98f2-f07693f60dbd", "comment": "Malware payload", "value": "dcf55fd28857ea2d4d86e6029858578705faebc1959164959f176c37d4135d4b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525192, "uuid": "b2eb3a75-66d2-469e-a1e5-8637de274f8b", "comment": "Malware payload", "value": "ed6127a6b7a21b83b1cab73806c7d5f1787967e9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772525192, "uuid": "a13783ae-56a7-439c-afa3-e5f6beaec1de", "comment": "Malware payload", "value": "165900e1afd2ac0de7e24b591fb3d05ab39781b2004d674fa2cc7a5e2a972b314c79089c574411b379c4e7a4d83129f5", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525192, "uuid": "d4bdf995-23c4-47b9-b9a1-8b3dd87416ee", "value": "T17D925DB412896C79FBD0CE399F3C6F4DADE5C2C42124A3ACBA0F39205A1166DC70535D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525192, "uuid": "b3c49d79-9ab9-4d35-ac3c-b36d6f722b95", "value": "384:QMcuQpWx+BL0SWL0gjzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:QM8i+BL0SI0kzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772525192, "uuid": "2646d56f-f665-42e9-9939-f0f81faa9dfa", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772525192, "uuid": "233e3100-60b2-44c0-8468-82e9e394faef", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772525192, "uuid": "784f2701-6872-4d48-b806-d596ec8cacc4", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aca5388-16e4-11f1-a769-42010a9c0008", "comment": "Malware payload (Metasploit)", "timestamp": 1772530572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772530572, "uuid": "e82afa98-0d7b-48fe-86cb-7783ef6b4612", "comment": "Malware payload (Metasploit)", "value": "c316be4e0d11e19936c577026d96a63c", "object_relation": "md5", "Tag": [ { "name": "141-11-107-134", "colour": "#BF8B25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772530572, "uuid": "45bb27cc-6509-43da-8e97-b66e1970933e", "comment": "Malware payload (Metasploit)", "value": "deb4f380d5161558f6346b3454bc6940e448d42331c18d5897e5b584c541ea01", "object_relation": "sha256", "Tag": [ { "name": "141-11-107-134", "colour": "#BF8B25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772530572, "uuid": "078f9a94-85a4-4860-8f30-0ec82b164f50", "comment": "Malware payload (Metasploit)", "value": "b76161085193fdb4e93ae0f5dbe8561e2a1f3081", "object_relation": "sha1", "Tag": [ { "name": "141-11-107-134", "colour": "#BF8B25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772530572, "uuid": "398d2544-79db-480f-aabd-eb8b5bd1e10d", "comment": "Malware payload (Metasploit)", "value": "885b29b75cdac71977ce177bf26e954aa0afeadd71aba51f7dc5f6e726594f340b584252c006653a434e240d6f5bacb4", "object_relation": "sha3-384", "Tag": [ { "name": "141-11-107-134", "colour": "#BF8B25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Metasploit", "colour": "#EDFD74", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772530572, "uuid": "f05f7bb1-e05e-4284-8b5e-969810d8c894", "value": "T1DE821A897B15D8CDC5B68179C4321D2AA229F36443724BEF27B4442A4DA3BB07D2DFC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772530572, "uuid": "aa26f56b-6cd8-4db2-a058-14119d8975ab", "value": "ba782605aac629a26bc1fecb2cf3b2a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772530572, "uuid": "5f6b7998-458e-4b96-8b25-7437ce77d76c", "value": "192:IFuOW7Lam/qxNvZzgUuzjm+xatsJlNf6gr2PxsMKuzt7ffn6uwnvdzL6GfaHtDkR:IceV4P6gr2uY5Hnzwnvh6GotgHc+jx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772530572, "uuid": "9ae193c5-fb4b-44d0-b969-726d9bab1604", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772530572, "uuid": "f50a1195-7304-4c4d-9027-a13f82fff038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772530572, "uuid": "d6ec1d40-1e22-4737-86fd-1eb581598e1b", "value": "hfsServ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1cfb84-16cd-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772520728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520728, "uuid": "b8cfd96f-18ac-49bf-b572-3275b0f6e767", "comment": "Malware payload (XWorm)", "value": "e845883eb355977200177c1bdaf002c6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520728, "uuid": "f78a46f7-8dc1-4b0e-80df-4e8706e02391", "comment": "Malware payload (XWorm)", "value": "df3668ed018d7153838d31bee2f4ff5139aafa8f613048e80851ca664146fc98", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520728, "uuid": "2c9018f5-99da-4a8f-a4b4-1fc1c2838138", "comment": "Malware payload (XWorm)", "value": "e8cb3d0336aa62e26634b9fd774b04f5b19effa9", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520728, "uuid": "b0ce5f2e-c2fe-438e-9165-0096a3e3b6e6", "comment": "Malware payload (XWorm)", "value": "13bc5e767d87a68abf681e0eb565122e6e9e9472fcb31ca8ba0da74ed5e461272da61d594e202c2ed2c556946d1c6b6a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520728, "uuid": "6b3aa998-db41-40f3-80b8-f8bf9a91f4ee", "value": "T1B935EFF9859FF87445E90629F67563D19A78DC03057C69EB20F228C2C2B4E4C8D3AE79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520728, "uuid": "9db603fe-e8fb-4496-bf63-8e0760a4c424", "value": "1536:DeXdVhQhVkF5I/MM3ODMWNSGJLcR/qWnUvZPrSD:qtkhVTkwODMWUGJLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520728, "uuid": "11941be9-b89f-4ffd-a44e-287de513ab12", "value": 1150386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520728, "uuid": "83c1cd5e-9418-4c91-836f-555903004a98", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520728, "uuid": "f3f1a1dc-8068-4eed-aaae-11866fc1e08c", "value": "Contract.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85bde32a-1729-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772560253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560253, "uuid": "bed58dc1-8415-4540-94d3-aab163bb6fda", "comment": "Malware payload", "value": "31b0f9639af7174ff584a416232d844f", "object_relation": "md5", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560253, "uuid": "f368e9ce-03d7-40eb-b2d3-427741d787ff", "comment": "Malware payload", "value": "df55e2f51e5c31cfc425ccae2e4d239a93546c46abddc139734742bb110b1abd", "object_relation": "sha256", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560253, "uuid": "b7774aac-014c-4142-8d30-776e10fbe1c6", "comment": "Malware payload", "value": "cad457b8e6989d2b4e79506a5af4230730d75f9e", "object_relation": "sha1", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772560253, "uuid": "3e99228b-b253-45e0-880a-7b86a3a6d387", "comment": "Malware payload", "value": "eb055a6a5a9a03b903b4421b2ce4d1d03013b7dfc25d6a1397d4aad0332c18e23a4c96b4e310b323c79df336f8c79f4b", "object_relation": "sha3-384", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560253, "uuid": "e6d9c70f-600a-4d95-908a-e91d72a691ef", "value": "T16E210F2B0794A2BB5B14C05D8B6C9F10FE01A0E6F40455DF37389B5A0A850F7C1F5885", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560253, "uuid": "ba349ec5-adfb-46b6-becd-6a8316287cf1", "value": "24:LI2rUbD4euW3cCMDZ8En1Yw5ACLAC4UJsk+y+zl5HuVMazgz+u5WNzj5WwCa5WN1:CD4rPPVn1jyBKQDzlxu9zpuK/fCaK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772560253, "uuid": "f244dc26-1423-4182-b270-36093500171e", "value": 1367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772560253, "uuid": "81a5d823-fd41-4733-94b6-93de1c8b2dac", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772560253, "uuid": "b498335f-c333-464d-b6cf-9cc7c9673b75", "value": "fdzybtc.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfcf5f07-16fb-11f1-a769-42010a9c0008", "comment": "Malware payload (Gafgyt)", "timestamp": 1772540647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540647, "uuid": "21e2b99d-e743-4d05-849a-125c3766ce22", "comment": "Malware payload (Gafgyt)", "value": "495e24644ec234cb0158456a653506a3", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540647, "uuid": "29caa0e6-d15c-409d-93e9-e1db3a72fabf", "comment": "Malware payload (Gafgyt)", "value": "df5f09d6a3dc39972c53664cae3d280f0f953ea4a1698dad5a440ccb63570dcf", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540647, "uuid": "5e8067f2-f6a4-4153-be88-1cff46272530", "comment": "Malware payload (Gafgyt)", "value": "f300ffb25e24858b5263da5d425269777dd903fc", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772540647, "uuid": "d6d7c1a0-75da-42c8-9f7f-5f0149c1e22b", "comment": "Malware payload (Gafgyt)", "value": "c9fca41d39454e5d4d3d93acf2a9d20e42649b7e9b84c5435d53fcd524b4790521a03a5e46724266b95ce134d762556a", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540647, "uuid": "35aaa6e6-f686-4d69-97a0-2117177253bf", "value": "T1CB93D604ED505737C2D23BFAF79A42CE77351F986B97334196283AF41BE5B982A39120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540647, "uuid": "49149a4b-3c34-40e0-baf9-dfb6ab1c345b", "value": "1536:FSyqHwbRuW1i4sB9xQMOvA9dHB1WoAgqWhQaaZiJBU1WhRYP3fHG8uPMJ+f6/H2W:WwbRuW1i4sB9xQMOvA9dHB1WoAgqWhQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772540647, "uuid": "a753fd54-61c8-445e-9a7e-b92f50336a6d", "value": 95137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772540647, "uuid": "bd405c08-a025-4766-9826-5144aa43bfaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772540647, "uuid": "b56eca58-fbb6-4d86-97c9-4e9a1bd5e30f", "value": "apache2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa174d3c-170e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772548851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548851, "uuid": "e6026c0a-9f3c-41ed-8f5d-5badbabbe225", "comment": "Malware payload", "value": "e48bbfed8aaefc1bc344caaec7fc8cf2", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548851, "uuid": "707c7088-a629-49b3-ac2a-63706deedcad", "comment": "Malware payload", "value": "e074aeb0a9824b9b497a591582417a9a0bd2eeef34c6efe4933b00adc0448ee0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548851, "uuid": "730ee9bd-b82b-4701-9a74-ace3ba50f1d3", "comment": "Malware payload", "value": "a9ecbcda4adcba9a7aa407ce1b8662f5e8432a2a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548851, "uuid": "789e6fa1-7f05-446c-b420-d13831ecc113", "comment": "Malware payload", "value": "a21181070542b48bfe4ef76f79bd1da8282c5a29ad526ec8a8d4b7e5470194173327480c4b3378f728c13deae71bea96", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548851, "uuid": "2214000c-0f27-44c3-9586-9745aa3dcab0", "value": "T1673390DDF453C35645CAB485040E74F1A9DE93E79CE23883BAEB97C8C5D49068B20EB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548851, "uuid": "da8f6063-65ac-4760-a22e-db29d2c700c2", "value": "192:D00000000000000000000000000000000000000000000000000000000000000L:1AaY6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548851, "uuid": "9669c432-7903-4408-a566-cbc9145349ed", "value": 54219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548851, "uuid": "eb7f7923-d5ea-4006-88b5-0a3f83ed4667", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548851, "uuid": "bf7cc746-8b29-44a8-be12-cf19a5fe1210", "value": "02032026_0903_PL10-03-2026L.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16c3ba8-1716-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772552246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552246, "uuid": "9889156d-8949-4e0f-9be6-8fc2b37fecce", "comment": "Malware payload (SalatStealer)", "value": "cfcd64360a0b0c3185f9a48b1dbe1bdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552246, "uuid": "fe7ae6c9-1733-4ae6-aefb-c5301cd6f09c", "comment": "Malware payload (SalatStealer)", "value": "e0c90f401ae5d23a551f2d75a826cec7f187a6b7f0da2d24565c880e027ae9a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552246, "uuid": "f05410fd-59d5-4208-9578-d12d0806988a", "comment": "Malware payload (SalatStealer)", "value": "88733f68ee56c177c6bb362d5e04621e07a3b382", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772552246, "uuid": "bf09a25f-b78c-40f0-b5bf-3b551d764dbc", "comment": "Malware payload (SalatStealer)", "value": "635076994316b35e099c20ae0eb86894d71ba7301b8c38bf9cce4f91822c6e505bd0fb013ff3ca0e829cda7095a07ddc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552246, "uuid": "ed85c859-846d-4f53-859a-733936aa3712", "value": "T18AC65B51FA8B54F5E9031831416BB23F23315E048B68DBEBFB547F6AFC7B681192A205", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552246, "uuid": "8ece463d-a3d7-48e6-bad5-07d43e5fe444", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552246, "uuid": "4676981c-4d8a-4488-9023-53266dbaf55e", "value": "49152:BtxktkFkPWLDl01NLE1UcQpYjS6x167Du0jKKDDcv0YJNo+CeOr0HPQoqJdW9wPw:DCtkFllZflv0R+C3eqvinpmVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772552246, "uuid": "06b60991-5d19-44ba-8aef-4a6a7b0192bc", "value": 11670528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772552246, "uuid": "accf8854-580c-4550-9df1-a3bf1e95ab77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772552246, "uuid": "03ba7029-6952-4e8e-a3ec-d7900733c06e", "value": "SecuriteInfo.com.Trojan.PWS.Salat.332.17424.12534", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb24527-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772548856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548856, "uuid": "449e664c-00e2-4ffc-8ed7-34de172cd311", "comment": "Malware payload (Formbook)", "value": "3b6b415d21deca9968d791146a4dbe21", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548856, "uuid": "14969e2d-e5ad-4ddd-a82a-727f1e8581e0", "comment": "Malware payload (Formbook)", "value": "e26391c784afa1e9f53f35c309ec06fdaa6df850b23eebe2028bd3e642ec9d24", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548856, "uuid": "d812e07c-fcb1-4a95-a182-917bcc6bd81e", "comment": "Malware payload (Formbook)", "value": "17fdc28c9903a03584e23db97a8d234e5fd7bdda", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548856, "uuid": "94d19f9e-da8a-4c4e-b0c2-fb287db6f1d1", "comment": "Malware payload (Formbook)", "value": "21c3c875c6c299c9c91b6f5a09d7688c1297905f664b47274e6adf1bb68015855693d29541e800a739f15a231fbe04db", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548856, "uuid": "950cdf1f-8fb9-4163-a61e-9a039b4f3bb7", "value": "T11B4127141BE51314E6F39B79B8BAA31189767855EE32CF8D0250618C24A1620F1B6F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548856, "uuid": "1379b22c-7930-48b0-87b5-1e11472f6fc3", "value": "24:8Q/BHYVKVWP+/CWesqVEV5yAoq3UMkWXUfpjAUfR+/E4I0arab/WlY:805aZsmEV5yAoq3HvjyAIZabi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548856, "uuid": "ae3f3e6b-674f-424a-98ca-8e60487baf23", "value": 2332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548856, "uuid": "68f5ade2-0895-4f82-82c7-0a4e4c603fb7", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548856, "uuid": "723c84e8-af7e-43be-9eca-7e005377a88b", "value": "3b6b415d21deca9968d791146a4dbe21.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082fea1f-170f-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1772548875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548875, "uuid": "3dbb9620-6e85-4234-88e2-1b15d72e54ef", "comment": "Malware payload (AgentTesla)", "value": "a2eb6d490623df97a002a58b8345302f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548875, "uuid": "b8bc2c00-d4f1-4e51-a92a-1a364b543bea", "comment": "Malware payload (AgentTesla)", "value": "e2de42cc7f2421759d61eae257ddd6c56566a15006dbbc569687abe41aa53c61", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548875, "uuid": "fbb9ebba-f3a5-4c17-a36e-dc72d069d5ac", "comment": "Malware payload (AgentTesla)", "value": "fc8f4ba02a810e97a38751e0ba8f16f930ef5e69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548875, "uuid": "06d866e8-e248-46f1-b1fe-d7a56afde8ec", "comment": "Malware payload (AgentTesla)", "value": "a3a5730881871f179e8fad7204acf6b6de79ba8cc446c68f8786028b589827cc9095e0a0b057e1d04c20c788432c4018", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548875, "uuid": "f6205d4b-e2bc-4a74-a768-6131fd56969d", "value": "T1AAD4F1917B40E24BC5A00C74A54B5B1186A6FCA3C5E10D67837D3E2F8B3A70B685FB79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548875, "uuid": "54055a62-c524-4026-8f5d-0954a7c9e191", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548875, "uuid": "200dec34-eea3-4287-89fb-ce6f027f13f9", "value": "12288:GEMxwehm1hBgyfgbD2zxPnVxPKlMMammSgqRs5quHa:GEMxJY1sIgnGxPnKl4m5sxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548875, "uuid": "ec15de06-7c40-4624-8474-fb6f83780eb3", "value": 656520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548875, "uuid": "95aca090-92a7-4b07-aaf7-01270772008b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548875, "uuid": "af29ccb5-6d32-4c13-a027-37016cb0bfbf", "value": "DHLTELEXGUIA1Z4815906897663406Confirmacindeenvo1Z4815906897663406355.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c10f44e0-170c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772547897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547897, "uuid": "54925351-bac4-4b09-bc21-77d383913e66", "comment": "Malware payload", "value": "660f1afd4cefccbd9f8b9632509bc7ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547897, "uuid": "2126e6d6-27c5-4235-9b3c-c0ba862cbc83", "comment": "Malware payload", "value": "e342c983f2a58e9e3a7659476878cd46d4c4af9f1c0a30f09212b1a37e11adf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547897, "uuid": "4078871f-dec5-4559-ae35-6af9d4792d39", "comment": "Malware payload", "value": "18c2343f5cf00c011052560dd2a5740f5ac1d1c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547897, "uuid": "8c67887f-82ad-4916-abc8-04e1687e3217", "comment": "Malware payload", "value": "29b25d0deaef903e2fc2dd56e885ccf1d25f10a9841274d9f025e62cf3e08029ab2937929c6e8c98077e81ce639f32c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547897, "uuid": "5baf8291-1d1d-4c4e-8c46-8f5dbe06ed3f", "value": "T19546AF13F2028573E52E1AB015B6573E5E788FA20E28C993D7D0FDF6AE73261876610D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547897, "uuid": "b54d245b-7a51-4134-b007-328732653fd7", "value": "f9ab754bc9fa6a8282105e098246a54c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547897, "uuid": "fb8c2892-603c-447a-987c-75cb600631fb", "value": "98304:e1/hneF1a1dO6Ye7ae3XHUqpD/SJBAUZLA:GeFI186TjgJVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772547897, "uuid": "9f73fdcc-d335-4c44-868c-30b54b76f8c3", "value": 5373952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772547897, "uuid": "e69d81a6-530c-4ce9-9a61-a6ddd35b405f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547897, "uuid": "f7b84280-ea3e-4f68-b46c-4d391747291e", "value": "\u00c4\u00a7\u00be\u00a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f50f995-1708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772546041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546041, "uuid": "a40428d5-90bc-4ae4-a9ee-051a720f8334", "comment": "Malware payload (Mirai)", "value": "82e7a3cdaf2d20c75a8c3f9051c95444", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546041, "uuid": "f321ab05-924c-41c8-b3d4-78d1934a7921", "comment": "Malware payload (Mirai)", "value": "e3650610cf482af4b833da6cd86a1c72953f95410082c0a0607c446b14330e88", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546041, "uuid": "1f149081-4319-420d-9171-a836978369fb", "comment": "Malware payload (Mirai)", "value": "d9b52fef54ceb96484c94c9b0652503efe4a4107", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546041, "uuid": "2750dc65-b7c2-4694-bcaa-8d9e7ca94519", "comment": "Malware payload (Mirai)", "value": "dfd8e48536752864ebfd4cff03e5d858f412325509fe6669d79b2e0fc7a7a16454231552948f09172e0ddd8efc3752b6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546041, "uuid": "43c9f65c-4da5-4955-8bf0-4709320db90a", "value": "T1D3D31A41F9504F23C6D622BBFB5E428D372917A8D2EF72039D256F64378696B0E37602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546041, "uuid": "fb34d4ec-8ad5-4c5c-9057-728acbd6c19e", "value": "1536:hFN2l4G58dxS6Ha0El2wgAcW0AEGL4V5ilT6IJEJ4XVbOl1qTo9IYfJ+ILl8+wyQ:hFN2PshEutW0C46lZJEJ0yHaYh+9oG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546041, "uuid": "f12572f8-ad17-49d2-ad1b-d1b6a5b59e15", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546041, "uuid": "cb4f0683-2279-4077-91de-69245651af19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546041, "uuid": "22a5ca85-7f90-4418-a99e-be472e799ad2", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02fc1982-16cd-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772520519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520519, "uuid": "370a13e5-f419-4327-9289-4a692d91984e", "comment": "Malware payload", "value": "9d2f21ca9a549b369a2839bb1b1f5099", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520519, "uuid": "3da5d30f-9f03-45db-8d15-63b13fa9a5db", "comment": "Malware payload", "value": "e49d9c41941f135ab50be0f4704cecd7a6010db93c31a741d097ba891d38ff33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520519, "uuid": "713e6e55-3087-41b5-8404-15a1afbf17a4", "comment": "Malware payload", "value": "d61e472540ef0297b72c326082455e0bc23369c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520519, "uuid": "b1cda841-735e-4129-b829-394c822f3193", "comment": "Malware payload", "value": "4389be91af4f1214ed30060018a9af26c31c87837a6a41a4a24e0d6b340e537b0f9a19696bdf01d0a7bc0e8b017aa0a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520519, "uuid": "cfddb536-7135-4c48-9182-a886ab1fa521", "value": "T1AB24940AAF510EBBD86FDD3706E90A4635CCA51722A83B763674D528F50A50F4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520519, "uuid": "746fc7a8-b391-4211-b578-1c9140030eff", "value": "3072:A5JZ/kiJCQLxd9ihqcmdsJxiHYlNH4kYVqAGviviu:A5JZ5CCzih7viHsfoqAGviv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520519, "uuid": "b81ba7d0-4a55-4189-87aa-614a4730d959", "value": 224636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520519, "uuid": "02a34952-97a3-4f71-a0e5-4d05fcd9a3c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520519, "uuid": "ad7c52f7-603c-42eb-a3fa-3bc14285cb1d", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72cc5107-1758-11f1-a769-42010a9c0008", "comment": "Malware payload (DiscordRAT)", "timestamp": 1772580407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580407, "uuid": "6d1f009d-6680-4057-a33b-fe11e8b34017", "comment": "Malware payload (DiscordRAT)", "value": "b08907b7964339a8423f85c0e56ee977", "object_relation": "md5", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580407, "uuid": "dc8dfa3b-b0bf-4149-b120-1c044e95b8fc", "comment": "Malware payload (DiscordRAT)", "value": "e4d4f00d0e703263f30ac42c4f8c71b042727ba9892d63789a4480ddccbda621", "object_relation": "sha256", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580407, "uuid": "49b8f8b4-db2b-4138-9014-304a71ba675a", "comment": "Malware payload (DiscordRAT)", "value": "3225d01fa6bc93953fd656a713984aaa0d02aefe", "object_relation": "sha1", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580407, "uuid": "40e32f06-2ced-4f05-a0a4-09cb90ec2c93", "comment": "Malware payload (DiscordRAT)", "value": "c3a482a4c973ba92a489480397e731efb4dc801d0f857ab98b320852b2029d1a4bca687360e30715f781232014cd322d", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordRAT", "colour": "#9126ED", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580407, "uuid": "7ab15e09-9be8-49bc-931c-ebfffab1e4eb", "value": "T11773B8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611B2B828C42B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580407, "uuid": "bbd3c47b-f8ec-4c85-b3b3-6d777724ea51", "value": "1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+cPIC:5Zv5PDwbjNrmAE+QIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772580407, "uuid": "c2c60e4d-7799-4293-80f7-dd1697ac1bde", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772580407, "uuid": "f05ae076-5443-4054-a9e5-be3b96b0c712", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580407, "uuid": "aee5d132-0122-44f7-bc8c-cfa4364c7e0c", "value": "C2Grab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b74117c3-170c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772547880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547880, "uuid": "c082f707-bf6e-4905-b992-257f099842af", "comment": "Malware payload", "value": "f3dc1e16cde2995f701c8db509f351c9", "object_relation": "md5", "Tag": [ { "name": "DEAFTICK", "colour": "#91C2CB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UAC-0252", "colour": "#63B372", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547880, "uuid": "53583410-4d97-465f-bb5d-dd76e2c47817", "comment": "Malware payload", "value": "e5941df780ae251bcafad3b833f45ee44bd1599ab45b7adf1f1c79510930642d", "object_relation": "sha256", "Tag": [ { "name": "DEAFTICK", "colour": "#91C2CB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UAC-0252", "colour": "#63B372", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547880, "uuid": "e374d507-fd75-49af-a0b9-1253774f3cbb", "comment": "Malware payload", "value": "6f58278d42a752eb13d24f7b5e61b959e59f229c", "object_relation": "sha1", "Tag": [ { "name": "DEAFTICK", "colour": "#91C2CB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UAC-0252", "colour": "#63B372", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547880, "uuid": "70d8ad17-c2a4-4844-894e-f9956971d755", "comment": "Malware payload", "value": "67f55342bb475e830d2a2d51a383656b8be9e9a86c82db14d229cb1ec59df8fc4f006db1f716bc029faa752dd27d4bd6", "object_relation": "sha3-384", "Tag": [ { "name": "DEAFTICK", "colour": "#91C2CB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UAC-0252", "colour": "#63B372", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547880, "uuid": "88eeb23c-d063-42fb-8ecd-d299db7a7f02", "value": "T197F63B87ECE21AD4C8EA8570D17A811BBAA27C091B7C23EB56A0F7201F377D05E76751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547880, "uuid": "52beaaac-01c1-407e-847e-0d86bf190941", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547880, "uuid": "8ad104ef-76fb-47ba-a04e-bde749c480ba", "value": "393216:xnraZ9772AS7pts4iMDabOcK2GghtweFVozRGjJOMz8Dz3+feVwecKQU7y9jIYhZ:xnOZ9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772547880, "uuid": "d4a4cfb1-8beb-42fd-9736-ff2f5160cdb7", "value": 16668672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772547880, "uuid": "f7ab81be-d8d6-47fd-b042-c459634ae42c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547880, "uuid": "37f83755-1845-40e6-a9fe-02fde47e11b4", "value": "EdgeUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc7a751-1741-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772570411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570411, "uuid": "8f09a8da-abc7-40fc-a4c5-0154eaf4479b", "comment": "Malware payload", "value": "98b93a8aabd2a2803d214e963874da39", "object_relation": "md5", "Tag": [ { "name": "Air-Gapped", "colour": "#528C43", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570411, "uuid": "9dd4e1da-f8d7-4462-ab00-2159f97dd9e2", "comment": "Malware payload", "value": "e5f334add3d5e4bc95293acfbb1afb2103074e4d453aff7172de6ea386543063", "object_relation": "sha256", "Tag": [ { "name": "Air-Gapped", "colour": "#528C43", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570411, "uuid": "8cecdefd-c250-4233-bccb-4a4b096e1056", "comment": "Malware payload", "value": "79fe1012d96d5421654df183b587a380dc77d831", "object_relation": "sha1", "Tag": [ { "name": "Air-Gapped", "colour": "#528C43", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570411, "uuid": "ca3d9a56-1693-45ab-806c-4beacb07e3d5", "comment": "Malware payload", "value": "dbb4ce63855f9e07003bc1806e59b23b76bd5e4ee777a6cee7927cf50fec10b5797c3430427e6d9aca20f77257f1d4ff", "object_relation": "sha3-384", "Tag": [ { "name": "Air-Gapped", "colour": "#528C43", "exportable": true, "hide_tag": false }, { "name": "APT37", "colour": "#C3214C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570411, "uuid": "6103ec4d-e99f-455f-a1a5-370785f4ba15", "value": "T122863391E3D60EFC935A065870CACA8988374E6D7819DCACEB36F1074A37D1E8895DDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570411, "uuid": "0806e184-b777-4918-922b-6da8eb53a5e4", "value": "98304:xZWKE3hhdbDOG2gzR6/08YBXs1Wr4j1/k+YcrA9qgdUbE4oymLnt3ymzmriHefQ1:yFZ2gzRrco4j1l7rjY0mzmrsZYvyDFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772570411, "uuid": "ec3ef32a-74a0-4557-81ba-cdba42cd3dfd", "value": 8194678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772570411, "uuid": "d4af4c71-6d46-4c57-be74-cdd717e5de45", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570411, "uuid": "e8e50593-0f19-4ee5-ae51-724e8d5bb229", "value": "e654df84fd6dc02ca1b312ff856ef2ca88b42a72bab31ea3168965cb946cf16e.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30920172-1742-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772570847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570847, "uuid": "0313571d-ade6-4815-ac11-20f9b2991455", "comment": "Malware payload (Mirai)", "value": "714ee1ed42d02fe61a162638c94ca32b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570847, "uuid": "056af04f-68f4-4621-a6c7-1f800cf18fc3", "comment": "Malware payload (Mirai)", "value": "e64892a885a8c64ad08027625dbf6213710e0648ef8ec09f6be17820483569d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570847, "uuid": "0625d969-5c59-4167-a2aa-9d5732526b85", "comment": "Malware payload (Mirai)", "value": "2cf2f0a87c1b30fadbcf318a288d6772cfa49d4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772570847, "uuid": "2fb13bfd-bdb8-411a-9fba-644b3d8c6f38", "comment": "Malware payload (Mirai)", "value": "54342158b6b417c328ae2712b6dc6c6bf7b8fdd2e1ba77dc70f0f504fbd45239fe6b8ecb2fb62c684439fc9e3a5a5264", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570847, "uuid": "47a5f005-1adf-41f9-bc5e-ec97a36bd01f", "value": "T10B93D506BB650FFBD86FCD3746A9071239CC550A22E93B3A3674C91CB51B64B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570847, "uuid": "fd6b13b9-00e6-418d-833c-eb0329a3fb67", "value": "1536:lX1tMe0R/thiC3ZE6UgaLiVw0FmWnM9kyXZLHLQq7V861yMRVz8Z:lltMe0R//lEZ5Wn2XvJVVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772570847, "uuid": "78701745-2058-4bd3-aec5-b730f1133125", "value": 93464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772570847, "uuid": "8959c823-8d34-4a9b-ad57-ee5735ea5bd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772570847, "uuid": "57b6b7c1-724a-4136-a35a-cb3504df5593", "value": "pmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ffbb60f-16de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772527977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772527977, "uuid": "07735fb9-577f-41c4-b15e-379a48c4a3bc", "comment": "Malware payload", "value": "cba5f2be81fe009b50b27faf18663084", "object_relation": "md5", "Tag": [ { "name": "77-90-185-24", "colour": "#B47C2B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772527977, "uuid": "662e72c7-a65c-4a6c-9c6c-59904e27464f", "comment": "Malware payload", "value": "e6a805c15be2b43d974707e2bf702e7d44a4e2328a2bea2e92ca4bc8eb77d296", "object_relation": "sha256", "Tag": [ { "name": "77-90-185-24", "colour": "#B47C2B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772527977, "uuid": "7d6252e2-eeac-4900-a89f-61821c77138b", "comment": "Malware payload", "value": "54a9d662456fb8559bca6549e007de52e516ee17", "object_relation": "sha1", "Tag": [ { "name": "77-90-185-24", "colour": "#B47C2B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772527977, "uuid": "2663dbf9-c947-4da4-9a46-a5ddd0cf1236", "comment": "Malware payload", "value": "248adbf49aa6f5f6e4da2c8cf9a336af9e5fef65dcd276f44d200b789c31e7b26f1586535ec28fafd36404a17a121e6a", "object_relation": "sha3-384", "Tag": [ { "name": "77-90-185-24", "colour": "#B47C2B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772527977, "uuid": "a7565df8-8aab-4bcd-9adf-269de617c002", "value": "T19962D0A6EB0205CEC17342B22CABED0BA2BF5039457441817E90A60F78C6539EC1CB79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772527977, "uuid": "44bb30d6-7633-4732-b7c3-95ae2a56811e", "value": "384:lbXVI4aamq0tHhdj11j83tLuP1WMrMKceqZ8ogYSK:lbXW4aRhdj1StStLryeqGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772527977, "uuid": "a1dc42e2-8db9-4559-ac0e-a34e5248ff99", "value": 15764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772527977, "uuid": "b33f08be-bd42-4db3-b8d5-95854b4db6ea", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772527977, "uuid": "4649ef4e-ac80-4a54-921c-9041440893b6", "value": "b9b9177ef5fe2b117ec0b4bd3ace1cb63ac536246a0cac82c31de18194a79f79.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ebf66c5-1708-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772546067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546067, "uuid": "ec45e538-a3cc-4acf-adb6-6d827f007184", "comment": "Malware payload", "value": "617ab23382216cd7e5e153e247bcedac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546067, "uuid": "0f602ce9-f279-4949-b83e-b3fbc13bfcd6", "comment": "Malware payload", "value": "e6b3700eb928f0d7793cd410ef7ff61c2eede6ffb9b3b4c775b2e9baacbe6a82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546067, "uuid": "8ac1188e-47e4-4c78-b667-e9481f11c6c0", "comment": "Malware payload", "value": "a450d8b3ed2cc4dfda6e87b3b54389fcb91f6159", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546067, "uuid": "5b326082-7dc9-4260-993b-77276e5f24d5", "comment": "Malware payload", "value": "073aceea760aa61b14bd71dfadef01e43e13ac2337dec29b7072b1493a8fcca542ea9ccd8dd377920a5c86dbf3f17337", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546067, "uuid": "154bb3d0-325e-4ac6-b8e9-0981c7352304", "value": "T1AC735C02B30C0A47E5531DF42A3F53E1C3AA6AE121E8F684754EEF49D6B2E325156ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546067, "uuid": "8f2a4add-b3ac-4d7b-a8e8-1ef8a5add474", "value": "1536:b1ib4ZFlN1ufluNsgE3S8y8hqFJggb8Z5p477jlDburP9Md+EO:+4+313U8hqPgQ77lurlMDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546067, "uuid": "ea0347a2-a653-4b3a-9bb6-a4c32c61f33d", "value": 79608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546067, "uuid": "1ba32fdd-0efe-4a57-b62e-f280960a0d0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546067, "uuid": "60c8bd2b-6cf7-4564-bd4d-6d1fd7edee8f", "value": "titanjr.ppc440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab37df62-1758-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772580502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580502, "uuid": "44fbd9f7-d5e2-403a-91ee-e12eabdd1d52", "comment": "Malware payload (SalatStealer)", "value": "3b9c96b6f64b6dc1a77c61b742cde22f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580502, "uuid": "d1ec1233-ca12-408f-a092-ede56e791472", "comment": "Malware payload (SalatStealer)", "value": "e7042a679865c3496d1acb6998e918ceef2b0ea27a1aea6d02ee74a4b0297c1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580502, "uuid": "ad781cd2-238e-4829-ad53-a118f0ed66be", "comment": "Malware payload (SalatStealer)", "value": "4f2ce09597af9e42211a9584420e338c41670e48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772580502, "uuid": "cbf2dbc2-cbaa-4353-9a33-e2b2856b57ed", "comment": "Malware payload (SalatStealer)", "value": "e6aad981d3e5247829aa816b905455b6f9db7486c59d42152eb9b1f0c7e3399af1051753217a954c2a39ac8a0adc6f5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580502, "uuid": "428f46e5-7e69-4808-93db-98cdf9cd8dd0", "value": "T1D5C64B51FE8B64F5EB031832419BA23B77325D048B38DB97EB147E3AFC776911966208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580502, "uuid": "82fbabf4-90bd-4256-b5a6-a25014d43125", "value": "49152:onNQbaLqf8XpVi5Rmow3C0Jgm79479qaNCCE9vKOTNwM6Ssz5mGibMo2PfQVwqE/:yybaLbVtT7dKtM6xF82XQNdIp8V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772580502, "uuid": "8e72b73d-6ae9-4fbb-aefe-4113069616bf", "value": 12107776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772580502, "uuid": "379586cc-0d32-4f14-9c92-2fa486ce577c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772580502, "uuid": "fda2a04a-c88a-4fb9-b084-422fa5f74be9", "value": "uprkc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e10ab8-1709-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772546296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546296, "uuid": "e9784ce4-cdc9-4bba-916c-036dcc3ce65c", "comment": "Malware payload (Mirai)", "value": "551ed98725caf3d07328306df66db302", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546296, "uuid": "676a9242-8eca-4d08-b1cf-0ed94b0dd2c4", "comment": "Malware payload (Mirai)", "value": "e71afa21cc4ec30b1e80e4a86b4af30b93812093c93e32f8ab458691b05168a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546296, "uuid": "e3854e5d-8af7-4739-b6a2-7f38c6a85595", "comment": "Malware payload (Mirai)", "value": "ff59e435d197e18af39e9671fbf6ec1705b8ab35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546296, "uuid": "973ae887-baae-4b56-bcfc-9ccd98db7d6f", "comment": "Malware payload (Mirai)", "value": "3ad0a56caa017aa9e09f58c51a06fb111d8ebb51c1dbb0d445ce5db90e05e6f6f28e632ab98c711a549cafffbb2f3bfb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546296, "uuid": "f50f6b94-8df8-499f-8dca-06bbb6b8f545", "value": "T141332B85BCA29A6AC6C0477A762E968B335767B5C2CF7353D8481B10368BB0F4E73D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546296, "uuid": "af6491c9-2afa-4e99-a4a1-4655de81f134", "value": "768:gN9Q7eU0k4T3t5HN/1RIGxy2Iq/Jr+MKKrjZZ4ulzMGzFTnWz:CAeU0k0d5Hfjxy25xr+MVrjZJx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546296, "uuid": "47345195-9803-408e-869b-69e5a629103e", "value": 51048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546296, "uuid": "eb1c9cc1-5582-4ecd-860b-d5d8075fb668", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546296, "uuid": "8f213847-cd2f-4616-8310-e8912b8b0fce", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c763a1d-170a-11f1-a769-42010a9c0008", "comment": "Malware payload (SalatStealer)", "timestamp": 1772546869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546869, "uuid": "14a30089-adf8-4ba5-98db-7ae54a1a04b7", "comment": "Malware payload (SalatStealer)", "value": "a0a6b880c3715a966c2fdbb51421cc9d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546869, "uuid": "bcd41a08-7b34-46aa-91db-f64568606b60", "comment": "Malware payload (SalatStealer)", "value": "e7a0b1b4039d9d28d2356e642ff7d9860fdc6c8474485280fc44d0e844bdda39", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546869, "uuid": "3b275242-232c-400a-86f3-aa4593011587", "comment": "Malware payload (SalatStealer)", "value": "db04dd81bcfe853378c48161112e6dd89446e772", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546869, "uuid": "a27b0c15-927a-4d25-9695-ea6d77f219ce", "comment": "Malware payload (SalatStealer)", "value": "02542ff074b09a2b888bcbac006076e9265277ad69d085002b005037b2815cf2444217ec901c40455fe443ed3f0a1523", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546869, "uuid": "f41a04fc-c692-4a84-b086-e1c6169d48b3", "value": "T18286C007F20272D16C2600BC9D6912D747BF80A93371869087BD059B98596DAF3FFBB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546869, "uuid": "d7d2b72c-1819-4807-81f7-b49267831360", "value": "33c9df7406bf531bc137e89341b173b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546869, "uuid": "935dcbb5-c169-49d3-a5ed-22cb4ff07fef", "value": "49152:YSOZ++G1lHAiKq2IhWouTkwD3HY/8kJfHsyJZLi5ajlelcP7yedZEpi2NvM79aH0:GXTTkCdkMMbFBZbeHycVO1vTT9tPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546869, "uuid": "638b2476-b15f-4daf-a3b2-321efeb75e32", "value": 8535040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546869, "uuid": "03401e47-e559-403e-b9ac-2bc2d25ac2b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546869, "uuid": "27e0744a-a8ea-47a2-8183-570c7898a1a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b71b174-1747-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772572986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572986, "uuid": "2b7f3543-e7a1-4f55-a0e2-ec03014b52cc", "comment": "Malware payload", "value": "53d7b38b18dd39ccebe6b8e31df90d5a", "object_relation": "md5", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572986, "uuid": "1c39cc78-9781-4e8c-aa13-87055759c252", "comment": "Malware payload", "value": "e81b395de5df25405fb3636e96407927217579135e5090a55fa8ee8249fe101a", "object_relation": "sha256", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572986, "uuid": "c59ee2b2-3224-4f3f-80a5-c0d4e9b55561", "comment": "Malware payload", "value": "9bc35c4a2ec7c7d7c52519099673cdb922e339d1", "object_relation": "sha1", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572986, "uuid": "ab1c00b3-0a3c-46ec-bdf4-f06d6cc63e1e", "comment": "Malware payload", "value": "6b65ccd9265cd06c11937eac33d58618c1702ae246405936c9e8674fc2b7b65342a897e4f9d2a1d1e99a27b5239be41b", "object_relation": "sha3-384", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772572986, "uuid": "93c7181e-f23b-4c1b-af7a-ee75967cf8de", "value": "T13FB01242DA8AC2E7D805301D8154C564B8C394CEC013D5FDB742C71F21C28D2428E1AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772572986, "uuid": "c43ee403-a886-4c9f-b0ab-ca3b617b445c", "value": "3:HRAbABGQYm+KXOCRIPGETJL18PKgGTpfLi:HRYFVmM7+IJL2ygGNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772572986, "uuid": "f116031f-e15c-4261-91b2-3838c7943281", "value": 102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772572986, "uuid": "cab23125-4293-48a3-8f41-875fddfb7a7d", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772572986, "uuid": "e4cdeb11-1720-4f9b-86a1-2ec7fb4e6421", "value": "Fac_2026_2746216801.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ef2e449-16a3-11f1-a769-42010a9c0008", "comment": "Malware payload (Vidar)", "timestamp": 1772502662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772502662, "uuid": "1d54100d-bb07-4093-971c-b4d670a45cc1", "comment": "Malware payload (Vidar)", "value": "5b020055fb7c2ac398768cfba07a5b9b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772502662, "uuid": "8f586caf-b377-45b3-a6d9-5f74567ff476", "comment": "Malware payload (Vidar)", "value": "e8ff2c7daf775a23680e2caba0dccb8d71a280c54dfaeae9b3d2a1318dc1bf92", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772502662, "uuid": "652a9345-0e55-40ac-8e20-d7aa803c4dff", "comment": "Malware payload (Vidar)", "value": "f373297038e035a953187a127126f351b831b7f5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772502662, "uuid": "dbed2eca-6818-4375-94a7-60cd19eb10b4", "comment": "Malware payload (Vidar)", "value": "acfdddbe373457b937187a74f1d3836e878b203dbcc34ff90d8e52e6221fe3a977a111b3edcb09f62d4252d358c11b63", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772502662, "uuid": "4ac74a74-b2eb-4c38-988f-fc377029a771", "value": "T16F86A36B32D48DABC11F953AD4F28A4CA4FFE1751B23C9D7819103E54A466FE4E3A360", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772502662, "uuid": "d460297b-a86b-49f3-85c3-42d04f222842", "value": "98d407ce7cb1a3b4203bb905c8b5b3cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772502662, "uuid": "ca0b8e3d-a2e6-4706-9b03-b01a8ebc930a", "value": "49152:eBWw3ljiKrjRxjeJXQaaD1QSy5G95iVOtD+SbZPurqwsjfLaRm/wjpkkJmxMj1Dc:erMepm1vdooRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772502662, "uuid": "50c1abc9-2b24-4c2c-ad1a-6d06c053e119", "value": 8515072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772502662, "uuid": "fcb9ce07-4f5e-4b13-9905-96e579175f01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772502662, "uuid": "f06b2c58-a335-4248-9caf-681562ca748a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9409a1e5-171e-11f1-a769-42010a9c0008", "comment": "Malware payload (SantaStealer)", "timestamp": 1772555552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772555552, "uuid": "f68576dc-6ab7-420f-87d5-5e1c311cb41c", "comment": "Malware payload (SantaStealer)", "value": "b6c005d28c70b569906a34e1a387086b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772555552, "uuid": "802eddf5-fde3-49f0-8592-b9d41564f1be", "comment": "Malware payload (SantaStealer)", "value": "e93afe14f4200654c5949dddc6334396d0453991cb340b93d3cf4c9bc8ab17b3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772555552, "uuid": "4757f061-0f9a-42ff-8d66-73c26ed58254", "comment": "Malware payload (SantaStealer)", "value": "66cc98b73773db9dc1c6f2d8c0db86132a65f637", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772555552, "uuid": "15e8afdd-d182-433a-9870-b68d1fd25156", "comment": "Malware payload (SantaStealer)", "value": "c30b95a3c5742dffc9f542505e73e459df52dff75b880350fabcc89b7e00a23b30a726f217e4388d1f80e4d93f8bd97d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SantaStealer", "colour": "#3BCEDC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772555552, "uuid": "0486e163-8db6-4f9e-9933-92f71d4ca521", "value": "T14FF6381010D96607FC3EEFBD85DCB6444F7AB2997722EA389B410DE90FD1B18C9429A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772555552, "uuid": "ef57e26a-6cf2-4cb9-9934-7c237a78d9bc", "value": "196608:60c1TUWkoPvDAQQjpS2umHl8tMh78hFfDKig78sEGeiWV4wD9CSSg7hHyyWX7BW2:6xUBoHDXupj8tMh0ZEAzlZDQ4hrZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772555552, "uuid": "fe27ac79-7156-437d-b2a0-1396469073e4", "value": 15973888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772555552, "uuid": "037c3047-7924-423a-8050-80e85c4cb439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772555552, "uuid": "70cbdaf5-09a9-4065-b59f-31ecda697b2d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838ebfc2-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772548652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548652, "uuid": "6e0ac43b-fb5f-470d-939e-3d68a69a9d55", "comment": "Malware payload (Formbook)", "value": "4465ea812c00ec68f37c360241d5fad0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548652, "uuid": "b4933c73-0428-4fbf-8a1f-052226ffc009", "comment": "Malware payload (Formbook)", "value": "ea7606942b197383e1320c6367cda0c15a1600c5e62106aa420901607e2b633a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548652, "uuid": "8a72da32-ab26-4d3c-83e4-bc293d299c75", "comment": "Malware payload (Formbook)", "value": "1c120c685cfa2c7ec8d4099d40f64e708c644742", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548652, "uuid": "f8af3536-3fe5-4b75-a7e5-07e014408b6e", "comment": "Malware payload (Formbook)", "value": "24d43d8f89a40626ebcc4972f3e6a10759cb66c71e418f6310d29a80d8647c048f0b4bba3a1c2160e771eadee8b74127", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548652, "uuid": "55e1e545-8420-4956-a2fa-26134a19559a", "value": "T18CD2629D3ACAF168033271372A5BB51AE0BF2C85744C9654C3A5BBD4FCAC718E0B6D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548652, "uuid": "32155994-996d-431a-99ba-409bef7923c6", "value": "384:3MQOipNnkcXnUVIn45QfG0VpfK0WTccMtWIhAisNvfSFbL3Ygo81w0NFoREu2jJ1:3fOi+06y4eeT681OxoEw0NrPJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548652, "uuid": "074a4f41-fb92-4783-8a01-9ce337280ce4", "value": 30948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548652, "uuid": "0a7ee727-2a2e-4557-8dfa-f73650cfc318", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548652, "uuid": "de1f4d88-228d-448a-bf25-5a8d6fede7e8", "value": "4465ea812c00ec68f37c360241d5fad0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab022e3-1738-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772566891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772566891, "uuid": "442b4915-f1e3-441f-a758-6e2a4c60a289", "comment": "Malware payload", "value": "7b08feebc159ef1034808dbd26a4933f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772566891, "uuid": "f2ffd893-249b-4102-baad-ba751cfe8a73", "comment": "Malware payload", "value": "eb7aa3c07a49cc75b502616b84ac93638e4504193d962d6a16303ffd9894d09c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772566891, "uuid": "ba7a42b8-1c5d-4620-a94d-4838562616e6", "comment": "Malware payload", "value": "9eeb3e6b380b7dfbf69ad4a3dad8d527a2b740c6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772566891, "uuid": "5f980804-43bb-4bb4-942e-59f07511a13a", "comment": "Malware payload", "value": "9c3deb0718fcce95fdbc82e647f83bf2e2e80eb9f52af7648738e8b65d6cf9dfb409a415c9a1076dc3d38ab78e442e30", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772566891, "uuid": "77bc0ada-9e28-448e-b55a-1a973d848474", "value": "T1E0924CB412896C79FBD1CE399F3C6F49ADE8C2C42124E3ADBA0F39205A1166DC70535E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772566891, "uuid": "c3493bc4-8fdf-4619-8a6a-c3565d96079f", "value": "384:AScuQpWx+BL0SWL0g9zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:AS8i+BL0SI0WzsP4cbddr7zsP4cbddrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772566891, "uuid": "d300c929-e92e-4c28-aa94-f416c420c04b", "value": 19499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772566891, "uuid": "74e43392-2789-48ec-9d5d-915093d62dc3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772566891, "uuid": "66914289-7b2d-4f82-af34-98ee30b96a36", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98fd3042-1728-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772559855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559855, "uuid": "654941c2-1b2f-4d93-9541-bb0f89c0f060", "comment": "Malware payload", "value": "ed497cd8404af76f577e372f361dac3d", "object_relation": "md5", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559855, "uuid": "ea3385d7-75ec-46a2-94fc-e3a17d9d1a32", "comment": "Malware payload", "value": "ebab054f276b189aaaf0b77bf641b8fea0f1deda7679e5947bcaf2d6837dcc0d", "object_relation": "sha256", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559855, "uuid": "3f372f57-c740-4391-b7fe-82388cce2532", "comment": "Malware payload", "value": "87fffec5d6cd04a74e8c968e349b24146cf1f659", "object_relation": "sha1", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772559855, "uuid": "71fcb2cc-03d1-4a4a-8161-38e18dad3305", "comment": "Malware payload", "value": "a06e06a0fa12b86f8b255b7507860affcc081b5ea65f01eab0f2b8509debd9431a6201f15ff2f26233efb37030cf1f0b", "object_relation": "sha3-384", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559855, "uuid": "f80a0d0b-a612-4f75-a036-7e476277ef44", "value": "T1E1E0F11178C8D0CC2501238A6249C209A4E340943F04F4B21B4DC3DCF55323103984FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559855, "uuid": "2482a1a9-b308-43ef-9786-c4d85aee1a89", "value": "12:qRHNkuqrw6s+2B7UxMbedO89ojALqWNHF8E4:qrkRjD2BgWkOpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772559855, "uuid": "2d55908b-f162-4766-a301-e8449f101f40", "value": 405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772559855, "uuid": "212a61f8-098d-40a6-b30e-02c0879fca1d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772559855, "uuid": "2bb55d79-5a36-44e2-a23d-4e5674c7882d", "value": "kgsltpy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5692093a-171a-11f1-a769-42010a9c0008", "comment": "Malware payload (AmateraStealer)", "timestamp": 1772553731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553731, "uuid": "0a0ebfd8-a66b-479a-ae26-2b6f7d8a14b9", "comment": "Malware payload (AmateraStealer)", "value": "6d8eba9352a36626333038de46cb7dd6", "object_relation": "md5", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553731, "uuid": "da54dd82-03b9-449e-a18c-950589ca3c47", "comment": "Malware payload (AmateraStealer)", "value": "ecf674e913f5fd7429886d419978470bb2f0d7832225dc51d98aa79c5f62c3d5", "object_relation": "sha256", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553731, "uuid": "16f45c2b-c0f9-4455-be9d-fd128ba67b7a", "comment": "Malware payload (AmateraStealer)", "value": "0afb28b061ccd1a452ef26a210a62298d5cc1346", "object_relation": "sha1", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772553731, "uuid": "369bfc45-90da-4661-bb80-87b57b234a9b", "comment": "Malware payload (AmateraStealer)", "value": "b7498e9ebece3ea08b655270fe74d2195d1482c7443f77ac805764f7ddc86ff2d32368c9cb35f205757a3a2fca2a8eec", "object_relation": "sha3-384", "Tag": [ { "name": "AmateraStealer", "colour": "#65B042", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Google", "colour": "#EA0F55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553731, "uuid": "de5b3e0d-80fc-4b69-9669-ade527083dad", "value": "T18085388252EB9AA1EF4E1B35C117535F6366EE82891CC5709371F9FBE0F21121C1A9CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553731, "uuid": "11a3e2fd-f196-4c2e-9357-abddbff1a31c", "value": "ae658aef5ecea3fb671c89aa0d362aac", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553731, "uuid": "cab3f38b-028b-4b12-9da5-962f6b27e70c", "value": "49152:y1PUY09mkAha00h8gknY09mkAha00h8gknY09mkAha00h8gkpbvsg9i4:yzbvsg9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772553731, "uuid": "6009268a-d49b-4734-a4b9-19f2099645c5", "value": 1720968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772553731, "uuid": "dfb43db3-b1d1-48bd-b8c0-fe1e078dd2db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772553731, "uuid": "40b4cbab-868d-4265-8be4-009359f121b7", "value": "verification.google", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845ec791-1708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772546077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546077, "uuid": "65bd1441-6fcd-433b-8ee9-42dba6288d98", "comment": "Malware payload (Mirai)", "value": "831e8a637d2ffa72baefa58ba7c2e54b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546077, "uuid": "7830135f-020e-4eff-ae5f-5588c7c06734", "comment": "Malware payload (Mirai)", "value": "eda08b4a54e85d2f4be08f61e04c7b1b5f162dbc22b2d27081d301006632d281", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546077, "uuid": "25c8fb8e-a211-425f-9c10-b104d7936bf2", "comment": "Malware payload (Mirai)", "value": "8d2f048e11bd607c31f0438ef97779e3a7012bd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546077, "uuid": "16298db2-0d67-4aa7-9c98-e87ed54f6a62", "comment": "Malware payload (Mirai)", "value": "f1564f60e9da1fa2308b40ce66e6142b87ad49526addf9e852b1d3d858379a309013f85ddb7d77569c487953425ec900", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546077, "uuid": "1e388c82-bf01-4476-b3f6-b9de69c7cbcc", "value": "T1C4E34BD7F800DDBEF80AE73748530909B630B7A215921B372257797BEC3A1981967F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546077, "uuid": "d3217b2c-9338-43df-90fb-5b7e0234a668", "value": "3072:KqRWWxXUM9Cyw6j0Z1DE5WY6tIL2yVxjbiqL2N7+oK0:KqnEywA0Z1DGWQL2mL3oK0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546077, "uuid": "df122c00-a8a4-4829-a06a-8140bca2ec75", "value": 152864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546077, "uuid": "557a5e29-b578-4dea-bc44-eef3976a9f56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546077, "uuid": "2996344e-79a7-405d-a8b9-431e4f321f6f", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc9432f-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (XWorm)", "timestamp": 1772548722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548722, "uuid": "b51fe3c9-bad0-49a5-8442-cd193a92b29a", "comment": "Malware payload (XWorm)", "value": "940e5612edf3a0abc97c18e99bb1bb8b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548722, "uuid": "ff56c016-f56b-423c-b744-6aa5fe6c19e6", "comment": "Malware payload (XWorm)", "value": "ee4f00eeda14b56d6372c3275807a0ab2e73e5f4855e2a8832527517947e1ef0", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548722, "uuid": "5a3ee439-1553-4449-a5f2-0569b742808a", "comment": "Malware payload (XWorm)", "value": "006fe2183e3967eb1b994cc4a07fdcd7060295e0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548722, "uuid": "8e79de7d-393b-48a4-b041-183e5f5144e6", "comment": "Malware payload (XWorm)", "value": "49b05905eb8b561856d7d435a763597dba327319442af4e5024f9f2ed61547d74d66e4b1a8c21a4ec30995b6f8570db0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548722, "uuid": "e92f3229-513d-4f4c-8bcb-a104dd0085f8", "value": "T19072932A8D0A9FF00A3E315175ABB81669200362F5392D4D3D4FC9AD3F76614CBE15EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548722, "uuid": "bc5320e6-0bf3-4c5a-925e-13f60759a0c9", "value": "384:Kma7KUJJQkHBDpNNkcFDhbVw9+N58hXh7VK+OlQ9qL:KmGhrBD/z/PC7Y+OlQ9qL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548722, "uuid": "99ca5d8f-2ea5-4507-9c6f-6f22afb550cc", "value": 17367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548722, "uuid": "b2aafb54-2bc4-488e-85ee-e2e50c208fb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548722, "uuid": "9cbc6b90-cb72-449c-82d0-455f4ce3eb55", "value": "940e5612edf3a0abc97c18e99bb1bb8b.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95cfb788-16e1-11f1-a769-42010a9c0008", "comment": "Malware payload (KarstoRAT)", "timestamp": 1772529356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529356, "uuid": "e7b1ad34-f50d-4eb0-bbcf-ff4b66afc3be", "comment": "Malware payload (KarstoRAT)", "value": "a857e04d4e07ad9671c4290c0a3b856c", "object_relation": "md5", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KarstoRAT", "colour": "#8F853E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529356, "uuid": "fbfbbd72-a77f-4f74-ae8d-92c68d579524", "comment": "Malware payload (KarstoRAT)", "value": "ee5b0c1f0015b9f59e34ef8017ead6e83259b32c4b0e07dc1f894b0d407094a3", "object_relation": "sha256", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KarstoRAT", "colour": "#8F853E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529356, "uuid": "44ca3bf3-afd9-4af3-96d7-729f61bfe08a", "comment": "Malware payload (KarstoRAT)", "value": "911c94edb0fbef89c1a120a3530560fb6b0114d1", "object_relation": "sha1", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KarstoRAT", "colour": "#8F853E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529356, "uuid": "e27bc58a-99e0-455a-b516-a6d3f4b615bd", "comment": "Malware payload (KarstoRAT)", "value": "a543ab8e50d7bb1cadb2275ac80f009708db0fd54b927790774766a2c1406c86cf8c8b75217e9c6c9b3fc9d383245667", "object_relation": "sha3-384", "Tag": [ { "name": "212-227-65-132", "colour": "#A672BF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KarstoRAT", "colour": "#8F853E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529356, "uuid": "704099e9-9292-4134-9f9e-e0b4bcd2653e", "value": "T1C1E35B2EBA051075D266D578CE870903FB737C5587A0ABDB17D19EB60F236D0BE3AA01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529356, "uuid": "003e2760-21d1-4a2b-b83d-4a9ffa565554", "value": "8f4a65bc2708f6149bf9a32b9e1d2416", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529356, "uuid": "e7d477b0-a6dc-4787-8c50-58bf627b3de5", "value": "3072:Iw+Kg2smhmBxaMhyf4ZLz2Y/xtVN5uKNJ:Iw+Kg46fhyfiLz1fuKNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772529356, "uuid": "4a7b43d5-3443-4d70-8c88-920739b514a7", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772529356, "uuid": "572ec410-9bd2-4172-96a7-c1226b348fd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529356, "uuid": "02bd17e6-e69a-4fc1-92a2-a33796648869", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b206de98-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1772548730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548730, "uuid": "5b30c906-db20-4ff5-a3bb-2ae2a3fa344b", "comment": "Malware payload (RemcosRAT)", "value": "e5e42f1fb4fe13d5b4efb4e1403ae1f2", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548730, "uuid": "2723b074-e35b-4434-bf6d-b4bfd0286971", "comment": "Malware payload (RemcosRAT)", "value": "ee754fecc6d8f2229c5fdf9b9189493eb813d6054fc0e71eec061f4f6fa91660", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548730, "uuid": "fefe8e89-795b-4521-bc6b-93783a0177af", "comment": "Malware payload (RemcosRAT)", "value": "ec2e0ef9e264e56b0cce0b6af296d5a6b8ac3079", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548730, "uuid": "7481df5b-42b9-41bc-9b40-a50ddbc090dc", "comment": "Malware payload (RemcosRAT)", "value": "6a2f303a4b13ddb5848c2d1c7ee2dc0a1892ed58fb59297f39bec7fac59ed925e3b21070573273adbc220bb76a987b3a", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548730, "uuid": "8d4ecbca-6960-4316-afba-494cca3dac12", "value": "T11E35DF5970E7EC8A9C05A082BB701D692E7A740F52CB4C12C6266FD313DF46D6AB50EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548730, "uuid": "6c453336-a4a9-487e-a0c9-0cf6c2d8423a", "value": "768:u222222222222222222222222222222222222222222222222222222222222222:p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548730, "uuid": "327d1702-03de-464d-b280-fccff6705a4f", "value": 1157312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548730, "uuid": "ad2e0e9e-385a-4144-988c-a52d299f724a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548730, "uuid": "c653b821-6705-42f1-9304-8bc7216720e0", "value": "e5e42f1fb4fe13d5b4efb4e1403ae1f2.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f19748db-170c-11f1-a769-42010a9c0008", "comment": "Malware payload (CryptOne)", "timestamp": 1772547978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547978, "uuid": "e30d78f2-2993-492f-9227-e4a24b975276", "comment": "Malware payload (CryptOne)", "value": "268681ecd4e5a9a45d55431b3b5d8e1c", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547978, "uuid": "3300760a-1a98-4897-92c0-6dbfa017e92f", "comment": "Malware payload (CryptOne)", "value": "efca5c3036e33dda88ac70c855d6055970501c0277010dd803f92ee4599d822e", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547978, "uuid": "a3671cde-1cc2-45d5-bb18-36f77d608952", "comment": "Malware payload (CryptOne)", "value": "4f51730d021caae90ed46477186c354963f0e3ee", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547978, "uuid": "2c37befe-d678-4f9a-84e0-0f36e2612244", "comment": "Malware payload (CryptOne)", "value": "07ff22f32ac0b8a1308f2a0086591bf50309aad05bb458bc642b41fdc15fef4e9fecd740ec516ed188468f86fc507756", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547978, "uuid": "5b58c967-a8c5-43cb-9f76-eb4a4289f0ea", "value": "T16C36F1FA606EE275C4C5573DDB29D2FB4C7638422A35A0E23AD20CCEDC1D6827A73195", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547978, "uuid": "8b283010-6cdc-4520-82ec-147f0aacb472", "value": "ed160f57a556f205db44503c0c7d19fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547978, "uuid": "69a72cbd-6504-47bf-9d58-d23752e34a7a", "value": "98304:194IRm5Izg0Lc/4wZzL16DV4cqlClCVVsmZ+tZc/0+Mrq:194IE5ILLhwH6DCkkXEt6/Crq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772547978, "uuid": "c5549593-cc86-4774-869c-36d6a3e5b0fd", "value": 4939776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772547978, "uuid": "3bb722e1-b713-4a62-a6a3-3a3fcf083944", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547978, "uuid": "591adea1-1d95-46f8-b7cb-5b1e0201e2ca", "value": "2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831ca148-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772519016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519016, "uuid": "ac954463-ec77-496d-ad19-7b842fb04125", "comment": "Malware payload (AsyncRAT)", "value": "4942d213ea092bd0f24fb38c875f8a54", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519016, "uuid": "175964a2-54fb-471c-b4d9-7af0f919266f", "comment": "Malware payload (AsyncRAT)", "value": "f00611d70e13c43db0abf6af56c3c4a05979820907d5dae11a2bbcf32cd38fb0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519016, "uuid": "0660d96d-37b1-4e56-baad-4e27ba7b225e", "comment": "Malware payload (AsyncRAT)", "value": "c1f1655a759347ada576481233f166005998b971", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519016, "uuid": "aff12b1f-43a9-4e78-a120-db9ae5814932", "comment": "Malware payload (AsyncRAT)", "value": "37177170f0d499a98269c1be79e5d72cbb3288fdb7ee0d59be3d70a420a096f7f4a404bc13df9ec770fee3e2bca856fb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519016, "uuid": "45084e22-a698-4c7d-a175-509e53baa675", "value": "T167D24A08B3D88561E1FD57B94D7292048771EE4BA973DB9E1FC441AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519016, "uuid": "a7e4ad56-e8f9-4f23-a60d-7d4c0897ba92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519016, "uuid": "033b4a19-5f5c-4b71-8577-40cc76d2f85c", "value": "768:7KqRXmghxwMhIEg/cIRGqom/Rb7fB/dTG/+:uqRXdxwUIV1i4RbN/E/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772519016, "uuid": "1f1a6665-88f9-45cc-a0ef-97f5eb2296cc", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772519016, "uuid": "814dc544-33c1-4887-8ec6-16c1438d11f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519016, "uuid": "57c1b0b0-60d8-46a2-8a41-7bdc215bab32", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7678bbb8-170e-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1772548630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548630, "uuid": "c528d5fc-f5cb-41a5-8cce-54b5200eb311", "comment": "Malware payload (Formbook)", "value": "56a71d3bdca5b4b9bfb9e734e49f2de0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548630, "uuid": "52b31a18-bb0e-4e3c-a053-12a14bc98887", "comment": "Malware payload (Formbook)", "value": "f0a98a72b7b1c86ac4ce457e7978a46e8af53393e1007d2fe94306bb042388d1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548630, "uuid": "226a0d04-ccd4-41cb-9fdd-77885e4a9c04", "comment": "Malware payload (Formbook)", "value": "19c720215dd0ddf77657473bbea26c29ddd988a0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772548630, "uuid": "75c0479a-cf05-4ec3-8c61-89b8153f3de8", "comment": "Malware payload (Formbook)", "value": "3b986d44993228c8ef2ef6a9f742a3bf79295293f09e7031ac5754ccabd921629139c4963343cdfec80aa5b1cfe7052f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548630, "uuid": "2e3d062a-6edf-48cd-bfe9-2a18aa26464a", "value": "T1A9E2081CB1CF4987F4679601EB4C70CC0A15E0D32F995CEAD66F6CAAA1D058E7A933D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548630, "uuid": "e18b6d82-8e0c-489e-93fb-401c4ca27e33", "value": "384:sGLCfWt2nTY6c4NrJ1Z/g3qvW3l3TvwoBpmvEh9gYQ0pEAI72KErJDso53IqYPAs:sgyv7Td5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772548630, "uuid": "010790e6-63c0-43ae-94f9-de7885eb325e", "value": 33978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772548630, "uuid": "fb47438f-a7a4-413d-b87d-38cde6b78522", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772548630, "uuid": "f181db03-eabd-4a60-82d9-07914798017c", "value": "56a71d3bdca5b4b9bfb9e734e49f2de0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c4f2a49-170b-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772547405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547405, "uuid": "488ed217-fc74-43ab-ac46-a23912fefac6", "comment": "Malware payload (PureLogsStealer)", "value": "5fded1ef3e647c27676a7b69c20c6de4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547405, "uuid": "2ff1dbab-6523-418f-883c-f2b1931e85d6", "comment": "Malware payload (PureLogsStealer)", "value": "f0b9e1998c2fb65cfd092aec89b28c339f2993d74b5fe958ce5e43888de9a37e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547405, "uuid": "36f9d438-0d33-4a3e-9bae-26583e8bf74b", "comment": "Malware payload (PureLogsStealer)", "value": "798d608a29fe3117d272c4746c6300fb98c9ede3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772547405, "uuid": "a2485b7d-6b88-4337-96f3-90f04376ef48", "comment": "Malware payload (PureLogsStealer)", "value": "48b64e6c7c41feb44ef0a3c224acf3239b3b012da52164124a151d39f73af33b18930a2bfd349c6bc9dc968c9a4a3352", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547405, "uuid": "4fff953d-cbae-4440-908c-5f54e2de8120", "value": "T15FE4AE6FB657DE20D1885333D1C74D45A3B5A68175A3E70E358823A219073EFCE0B6AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547405, "uuid": "4804a45c-66c4-4502-8080-7a9eebe17839", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547405, "uuid": "a5ee8a69-6669-43b6-8de1-5f9e440276d3", "value": "12288:iG2Mj/eIgCtrEW30T+y7GDwoKUYAD2bkfW4:0MSYR8Sy7Gh7r22D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772547405, "uuid": "bdf1a216-7ddd-471a-8843-2f3a46a08efd", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772547405, "uuid": "90239358-7963-42e0-8e9d-30648bc3363f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772547405, "uuid": "c5ee2a07-4b12-4f7b-9a83-34ff17144b11", "value": "5fded1ef3e647c27676a7b69c20c6de4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664420c8-16de-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772527987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772527987, "uuid": "4b9dba01-efa0-4a6f-9bdd-1821928ff894", "comment": "Malware payload", "value": "f0a3d6d969c9965a0c6ee7ae38aec6a7", "object_relation": "md5", "Tag": [ { "name": "77-90-185-24", "colour": "#B47C2B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772527987, "uuid": "ad2e62b7-18c1-4da9-9015-a0e902a1086b", "comment": "Malware payload", "value": "f0eb85a26aa554363ccf9d516b05526369b20b8ec4c995b3c6604eb1efa81758", "object_relation": "sha256", "Tag": [ { "name": "77-90-185-24", "colour": "#B47C2B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772527987, "uuid": "d6208755-7b7d-4a1b-8912-67eb01b03432", "comment": "Malware payload", "value": "24ef628a24f8a8350248460c80d6c8f44f8ecbc9", "object_relation": "sha1", "Tag": [ { "name": "77-90-185-24", "colour": "#B47C2B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772527987, "uuid": "7681ae82-d426-4423-ab8f-f6e367ca1f32", "comment": "Malware payload", "value": "aa9f938e291627686c5b152dc2f92e5d31e5e7d051a256c12b4f30aaa2004da6dab39ee5e48fa3e5804011a33da900a5", "object_relation": "sha3-384", "Tag": [ { "name": "77-90-185-24", "colour": "#B47C2B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772527987, "uuid": "2fb4c9ab-957b-49fd-a8ae-4083f51923fc", "value": "T18A62E1E5FF4A06CD80CDC6707C3E9F46573E89FE0261E6062E802D4BD8504395A6536E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772527987, "uuid": "1bec1669-ee4e-4e16-89f8-52d1a8f42727", "value": "384:mbXVI4aamq0tHhdj11j83tL+M4Bq8kgNi7i27CbFD:mbXW4aRhdj1StCMPxgNi7ifbFD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772527987, "uuid": "37304a78-d32d-4d15-b271-46e06db8a548", "value": 15764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772527987, "uuid": "f84390ea-6d61-44c8-a1d6-918baef4615a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772527987, "uuid": "cab86c16-601c-4576-acff-05081901ed85", "value": "df5aa9a7e36f5b54c1c6f6f9c38d86b070eafbb02760a8133568d035d5ca35a1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c833a343-1747-11f1-a769-42010a9c0008", "comment": "Malware payload (ConnectWise)", "timestamp": 1772573249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772573249, "uuid": "e16cd5bc-64c1-40d9-9d9e-b0fb692ac2ef", "comment": "Malware payload (ConnectWise)", "value": "cc0750da1901cfe6f43843d84f26805c", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772573249, "uuid": "25e043c9-b5e4-4be5-93b7-ceb422255bf1", "comment": "Malware payload (ConnectWise)", "value": "f13aeee2cdb6680d92946d29d53d63da1dbee30088c47be092ec44b94a93096d", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772573249, "uuid": "3fc9c537-4dd2-44aa-b45f-5c58b484a02a", "comment": "Malware payload (ConnectWise)", "value": "8c2c9786127b3e571437a6920718db1ce8d942cd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772573249, "uuid": "e1fca442-98f6-45cf-9bcd-436b448c3d81", "comment": "Malware payload (ConnectWise)", "value": "116459f33406445088c4abe2ec6c8755a8b116e176aaa7a2e497f1b10adc31fd12cead11e15844c70ed20d4c528df824", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772573249, "uuid": "cbe296b7-f56e-4f45-a3f9-fbb2d51d7eef", "value": "T178D6231023F94815F5B25B34EDBA92B1D8367E35BE12D18E1761F81E2EB1D808E62773", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772573249, "uuid": "32d1b751-aee0-4a28-a17d-892e239f56e0", "value": "393216:DxIQzckXxIQzbxIQzlxIQzZxIQz9xIQz0xIQzw:xzdz5zjznzrzezw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772573249, "uuid": "38b83330-26c0-4c6f-a4d4-1349eadaf002", "value": 13537280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772573249, "uuid": "ca62bd62-e0b2-436d-9600-9de125272944", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772573249, "uuid": "e859b07d-f872-42bf-a28a-f05364e0f7e2", "value": "SC.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4225819e-16ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772542100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542100, "uuid": "d590dd0e-e4f4-4697-a0df-a16d27b21f84", "comment": "Malware payload", "value": "3ca7655b64631fc22444cf135fc41422", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542100, "uuid": "b688361a-2f11-430d-919d-d91c77528749", "comment": "Malware payload", "value": "f149c7597f147ca63561bb21ccba7f729d454364445758dcadce7854bbfff5f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542100, "uuid": "eabc3f08-61c4-4620-b2f4-5c3ed517ee5d", "comment": "Malware payload", "value": "6ff2496526b32205207deb2154ac92c8495bf7be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772542100, "uuid": "febdc1c4-6655-41f6-9629-8935ef0e0094", "comment": "Malware payload", "value": "4ff8ad8362cd0322ea74659d938c39a024ec5eb6a0c4f5ddb864ff6dfed9a5773436e69f4bd7e9e410fbf7d03e17f92a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542100, "uuid": "cef093ce-6cfd-4659-b51c-6fe4d7703906", "value": "T1DDD56A72769AC13BC53604B1266DCBEE61297EB50B6590D763C83E2E05B78D28331F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542100, "uuid": "3d7f88dc-a0e2-4db0-b5b5-ccd7820a54ce", "value": "2565cbd2a560c6b3554de2985322d883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542100, "uuid": "bbfb596c-42d6-4e80-a485-ede15d8bd300", "value": "49152:UfImZfi2k8XXSSRrHWaVFuHT8xyMdV5whLnPUD/Va+FN/BJ9+mIYDDTBZdB:cImZBk8XXSSRr2aVFuHIx/iLnPmTBt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772542100, "uuid": "8a552a2b-21f0-4cbb-8fd9-db4bb5d06511", "value": 2857792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772542100, "uuid": "21a28cc3-5955-4988-8ce6-770ddcfed822", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772542100, "uuid": "b4044b42-73de-4a00-be62-7e45248f1191", "value": "Game.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86aee93-174c-11f1-a769-42010a9c0008", "comment": "Malware payload (DCRat)", "timestamp": 1772575450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772575450, "uuid": "a36f9845-5405-4b76-be87-5e8ecd64e5a2", "comment": "Malware payload (DCRat)", "value": "ec83435d6c98e7d396789456cb6170e6", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772575450, "uuid": "3c03fc23-472d-4792-8440-76ffff885911", "comment": "Malware payload (DCRat)", "value": "f6ce74ace5b01a891f5538e6502b8966c2e9d9b5aec69b4d76f3899b97c764d0", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772575450, "uuid": "f77643d6-b130-4ad3-b5fb-423595189f69", "comment": "Malware payload (DCRat)", "value": "bf0a3e34ed3638c13f86cdfd2ef201663b195c8e", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772575450, "uuid": "e839e8d7-d46c-4014-bba4-eeb8062f548e", "comment": "Malware payload (DCRat)", "value": "2ed006eb16f318f1ef5479aac04801f9289b314a11e2be732d9dc9cc3b2a05d24d9b7757ac70ebaf434de73ab3de6127", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772575450, "uuid": "2f8d4d12-79d3-49a9-af75-9e0e81f049e0", "value": "T1CF132C00BBD9C57BE3BE4F7854B2630546B5E9A76503EB4D1CC004EB1A17FC98B426EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772575450, "uuid": "3798d22c-2a54-4db8-8bbf-c92aa16f9a1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772575450, "uuid": "90a17806-c5ab-48e0-afa6-93a02e78d54c", "value": "768:iEoSQWILxI0UVlvl0/XNzMUDrgOdQ8ekAZvu+:iNLVSlWfNAUDrg38ellu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772575450, "uuid": "e5185061-cfa7-44b6-81d8-f1f9df68c2c0", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772575450, "uuid": "4d88debe-af4c-4a74-9565-8f571e3cb3b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772575450, "uuid": "7f3ed8cb-cf1f-4778-b621-81493ccd1374", "value": "mv3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3105fd43-1747-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772572995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572995, "uuid": "b86ff92a-8476-446d-bf6f-60d92100e5fc", "comment": "Malware payload", "value": "906de45984d0ae56d2687e43ca97a1a5", "object_relation": "md5", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572995, "uuid": "0b414630-e139-49aa-9701-68c928bd2800", "comment": "Malware payload", "value": "f87c264dc752aed426c052763bde05695d07b90777c7f9207e10ecba0bc7897c", "object_relation": "sha256", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572995, "uuid": "7872051b-491f-4f6d-82ca-662fbb792659", "comment": "Malware payload", "value": "8cccd9bd11fb6bb7d864b22f43cbab1509980bfc", "object_relation": "sha1", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772572995, "uuid": "979e0b6a-3543-4af6-aae6-0a49435b00e1", "comment": "Malware payload", "value": "504a96f30b091f7d24e87e521126caf8d3568ca39d5ba7f4de9efdc29f1ab088b983bb14ba810df6fb437356a1e4a383", "object_relation": "sha3-384", "Tag": [ { "name": "85-11-167-119", "colour": "#43DEC1", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772572995, "uuid": "186bcc17-60e0-43c7-84ef-ab585d7e66ee", "value": "T1AA33F2FB047C42D35F026A3F8EAA512F50F1CE48799823A5754FB3815D36628A6371B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772572995, "uuid": "60715702-10d0-4638-846b-173cdf97d288", "value": "768:f+bp7kqrT4HE5rmUCsg+/PAQM6xI5nyCn3SnNUFmIO7Nxx1FpZhEX+qfMzjixtCt:85rmUCsHgLF5nyzegxx1Xf8dfAjixtCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772572995, "uuid": "f3b3ec6c-c7c0-4aff-9c8c-63e255004178", "value": 53368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772572995, "uuid": "a52fb722-fbcd-486a-8dd1-59514a2331ad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772572995, "uuid": "2c366e66-24e5-403a-8731-fd249da3b0cb", "value": "new.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf14d30-16e3-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772530282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772530282, "uuid": "b1d67a80-7dcf-4dcc-8a09-ca636f6cd6f8", "comment": "Malware payload (Mirai)", "value": "4e7972ff04ff15656b35f57671169f64", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772530282, "uuid": "c390b372-ca47-444a-a54b-b695a2f2ab80", "comment": "Malware payload (Mirai)", "value": "f989861d8c1d0176ceed8040454829ae94a1ca802dd3ebf4a31817e71193bac2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772530282, "uuid": "d3559182-3f4c-4a31-b5f1-52b3c4dda4c1", "comment": "Malware payload (Mirai)", "value": "84f30cfe7479a67285e3bb955b9b2bb62b548191", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772530282, "uuid": "4081a059-5e83-4f13-a716-ddc278a8de04", "comment": "Malware payload (Mirai)", "value": "189f7b5cc50a7dd9c9d78b32fc9b30c4510830793ab8d015d5bacf7e58f1fa0e2770eac647e5148466a467113dfe8001", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772530282, "uuid": "f78cf54c-94ca-47c7-a9a8-17b967a36e42", "value": "T170732B86F88B84FAC91B8C3050B7F23FCA31D97E4175966FEF596E35CA279025213189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772530282, "uuid": "abace676-d84d-42dc-8114-0aed0180b981", "value": "1536:XNQhHlXSIi6kPRcy7wA5JZbMEBkK/LXdnSDCwXw7cgtR:XN6Xxi6kZcMwA9BkKjXpSDt2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772530282, "uuid": "1f5bb740-d05c-41fa-b5d6-c55117f590dc", "value": 74928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772530282, "uuid": "dc06ea63-c72a-4b02-a2a5-f7d5c0c991b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772530282, "uuid": "af9fea22-43e8-43ea-8d33-7b290361d42c", "value": "nullnet_load.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f56a2b15-16d1-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772522644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522644, "uuid": "eacd8877-d57f-4a46-aa7e-b9a9690dee61", "comment": "Malware payload (PureLogsStealer)", "value": "105a667049b780e82da51ac970f146af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522644, "uuid": "fcf67f7f-9416-4b45-858a-c3d44fcb1469", "comment": "Malware payload (PureLogsStealer)", "value": "f9af61b4bf86ac7a59397308acac4252efec71dabd9a9e1fedf0ac6c1c473a9f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522644, "uuid": "c9dbc6b8-f5ca-45c2-8c3a-b557e7f4ab2b", "comment": "Malware payload (PureLogsStealer)", "value": "3f3727d05789364bd8dd09ca6f835d5bf6a413dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772522644, "uuid": "e6b85353-fe01-4391-8faa-27eaff1cfaca", "comment": "Malware payload (PureLogsStealer)", "value": "9df859f94911d654115570a2386cedbccf5758ccdaabb85d4545d65111fe165c71af62ff73ec589eb6c804a2bc92d3ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522644, "uuid": "e95085d8-be87-4ff5-8def-67613a466f4b", "value": "T1243512481758D806CAAA577629B2F37C177EAEDBF411C31B9FCCACEB3A627055808351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522644, "uuid": "15a928c3-bbcc-45e1-af49-7be2f412ca30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522644, "uuid": "2f60101a-99c4-4ca3-8020-d5d6970adcd3", "value": "24576:XI5aOUN3EgPAOzBz9D5J0WFrHCMpXSHVrnXHs85DwSXdm4pt70o+8:4UJEvCBz9D0iXpKdXlDwSNmWhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772522644, "uuid": "dd071ee5-a510-4cb6-b790-ea641053d416", "value": 1154568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772522644, "uuid": "3c683b60-14e0-4619-8477-af5dc98d1f9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772522644, "uuid": "4e82b49a-b530-45c1-8fa2-aa4ce52bf104", "value": "105a667049b780e82da51ac970f146af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df45198-16e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772529262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529262, "uuid": "078fa2dc-a370-436f-905f-ff85810c53fa", "comment": "Malware payload", "value": "86d9f7764851988704e57a0e5e0f9760", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529262, "uuid": "1e19f8f4-954e-4280-8437-1dfb3a84cb84", "comment": "Malware payload", "value": "fa354cf29852573669bc468ea2dac0ea5e83a943315466c89dd8634b38cdb261", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529262, "uuid": "ae31eb73-37cd-4a74-b400-53eca1f15e1d", "comment": "Malware payload", "value": "3b4bea3a812816d08218db3e47aec7128fd92a29", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772529262, "uuid": "43299b0e-3922-4cd3-b271-09bb09a90175", "comment": "Malware payload", "value": "dfe2ab58fc53d729c7503dd7bfc93aec09b807843002a0423c94f2e07d4ce229e41bf03623df02c43f94022a8c5a41b8", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "crewldmainnew-com", "colour": "#0AE1A0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529262, "uuid": "ddc49ae1-8a74-4490-af6f-35146634d8ea", "value": "T186B092502B949A118A0E823241A59287B800CA4D8950FC7081A2446ED9B167A22B93E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529262, "uuid": "7d70e22c-c00a-47e4-ab2e-1b55156c5966", "value": "3:pF22wxzwXAmdAi9zK4ZFfBxTyMAmx+TIoDjrxy4:pF/wAlCwNZZBxWfmx+vXxy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772529262, "uuid": "a3b393d8-dc01-4bc8-8c38-a20fecaca73f", "value": 113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772529262, "uuid": "764e990c-d17f-47dd-887b-562f4cc49110", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772529262, "uuid": "6a624d87-5ade-4302-a320-89585ebe69fb", "value": "fa354cf29852573669bc468ea2dac0ea5e83a943315466c89dd8634b38cdb261.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "838a6fcc-16c9-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772519017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519017, "uuid": "4d713352-6166-485e-94a7-d92521316713", "comment": "Malware payload (Mirai)", "value": "d2285d489bcfc77bf4791034704a48ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519017, "uuid": "99236aaa-2b5d-4fa7-9529-c4f5f41fcbd5", "comment": "Malware payload (Mirai)", "value": "fbd14e68e15fc292481e8db8b4a6241cfbf0afb50abc7687e5031a3e9df4825a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519017, "uuid": "3913a7ab-a6ef-436c-9cbe-c35fa992ba73", "comment": "Malware payload (Mirai)", "value": "43fda6762a9fff94316f582160c131bfd32e3608", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772519017, "uuid": "6b453d95-24e5-4854-98b8-e3096e221803", "comment": "Malware payload (Mirai)", "value": "e9ff1c72b3c604ed60816552a98035a9f9d34f6ba66a05f308387bfc267f34c36a17cf1951a7b65de45593b6f4fd89c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519017, "uuid": "56126805-701c-4103-b88a-2447ad145c1a", "value": "T17E739E76D16C5DB0C4440A7476A8D9B44B136504A6A33FF1DA828F699007EFCF226BF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519017, "uuid": "18b46da4-415e-4fcd-b79c-ac6382976297", "value": "1536:2/E2u9ajZ/pnCNS3ESNiL5pUKmeNQ3kCIhW:2s2w+/hsSgDMeNQ3k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772519017, "uuid": "1fcdff4d-8671-4242-b7c6-3cd56704d6da", "value": 74764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772519017, "uuid": "a006d39d-f379-4f85-906d-75c19351d8b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772519017, "uuid": "3f586831-4e14-4b85-86c2-90cf8872a57d", "value": "nullnet_load.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884baf40-173e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772569276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772569276, "uuid": "3e411f78-5038-433f-abb0-bf5b03e61ab8", "comment": "Malware payload", "value": "dcc6babb306d65b145c29276cdc03d34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772569276, "uuid": "dcc05b03-a63a-4f69-a705-3f2b152b5905", "comment": "Malware payload", "value": "fc0679e7f8653a35bb725adfd54fa7a58db8b1d10ef0231c65907db622075b58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772569276, "uuid": "99597b49-286a-41e0-9f86-ef7d00e0b7f0", "comment": "Malware payload", "value": "1c0d7bac7d683605cb66b16ec39708df34559925", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772569276, "uuid": "819b9256-a268-446e-9473-b660dac39718", "comment": "Malware payload", "value": "9e4e7804360d710ece7c5f360c9f5258d266683840d47006e9d4d62c771aac26011a9c2a4c1688b52bacc85fe443c40c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772569276, "uuid": "94c45e89-f07f-4cfd-9b77-80db71a02f85", "value": "T1C8668D93B6CC6539C06A1A36493BA650993FF7613916CD1B37E40D4CCF35A806A3AF1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772569276, "uuid": "dc1a5a8c-d105-4a7b-9d37-a15ef9888ae9", "value": "c6731b1fe59584f0330df66b55d0da33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772569276, "uuid": "a7da162a-6f76-4bb2-a28d-98c1046977fc", "value": "98304:Vav9kzPyLTpOdv6tLlSIZ0PUXOSkk95GF/:y9kWLSfuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772569276, "uuid": "71b951f0-2918-42c7-ad67-aa9e84b7cbcd", "value": 6498920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772569276, "uuid": "df04b95f-2e6b-4bc9-95fb-d7e14ed6681b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772569276, "uuid": "cd83e916-8ddf-4bf9-af42-7cc62d882dab", "value": "Win_Driver_SSL_support_v43.22.209.44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4bb855-1708-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1772546036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546036, "uuid": "9b426a0a-b394-4017-962b-31ec272711fb", "comment": "Malware payload", "value": "eea5f42e8ff6b10eccaec3b4ad4ca702", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546036, "uuid": "90ea81a7-2c02-497e-a944-95c548d1633b", "comment": "Malware payload", "value": "fd452d2cfed222a167131237b4060cba8313faec887a4747682671baa0ee3ca3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546036, "uuid": "f7e94dfb-5d7e-4694-b6e4-1ef114b5fe7d", "comment": "Malware payload", "value": "3cb538dcf6a286d36917806f32433097e013815f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546036, "uuid": "b82ce436-46a8-4fbe-82c1-8dec5d8886e4", "comment": "Malware payload", "value": "fd9457a01a399a7827b2d2cc78d2b620af61afc7ff9504e93b10655807924c592358ba6cdb1e9571d61f4a7c0da1ef13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546036, "uuid": "4f266bf1-a8ad-4c03-9a33-a7257b21c592", "value": "T18C733C02B3180A47E1631EF02A3F17E1D3EEAAE111F4F6C4655EAA45D1B6E361186ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546036, "uuid": "83cbff94-b72c-450c-8ac4-60faef91432c", "value": "1536:CBFzdgxT0QkrDe8aLPxfsAji63+7ge4+Vi7MWCq4+N4:eoTlxDi635j7DCS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546036, "uuid": "17b67c3b-abb0-41dc-b120-fd12d8da6bc9", "value": 79608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546036, "uuid": "e6035ca7-9209-486e-9723-f727f5b724a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546036, "uuid": "eaf4a867-f190-4918-ac94-b071d73bc48c", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9876a75e-16de-11f1-a769-42010a9c0008", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1772528072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528072, "uuid": "97009923-6709-44d6-9caf-13e72b8220bd", "comment": "Malware payload (PureLogsStealer)", "value": "b7fa192d0fab80e5816988da055256b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528072, "uuid": "dd95bb98-71ed-4fa7-b3b0-cfea552e05da", "comment": "Malware payload (PureLogsStealer)", "value": "fde23c39738f7c241bfa877dd0623e2468388b51accb030876267ad2b8b81637", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528072, "uuid": "43abd52a-45cb-499e-92a2-be02fa673a24", "comment": "Malware payload (PureLogsStealer)", "value": "7926b46bd9ba604e9366af224b18359d0046df17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772528072, "uuid": "d3a58f01-cf4d-4e4b-828e-8c864675b296", "comment": "Malware payload (PureLogsStealer)", "value": "bfcba7e14014c9870329dea0d08457c227c0cf35f22a1ed71a739222b2c35d6186244778b1eba2d50cca6c1150f7ae83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772528072, "uuid": "3ab8557c-2fbc-47e9-90a9-9d4271f2e258", "value": "T10C35BFB876043CE6E66F467BCA96ACDD13723A639BC7A4CD40646BC30963371EF16805", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772528072, "uuid": "1d4023e6-4d24-430f-832c-90842e2812fb", "value": "79c2877b90f1bfb58c906f4d9155285f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772528072, "uuid": "96019ac4-455d-4458-b50f-e58571bc0d48", "value": "24576:D/Xy2oXQqeWYc7vQAKgOJeZuwU+LcZ1M080Lq/ROX3mFQi/++he:DPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772528072, "uuid": "4d68f4b0-159d-4791-a285-47f6e55fb9dd", "value": 1150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772528072, "uuid": "65b4bdfd-1f09-43ac-8b65-2a11a2b3ac2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772528072, "uuid": "e8282af8-00df-46d1-b563-8cd5c4a2a85b", "value": "print-2503847261.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb957da-16cc-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1772520185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520185, "uuid": "1863ea5c-9315-453b-9f8f-755829b39a87", "comment": "Malware payload (AsyncRAT)", "value": "dac2cfac4adc0d6f618c035dbd34d219", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520185, "uuid": "065bfaf6-4bf8-4cbc-9d7c-7078c521e8ad", "comment": "Malware payload (AsyncRAT)", "value": "fe67b6ec00f704040dc54a7f66a1aeaa4aa6cdf190a5d073b3ba27240a2f27cf", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520185, "uuid": "1dbba4e1-bd4c-4c1d-b365-0eeb343cd07b", "comment": "Malware payload (AsyncRAT)", "value": "65bfb7582ffc5641f5e2162c85327fa1da92e335", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772520185, "uuid": "e75b813b-365f-49a8-aab6-d39ab6b9d19f", "comment": "Malware payload (AsyncRAT)", "value": "7adbb3aa135b37ae44cd029e8c642b508bf2e46563cb66ec1179aa1368463e4d086afc590aef307749f6f35afd3b2cfd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520185, "uuid": "3cd30ca5-9372-4502-bbbb-67ac08b4667a", "value": "T11FD24B08B3D88521E1FD57B94D7292048771EA5B9973DB9E2FC440AE2623B88CF15BE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520185, "uuid": "81fa5f34-1967-4230-ad23-68f7aa2e9409", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520185, "uuid": "cc6aba3c-7bbb-4a91-acb6-879664f2df68", "value": "768:BYERXVgO3ej25Ni68g/cIRGqoe/Rb7fB/dTv/+:2ERXVgOuj25Ni691iQRbN/9/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772520185, "uuid": "99416895-a917-4d16-84a2-c1fac08d272f", "value": 30720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772520185, "uuid": "704fc228-efb3-40c7-9d50-31c3a8b6549c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772520185, "uuid": "69dd140e-f6cf-472e-a1d6-311a91f99098", "value": "AsyncRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63bd70d0-1708-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1772546022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546022, "uuid": "859e923b-30ef-47ae-b498-caede1440e4b", "comment": "Malware payload (Mirai)", "value": "58edefe37adf4b6e5081777b9aaa4da6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546022, "uuid": "c0e93fef-be16-43f0-ae98-9370553eddab", "comment": "Malware payload (Mirai)", "value": "ffc4251071ae031dac799b3c445da328f62a9a6063a7c4bd615e0f67c306471b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546022, "uuid": "9fd6be03-5ceb-40d2-a83e-3cabd088e12c", "comment": "Malware payload (Mirai)", "value": "e98f491da644d399ab3531e1b359f49c8663a260", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1772546022, "uuid": "a26d6b44-bb8f-4183-b95a-b549008df8f6", "comment": "Malware payload (Mirai)", "value": "433125dbc86c874edd25de8360f5a89cd7c9023f634a8a5668e19cff76044bbb39b442a463508282a88b92157ad610a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546022, "uuid": "4c89770b-394b-49d2-93ff-f1d842faa0f6", "value": "T184636CC29A07C4F4FC1B15B12177E7329AB7E93E1059EB46C769A935BD23501A3263CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546022, "uuid": "6b3a4571-f011-4e08-98c8-8e5a3b0445fd", "value": "1536:VgxjM586A5vni+2gzN5KzRMI4LV0e0mbsK4:axjMdQfh1NiRMD2egK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1772546022, "uuid": "4c3300ad-e0c9-4044-a079-9d448e10f521", "value": 71152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1772546022, "uuid": "f9191464-f34f-45db-94f5-bf667ab64561", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1772546022, "uuid": "10253a13-c0fb-472e-a061-739857ac1b2d", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }