{ "Event": { "published": true, "date": "2026-06-22", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-06-22", "timestamp": 1782172981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d712f6f7-92f6-4ecc-9dd1-764872798cd6", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bcda84d-6de8-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782097935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097935, "uuid": "ac9e8a24-f880-4dbf-ac9c-2d36febb642d", "comment": "Malware payload (Mirai)", "value": "a78a8fc065f1b5a70fd6256b28d760b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097935, "uuid": "bf22a227-bc86-4d09-bcaf-e96a10b548ad", "comment": "Malware payload (Mirai)", "value": "00109ee92a3ccea9d23621fe1e2e6f73cab1616c585da67ec9da59fa086cc848", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097935, "uuid": "8ebb1bec-1877-4e4b-aeed-33b78d30e391", "comment": "Malware payload (Mirai)", "value": "786ca2096a9fcd63676d4afde2ab3a3782b7dd5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097935, "uuid": "aa98be74-e8de-4db8-9c77-f4179e87400f", "comment": "Malware payload (Mirai)", "value": "85715a41290d7b385266166e52ded5091f6085129a10005aac74b2bd95863ea5260722c4dab6959ceb488c343aabfab4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097935, "uuid": "90080ffa-73cd-42fd-8e99-6e74b278d77c", "value": "T102E47D9DFE4E3C42E2D7E37C9E4987E1721B75E0D32391A23982430DD5C69D8CBA1A25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097935, "uuid": "fec63f7b-a46f-4f9e-8c49-3e27d7bfb864", "value": "12288:xx0iWHV/WD3MqMfZFrr5j+v1uQjmOyt5YXlzT9vpwnJSw5Ldtc7:T+pWD3Mppj+v17jYunyj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782097935, "uuid": "47a5a1b4-2507-41a9-803e-d11c86c4a96c", "value": 705168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782097935, "uuid": "dfc89a89-7f58-4412-9462-c55e21db1e2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097935, "uuid": "206ad2c5-129d-4a77-984e-4f44b6985f1f", "value": "data_aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39947d36-6e7e-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782162383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782162383, "uuid": "0041820a-c455-47da-bd5c-89852f4327a5", "comment": "Malware payload", "value": "c78505931bd088d8102f8a1febbad3b4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782162383, "uuid": "4869ef34-26fe-4ef6-81a5-e088cea2f88a", "comment": "Malware payload", "value": "005dd3c56c6bf41623e05f4f35aca2a9a2e235b40e175af776f13d0a48ae2c32", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782162383, "uuid": "6a952a22-4ada-4df3-97c2-48febdc3106e", "comment": "Malware payload", "value": "e4bbc880ef61af19ce7e1183c881eba3f45db5fc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782162383, "uuid": "1c7a1128-23e5-4986-abee-ff331cad0440", "comment": "Malware payload", "value": "5b40a5116e864bc1c1119d457d537cf3e0f0d3d3db573859b13a76db599864575e094f2a7854ead2bb11d9bb3b2adc8b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "e", "colour": "#C6129A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "US0.file", "colour": "#697B1C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782162383, "uuid": "52639b34-668a-43b9-9807-2e88cdca7f01", "value": "T1A02733137383C2B2DFA215F3C9BA5A715938BC381B2849CBB394746ED5B15D02B32B56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782162383, "uuid": "597d9ed0-d23d-40c3-b788-9acb6e54b7eb", "value": "fb40ad72cb65f1767a2e06fa73fcbc83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782162383, "uuid": "81cf6871-6bd2-4d20-8e0a-746d9e0e64a9", "value": "393216:24E82XhzQKAGn491oKNUkkqYgsV0wWkZ01uWgYTFSFgQVH+o:2vXhUe4919mjnPVJvg669W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782162383, "uuid": "8218d3f3-63aa-4453-9a90-0beb1ec97f82", "value": 20530176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782162383, "uuid": "953f5049-c34b-493f-8831-e52f0a833446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782162383, "uuid": "77a37c69-6fa4-43e6-9283-af9180115b5c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d260db55-6e50-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782142883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142883, "uuid": "9d7dea43-03ec-499b-8f83-9ba8731ff389", "comment": "Malware payload", "value": "a8f66d78c9b5638481d5df2d9adc5858", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142883, "uuid": "94f40a6e-a13d-4de9-a1a6-abc110e871f0", "comment": "Malware payload", "value": "01bf6451cc7663c7f9a7ca24c9181c58c3406aae6646bc6f64a9705da2328651", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142883, "uuid": "b4ece7be-8e9e-487d-a344-f4c01a3cc246", "comment": "Malware payload", "value": "52273f6a28cd5ced9a845768a3dd7f9868a60c4c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142883, "uuid": "c0fae4de-fccc-4121-bc2b-7f4f425ec855", "comment": "Malware payload", "value": "5bd5ea731a209e2db3c5f6a6f6aeae1f64f16c62fd545dac6301611b372a108597bc9160229d5d82160ee5a4d9816a34", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142883, "uuid": "b7ffa3fc-5694-4bb2-ae7c-0c270a0acf13", "value": "T15A72645AF790CD3BCDE8923854A7063071B6F8B0A721633B161463B55E473D88F1FA9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142883, "uuid": "5e58679e-eaa0-4d74-aebb-b5ec7a5debad", "value": "192:R2gnwY4hbt89bjvETze6ZVPjTVRHyZ1tvay4+qG4vi7:lstGEfe6vbiLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782142883, "uuid": "e54f8611-0e0a-4dc1-89ff-02398997ea02", "value": 16952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782142883, "uuid": "027f4ab9-e3b9-47a6-bd38-fff0b3cecf26", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142883, "uuid": "61fa450f-8779-443e-8ab5-5c1ff94d6839", "value": "a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8687dc67-6de5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782096799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096799, "uuid": "617192d6-1e51-47bd-bdb0-55b2d16d794a", "comment": "Malware payload (Mirai)", "value": "0bcc0ba9cec4a6580ab067f1b33876dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096799, "uuid": "a48a8a87-0b64-42de-9f46-6f39bb7c0d73", "comment": "Malware payload (Mirai)", "value": "0238e06a1ac58756abb6a5d261aa720ee600d7a8bf16fc50bf134251f6df5efd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096799, "uuid": "d2ae2f11-f338-41db-863b-75d497c4b1c2", "comment": "Malware payload (Mirai)", "value": "b69a1964323a8b04985028616e15338f35324b90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096799, "uuid": "bc41de49-feb6-468a-8e32-c55ca9edd5f2", "comment": "Malware payload (Mirai)", "value": "c5f12d812c796e0b8953621ce825afa7c29782e9a82955cfd6eed38bf2f1c6e986f24783130e57e17e8f4e82a2b97102", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096799, "uuid": "15817f4f-5db2-446d-8ed7-30cd71e9ea04", "value": "T102157CDDE7C7E0E1F62300F1025EDBF61934A12A5013FAF6EF45266274727A16F1A21A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096799, "uuid": "2ce713f9-fe0b-4ac1-9a6f-59164c5aeb20", "value": "24576:vQu5hIphla3ngNmi23pxl/VE8lxAyiErC:jhIphlaTi27UIpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782096799, "uuid": "c550ea11-8be5-4858-9b4a-b998ad383122", "value": 931160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782096799, "uuid": "bce882f9-f17c-4c7d-ac5d-fbb4d311e323", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096799, "uuid": "cec8fb53-a2bf-4177-8996-9ed73597a94f", "value": "data_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f3de7b-6e59-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782146571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782146571, "uuid": "b732f608-defd-4af6-bfac-d0a29a57fe59", "comment": "Malware payload", "value": "a833ec8fe1d3b84c4f2f621de9c6055c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782146571, "uuid": "c4582901-3b44-4c5a-9afd-352bfb55f5e3", "comment": "Malware payload", "value": "026b15d1583065e220e4c9c55173fcf3122fd25cb972380b7206cbbb920c2de8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782146571, "uuid": "1038767f-fd58-43e8-b1e5-03f90064d465", "comment": "Malware payload", "value": "635bebd68753ebadbce7d95a62b1f97cfcedbde1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782146571, "uuid": "56ccf789-7a45-44c2-988d-7a833102362b", "comment": "Malware payload", "value": "bf6d6dbffbde8d7bc00c6c8ac2167d8e66ff0cba630f800b9af64be9710589b8718b873d74d48bf43f988e41f15f291e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782146571, "uuid": "d43fe5fe-046e-4b24-8ea9-d5927d84a58a", "value": "T17FF4BE5B76568E21D2C41632C5DB810183F45887BA77E70E7A8423DA2D433FAEE4B397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782146571, "uuid": "0e728f01-e30c-40d8-a76b-fb3442604e7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782146571, "uuid": "86e0177d-ab90-45a2-8029-0c2f55fb1b03", "value": "12288:0oS9ec1MkGfiXpUvs52BTQoNwnCeZB3vyYaid9H446tspetQFFY1RhZXyN7:r45UvO2BVwbZNNd9fAtQFWgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782146571, "uuid": "c273bfd7-c4bb-4115-bfd5-4e845cf5bdd0", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782146571, "uuid": "dd351649-f149-4502-a861-23ee84d2b0ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782146571, "uuid": "bc4ce641-909b-4378-b7e1-748854640b77", "value": "SecuriteInfo.com.Trojan.Kryptik.279.56168261", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4eb74a6-6e45-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782138189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138189, "uuid": "615c1f5e-6cce-4136-844e-ef2ac3c5aa88", "comment": "Malware payload (Vidar)", "value": "05cacbb03802272dcc3e6747d79069fe", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138189, "uuid": "7ca5c21c-da3f-4333-ad95-654ed6177ed5", "comment": "Malware payload (Vidar)", "value": "03ab8ad3d41ca487e715290a68e3f90d671f36ffeda8c12439d2d7c92880948e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138189, "uuid": "c839b7c0-4ed4-4115-9554-f7aae2b4416d", "comment": "Malware payload (Vidar)", "value": "30e669ff4710b6e5dd195221af5c068c7f2acf37", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138189, "uuid": "933425f6-a5de-4aab-a7bd-a4a76250bc63", "comment": "Malware payload (Vidar)", "value": "b2a4891c16c9ca471dd762030e9b3f55f9381eb01d1ba9a88cc23de6bf8eaf226a2f5452418a91910e4c460220d15b24", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "MIX1.file", "colour": "#FFF7BF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138189, "uuid": "e20c2288-763e-4228-bf45-c40e92bc396c", "value": "T141F58C07FD9119EAC06A623188B3959177B6BC091B3137DB2E90B7792FB63E05C39718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138189, "uuid": "5c8e1752-6b23-4ebb-8487-44d9cb0106c6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138189, "uuid": "a32686ce-40e0-4f5b-8e66-a099cfc5b471", "value": "24576:+bnd+nRJ0ZLCIPRpU/TzU0T4cmU6JUZ3aYFWAK7E81zqpzH5CxGubL6PqtjEVo96:+bnsnX0MI5i0tZ+KYK7R1zzn52tZ0Ub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782138189, "uuid": "c21206fb-6fa2-4cf4-aa2d-bc36c9412fd2", "value": 3396448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782138189, "uuid": "162d064b-9628-40a5-a08f-251c4d86ca6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138189, "uuid": "4e2dd0b3-4cec-45fd-bc4d-48d6b7d56835", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "add9567a-6e3b-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782133802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133802, "uuid": "f7b86652-824b-4c6e-86d7-81c502706355", "comment": "Malware payload (Mirai)", "value": "19a556e99750fa3b27596ef8aefc097e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133802, "uuid": "3a75ce62-8e9b-43cb-a047-2b3367ecccc1", "comment": "Malware payload (Mirai)", "value": "04aa408827198e14501997a834509fc4fb43f9ffd6cdc719d7451d43ff71767e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133802, "uuid": "789b58a1-bb61-4cff-b383-6307e43a5998", "comment": "Malware payload (Mirai)", "value": "8c9d9c23be771ef142d00133a3890dbf35e7261f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133802, "uuid": "e6d5f2a6-b0c3-4acb-983e-67b6a5c62eea", "comment": "Malware payload (Mirai)", "value": "21b4928bf789a9449321c92157a723af03cf9da9752b4c5c1a2de4a12d4240a537ea0910408e5eaf5c6a5491d37fa045", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133802, "uuid": "560b5063-f068-43d2-bdac-b1b09a3ef477", "value": "T12793A64D3E319F7EFFA8C63857BB5960A208339622E1D585D17CEA110EA034A346FF95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133802, "uuid": "fa70dfd8-7985-42b8-a4b0-6d7d9d73cf68", "value": "1536:agtmL+zhnIAqg4rziH/E+yqCXYnFz9AalZjijsCmh8JIlW:agQLbRc/JyFYFOalZjijeh8SY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782133802, "uuid": "f726509a-077e-4b2d-9446-efaae09cb9ea", "value": 89152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782133802, "uuid": "ba6a2f6f-75b3-41b5-90a1-dbedc32ca133", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133802, "uuid": "37adffd6-a464-420d-9c2b-67ce8b6869a6", "value": "bed2dc64bf517a17ed16370fdb1f5f35a2e1926f411697ac14a249038a95b57a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15efdd9-6e22-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782123151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782123151, "uuid": "4619b442-8faf-4732-abdd-fc674909b758", "comment": "Malware payload (Mirai)", "value": "cbe6b5f53d007c176ea7b218247a2151", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782123151, "uuid": "7c0608ea-dc18-45ab-906e-f98d80b5e5a7", "comment": "Malware payload (Mirai)", "value": "05992a5d07e866e84fc92fafbe612fbe5981f860f5df88154e3a276d8b164e3e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782123151, "uuid": "92f4021f-f255-4e6a-a359-c88f263ec28f", "comment": "Malware payload (Mirai)", "value": "875dd3a19dde54d283efe59eff700ec9a706f0b9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782123151, "uuid": "f454dc11-15ad-42ad-bcbd-553a3da93135", "comment": "Malware payload (Mirai)", "value": "32739e8fc15aa0e23e67a1dd6369c50cbfac44939d89aacbc5d7ba29ae3fc3e8c0c4e042f52e97f4399759eda3c8a0a7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782123151, "uuid": "8be15106-b7f3-4462-ad68-d26cb5710add", "value": "T1BD33C80AEF914EBBDC6FDD3306A9074630CD944712A43B7A3538D92CB25A54B89F3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782123151, "uuid": "2ca08e8d-2dee-4851-8dbb-9f5968b38b1b", "value": "768:QGXT0E4xJRz7eNSy7L0reooH4IlQwz1bN/3ETZp39kbXiXve4x+iea/Tmgz/I:MiL0rNoHXRh0ZptTGiTTmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782123151, "uuid": "f0aefe36-dfdf-4f4d-b950-251e273eeb73", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782123151, "uuid": "fe5ad333-e74e-4b23-b28d-7f45a15ac968", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782123151, "uuid": "cbd3cef6-e353-4987-9c41-bb4cf3428cf3", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf639f4-6e48-11f1-ae13-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1782139436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139436, "uuid": "5e79279f-c6ab-4b03-93b6-189831529bf5", "comment": "Malware payload (PhantomStealer)", "value": "15d472fd9b877b992377457d136167b7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139436, "uuid": "6b5cd187-277c-4e05-b787-ddd7fffb94f9", "comment": "Malware payload (PhantomStealer)", "value": "05b67b5e047a4270c75d9b78a8ea1fc1f23d6fe634f8df29c6b59bf700ddf577", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139436, "uuid": "c99bf599-b304-4b52-827d-f436318a28f9", "comment": "Malware payload (PhantomStealer)", "value": "db4b3932d900ee4aa0ffd61b1dbdcf9275ed731c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139436, "uuid": "9e77da0f-d74e-4867-a78a-94fdfcecbce9", "comment": "Malware payload (PhantomStealer)", "value": "af84bf140e970c09e9e60d8eac734d8f9ffc10cf08d3b0d3c3b8164d90551cc855297d53933cdd065799558408d9a8d0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139436, "uuid": "78a4070e-88f8-4c8d-ae5f-57caaf8008e5", "value": "T13663744562E0FC8D43F75BFB362F71D5F4DA08DA6984880BE601F8A4F5A5A09EED1630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139436, "uuid": "ededebbb-78bc-4f4c-8755-b897df2c6647", "value": "1536:4qmw1DE+lleSNIpx/kalF/DJt77ndL/CT9:4qmw1DE+lcntRNO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782139436, "uuid": "513e82be-2000-4e82-92be-af8ddc2d32d1", "value": 72997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782139436, "uuid": "2c93076e-d1d8-4933-84fe-4396ac68419a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139436, "uuid": "7e819a34-bd66-4dc2-aedd-2f3bcec2a634", "value": "crypted (4).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc625f8d-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141611, "uuid": "015b367a-fff6-423f-8948-20d9ab723f9f", "comment": "Malware payload (AgentTesla)", "value": "61a415f9d36dc6cd672cbf06560a24c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141611, "uuid": "0e80e3ad-70cc-4a90-8bbb-359f99968084", "comment": "Malware payload (AgentTesla)", "value": "05c491f3252964d79d46b630f3a39478d2f530d513a7353371b6e40d5aba46a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141611, "uuid": "adf3cf1f-65ba-41d2-addd-5dd5cb15dff6", "comment": "Malware payload (AgentTesla)", "value": "332da4f5cfa9fd073fc024049e60a11ab413c4ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141611, "uuid": "481a7ec2-0b8c-4a1a-97ea-42b1f42c62a2", "comment": "Malware payload (AgentTesla)", "value": "ae4690fcde00e47cc10a0dcbfc282c7c4f4c607b8ebb3e4e656e72483fc742728cbb941d6ee929845f117dc3147e71be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141611, "uuid": "19791bdf-c470-4a33-8a76-1dd32195a16d", "value": "T1C6F518811790E1727721EBAD923BEE70A44F605314D9CF44301EE328BA6CD4B6799EE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141611, "uuid": "e749c6e3-39a8-48ff-8c8c-00f86b1bfc0d", "value": "98304:3oqYFzHZOupBXO+ISnhl477uSQrWLH/YJBU+LQcZhuSS9rnHzMhtHo2:3s7ZOup8+IShS7uNG/YJBU+PZwSwrnHe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141611, "uuid": "ab04f09a-cd08-409c-a080-29b7fb4a58de", "value": 3321761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141611, "uuid": "9ecb0fff-cf4e-4e76-8c06-d355d0c16bee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141611, "uuid": "d65af3a2-aeef-46ce-926a-689a4a449a06", "value": "FACTURA 0027560.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796fa580-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141874, "uuid": "b6e29b7d-4516-47d2-8866-ea8a327b63a5", "comment": "Malware payload (RemcosRAT)", "value": "31805d48c700d38647844a9ee06df760", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141874, "uuid": "8e215654-064b-492f-9cdc-ddcf8727a5a6", "comment": "Malware payload (RemcosRAT)", "value": "05f635babcfecd234ec89193ccf34b4f892e7a07730ed09730443e9abd95a655", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141874, "uuid": "e4f0f484-bfef-4d83-b127-b854f81712f9", "comment": "Malware payload (RemcosRAT)", "value": "f2d4134740921a439b4b3cc4ffb75a484a0f1815", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141874, "uuid": "578ad278-8ee7-4aeb-abf1-7ff78985ff43", "comment": "Malware payload (RemcosRAT)", "value": "568831153895a9886d7fb53cea62d97c50a0193d1f73891e5093c44066b1466300ed659b5a4a62f7f6bac042672537f8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141874, "uuid": "82d792cc-6d8a-43d2-ba0f-71842764b66d", "value": "T1D73629912760A13B7B51C79D6237EF74A44F601318DACF14311EE228B94DC5BA3A8AF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141874, "uuid": "7fccf066-161f-4a51-80d7-1ec607fd59c7", "value": "98304:pXFWi5noCdzy3Z744TNVDeHjaRP4t4NP665bTNIkxOHw4Wz5yC+zgIc8ZwM3vCzp:JMYg44rDidA5IKOXWz5qzk8qQvdP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141874, "uuid": "82cd2885-e175-4d03-9b47-c61bd8401297", "value": 5186958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141874, "uuid": "b587bb8d-97c8-431f-9859-b392e1894362", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141874, "uuid": "1dd8bd94-4343-427d-837d-c2a4d5128b0d", "value": "Purchase Order.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e2eff1-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1782115319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115319, "uuid": "bae04704-b289-49ca-82a4-66d42771850f", "comment": "Malware payload (LummaStealer)", "value": "ba3281bb9c624619a22b1e506f23fe46", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115319, "uuid": "b74c7f8e-174e-402f-8e6c-7747ceac8542", "comment": "Malware payload (LummaStealer)", "value": "060618b911a7022394c88e195aa477157d366363f76ed4b86f0cc3b635908cc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115319, "uuid": "147d58e4-5bec-4709-860b-0d4b2ce4c318", "comment": "Malware payload (LummaStealer)", "value": "b8cb9a47c68bf67ccd8d7a2769d32501f9aed4fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115319, "uuid": "f2fde877-1f31-4261-be8a-4c554bd3f027", "comment": "Malware payload (LummaStealer)", "value": "57804b77063ed498f12af71a63574c9c8d08087f413552c2b26200780168bd6ed198624b10bc9563e6f75ee6b66f37a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115319, "uuid": "f95f2424-f686-4155-becf-10a28506ab20", "value": "T191E57B00FDC715FAE503167249ABA2AF27399D050B36DB97EA403A79FD776D60832309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115319, "uuid": "08807eff-bdc4-41ea-aa84-c56b7fab3a0e", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115319, "uuid": "9a66af34-1f38-4781-ba47-768a631d8e91", "value": "49152:3ZU4XpvlafwBkjukodZRB5+gkbs/+k53/8:pXXpvlafwBgQB5hP/Hm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115319, "uuid": "63816bd0-6b4d-4b99-973c-2e7b96326be7", "value": 3120464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115319, "uuid": "5acf2d3a-c0f9-4aa3-872c-c5cdc60b0f39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115319, "uuid": "e9d96871-9064-47dd-b50c-46902ef32806", "value": "ba3281bb9c624619a22b1e506f23fe46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad922195-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1782141962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141962, "uuid": "6317af4d-f938-4bec-a798-8cdc738d5a04", "comment": "Malware payload (XWorm)", "value": "7dbe080cd3266a0aff07f1af5ee0a85a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141962, "uuid": "0c2e7bf0-cdce-4d4c-b453-0b8ed7b9de93", "comment": "Malware payload (XWorm)", "value": "06316914d40365bcd7a60ccd3268411f4b79ba14bef8fd1bd713fbb65fedf115", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141962, "uuid": "5ef09bc9-e248-478b-b490-ac9e11e9c870", "comment": "Malware payload (XWorm)", "value": "56df8271d0862862056d13db1e4c34304fcee1b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141962, "uuid": "11ab1ab2-d049-4468-a56f-75564016b06c", "comment": "Malware payload (XWorm)", "value": "db785a5ce5b26fe532b503112ead171d80409461e904306b2dade7c691be87736d0fb6319443a987441586fb02c2cb03", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141962, "uuid": "bbce4ad0-a62a-4f9e-81a0-f764ca5a52d9", "value": "T145E5D7608620A53D686DC32ED03BBF74544E140324BDDF5D3A3AA359B942F8B179E8E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141962, "uuid": "86af65b9-694e-4a29-a1de-f4b089cd77b7", "value": "49152:Y3zjUTftRgaXSQ48p6PE5U5Fn3EsAuNin2e4rx3VS7xzGUOLOeUNPg:Y3zj2fjgaXSw685U5Fn3EsAuNin2e4rT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141962, "uuid": "d998c1be-3fbf-4958-8912-9f9db3d9d9bc", "value": 3026096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141962, "uuid": "35c84c78-b18d-4cbe-9821-91d9dc3d5feb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141962, "uuid": "38373581-0c81-41fc-9171-b624378bc968", "value": "GTU YTDD RFQ - spec _ pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88c3f1d2-6e3b-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782133740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133740, "uuid": "b092a075-fb12-4af0-bb5b-a390a47f1dd0", "comment": "Malware payload (Mirai)", "value": "19d3a16a9f4af2d757ea5713d663ab18", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133740, "uuid": "8ac07f85-70e8-4c59-891d-672d390c2bec", "comment": "Malware payload (Mirai)", "value": "06f8f80d7a6c9ba13bc7dd02f97c2c662e11f5bf342161bb9293500a89c7eada", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133740, "uuid": "4130645b-afe2-4f0d-9519-c80741e05c8f", "comment": "Malware payload (Mirai)", "value": "d3b303bd145176cadbb0b44f9ee17d3c44cfce8e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133740, "uuid": "3e2bff2e-e17f-47db-b4fe-b643a82de192", "comment": "Malware payload (Mirai)", "value": "bfcef25753a88da1e85450bd15a093aea2d9271070985a7833ec4dfbc476e3845eef0ff307f9d6a76df9328b56c14db5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133740, "uuid": "efab94a8-f215-49f3-a6ce-5d3d4dd45af0", "value": "T1A1D2E0B27BD7293AE461D4767684A83FD48DE066C25AB7CA33CD8E03334852919335C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133740, "uuid": "0526a87b-74ef-4947-a08d-7957796b09c5", "value": "768:UiH+DzrYI3L7sftwzBaPYhg83ZMqi9SrmXBG5DMV:3HSzMIb7WtwTX3ZMqiUmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782133740, "uuid": "9f9ce4e9-e494-4121-914f-f6ea034e2058", "value": 28932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782133740, "uuid": "2a3bd9c5-55b9-481b-b1c3-d0f3f2573479", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133740, "uuid": "f892f9e6-ac29-41ef-b2bc-dd38f2d0afc5", "value": "06f8f80d7a6c9ba13bc7dd02f97c2c662e11f5bf342161bb9293500a89c7eada", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "331eed14-6df5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782103531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103531, "uuid": "05782f9b-b8b4-4f4d-a775-b2a1987b9f98", "comment": "Malware payload (Mirai)", "value": "a8c666895b971ac5d206caf89e5f1ec8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103531, "uuid": "2ee58749-287e-4d22-b581-a410798c68b0", "comment": "Malware payload (Mirai)", "value": "088b936614445d0ef54c838f10b563343efedc68209c482d0155221de613ec18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103531, "uuid": "75b0cc47-3a4e-4e64-9e98-9a05f4dc433d", "comment": "Malware payload (Mirai)", "value": "712034e892b96eba3c73053b8828abff9e6b1283", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103531, "uuid": "6740782b-f965-4359-a255-09f564cfb01c", "comment": "Malware payload (Mirai)", "value": "ff133adbefaa7b528c383357f6636708edb86706f9e38458ba63a2e342731df9affbb33328639d122c07af14e8caf30a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103531, "uuid": "e2c21275-2f67-4d2c-9de6-c85ca98db721", "value": "T100D30816FB210EFBDCABCD374AE91705258C651A22AE7F367934C928F44B15B16E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103531, "uuid": "356a1590-af3c-431f-9856-fab2c99c1f63", "value": "3072:NXj17Jo82I/GFSiPep063os51hERGjPrzz:NXFLOPX8RxERmfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782103531, "uuid": "a8d00f70-1e18-47e3-995f-47d042b7c0e2", "value": 141604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782103531, "uuid": "9ce13e15-b206-4eca-a327-173dc01cba29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103531, "uuid": "f932d60c-ebb3-47df-a6cd-818ac1678de9", "value": "nerv.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd9069b-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141828, "uuid": "e782b4ca-8f1a-432e-b346-b87e9ca0e327", "comment": "Malware payload", "value": "25a400b50f020f1bf150daadb027aaa7", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141828, "uuid": "d4ea19d7-f3fc-4525-93e4-f45801c2c22e", "comment": "Malware payload", "value": "0963740791aa9e823cc8ff8934c1e5973621fe3af2229ff710e3f41ee734b097", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141828, "uuid": "50c3a71c-e72b-4e31-9c2c-d942a33f868f", "comment": "Malware payload", "value": "ed488ef3623f4c2d15d18b2fea366ee77dab3d0b", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141828, "uuid": "985ebe6c-5133-4282-ad9f-d9b3b27b3bbb", "comment": "Malware payload", "value": "3284716fe657936dc1ffad6b182de4932c07df17cfe02e7e71faf3776b029110663fea1ff74c0a76d76c5fa9b5a25934", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141828, "uuid": "583fe4f1-9fdd-4722-b92c-df9bc8ce57dd", "value": "T134B3434127D8E44C13E36B7A361FB1D6F4AB1CDD6E54854BE200F8D0E4B824AEEE56B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141828, "uuid": "a93d0a03-3422-4210-9f5e-4b0b3f7e055b", "value": "3072:CaJK41uVqGTcuWFvGs+Tq9iK8YappH8cV0UuNL:Cs1uVqCcnFvn85mL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141828, "uuid": "9bb0814c-552d-4773-ada4-bc0903f72ddd", "value": 110234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141828, "uuid": "11611713-b010-4ee9-b5ce-2736f43daa99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141828, "uuid": "06a70dcb-e397-4124-a689-8697cbb46eb7", "value": "Yeni sipari\u015f A6J0S3-TR.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77450dab-6e59-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782146595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782146595, "uuid": "0642454a-da08-4cd6-b7a1-83022c2fd2c6", "comment": "Malware payload", "value": "036e88a603cd44e87c990b29d7f50f55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782146595, "uuid": "acd63fa8-ab81-4199-ab06-c0a2b79c4431", "comment": "Malware payload", "value": "09aeddbc97e2bb0c70a226ab41b4457a12630f97e875ba982816e362247255b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782146595, "uuid": "3661a293-6f0a-4cdf-9047-a14eea5d8a0d", "comment": "Malware payload", "value": "17926785bd21485c6d8d5bdca2ca46e8b4bdfd00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782146595, "uuid": "8da94e3b-0960-4fe6-96c7-5332469fbb53", "comment": "Malware payload", "value": "3087b29b3b947ef8fa747b027d21ed0aebd95a8b6e8c584c403bafae3279e9d91a7ecf73532ef8f31700a9ca0916da2c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782146595, "uuid": "736d915f-523b-43dd-8739-b4537c361226", "value": "T1ED041A46F9819B15D5D122BAFE1D528E33231B78E2DF72029D146B347B8B8AF0E3B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782146595, "uuid": "b9f735aa-5258-41a6-93bb-ee10ea79a9af", "value": "3072:fJzy4mO0i8clCiRG3D02Xf5Xmwz2+9zVdFz9ZuSHaMT5qEGC:Ry4mOOcl9G3xXxW22+ZVjpZuSHapE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782146595, "uuid": "eaa50ba5-5079-44a0-b7a9-6b4c6c74d061", "value": 178704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782146595, "uuid": "897f6f7a-f929-4b14-bf3c-ca473d9c5fce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782146595, "uuid": "5329d28b-5556-4076-8303-c6fbb599367d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f19c76a-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1782141508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141508, "uuid": "135222da-8152-47e5-8404-6af33ca1b859", "comment": "Malware payload (PhantomStealer)", "value": "774ca41497a8c16052553bfcab2d0ceb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141508, "uuid": "af3de7f4-d3f2-4d62-a0bd-f6eb9827842a", "comment": "Malware payload (PhantomStealer)", "value": "09c564be2f8f5bf7b36d789215e94124c85adb340ceae9cf818e2912ed6c8a31", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141508, "uuid": "5e0f5be5-ce52-45ef-a683-b2a5f761a6bf", "comment": "Malware payload (PhantomStealer)", "value": "0b0d6abe4b03e22f3cb30f5d8ec343a1519300ac", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141508, "uuid": "4763e0c3-f50e-4b46-b1f1-2c34e0c6bdee", "comment": "Malware payload (PhantomStealer)", "value": "b54aa149ead658d76c40d71617ae78e0a261bb96d386de51bf3a479d4594533ff00342ae673c0cfc552d5c10d48ed9e3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141508, "uuid": "384364b3-dcd9-450f-9567-2796415edc8f", "value": "T10226021189C42FB5CFAC5A1C90FE160EE3E14A8F5416798AEB33FD46AFE7504460B1B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141508, "uuid": "d9128e18-47c2-4427-b2e9-cc1e7c5d051e", "value": "49152:MzwcPf7rpPll05cNZUiETcqyMU87KFaVKUnel6IrzB:U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141508, "uuid": "0353db87-d6b9-4ba6-8457-a910e1da2487", "value": 4626623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141508, "uuid": "5bb1b1ca-8d60-450b-be03-0d8211ec4e0f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141508, "uuid": "9d887d37-ba2a-4567-a420-89a5c3c5e023", "value": "PURCHASE ORDER DOCUMENT23062026.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b534623-6e0f-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782114819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114819, "uuid": "2b344827-b0f9-45a4-81ac-d6a0effff43b", "comment": "Malware payload", "value": "f58d1c43e438fee813e6f127b71dc59f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114819, "uuid": "4f3ef43c-a314-495f-97cb-0d8eecc3dfca", "comment": "Malware payload", "value": "09e064efd096a2bd64a42a50588e5b1f2d057f2c50484440d66841c14ca66741", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114819, "uuid": "9860ea54-1e88-4716-8831-a1f5d5670244", "comment": "Malware payload", "value": "6ec0b3149da7f74a128231c2a86f4cd93ba95e60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114819, "uuid": "aa48a14c-50c5-49c1-989b-2505d0b9dcf4", "comment": "Malware payload", "value": "d93351d13f95e70ab1d5e1afcf9e8a37b87b35a3c8e4cc409108868ba3fcad29df8d42ea0dae7a861bce04a5e48add91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114819, "uuid": "6496ad98-2047-4db8-80e0-115fde93d6ae", "value": "T16B18333B4135E382D3E2DD7421F6227FF261872D57239D8EE24DA0F86BA5348B51885B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114819, "uuid": "8619ad26-8a42-4ab3-beb9-e0851f79d2db", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114819, "uuid": "e7a6b2f5-862b-4776-bb8c-d6abd2a0b82f", "value": "1572864:et9IKPpmTfvrLA8arLJRRWYi4ZRyxMlMcGBc3kdUF91CAnpbOu/77:eUKQTfvQVLrRWH+LlMJBSkGFGAnJOu/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782114819, "uuid": "6ef64db1-c3bb-4d07-8fdf-0abb77d98f6f", "value": 86396916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782114819, "uuid": "364e886a-1a5b-4606-b6e4-73216fcbd786", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114819, "uuid": "1652fd2e-2ca3-441c-87fc-ecca5c4c3a41", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60545e3b-6e4a-11f1-ae13-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782140114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140114, "uuid": "6110a2b3-fa60-41fc-b329-6b406e784b9e", "comment": "Malware payload (ConnectWise)", "value": "2312608a5b3968e154d49629cbb44f4a", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140114, "uuid": "d95a7cb6-050a-44e4-80a4-87fa9e3a1c7b", "comment": "Malware payload (ConnectWise)", "value": "0b3e31bd2e94bb8db8ce5376c431c2912844d3e5f89226abae7ef6407888db59", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140114, "uuid": "55710333-b9e1-42de-8004-6b917559fb7b", "comment": "Malware payload (ConnectWise)", "value": "686d46b27b2434e1aeb24dd67d2e7a1d085e7125", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140114, "uuid": "98786e1f-0b44-4c2a-9418-100c79baa218", "comment": "Malware payload (ConnectWise)", "value": "71b4867d66d054f6847de4bbf1ca5f75fcf875b2128f853242923be584b331f91ed26454fd429b828ec4a4271fd4459e", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140114, "uuid": "f7921cf4-4c4a-4b56-a9ab-a30465454011", "value": "T1F3836C43B5D18876E9720E3118B1D9B45A3F7E110E648EAF7398422E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140114, "uuid": "ef3dc353-2a31-42d6-bc76-c4aced3f7ee1", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140114, "uuid": "f046c3c2-c261-4dfc-9f06-0740657419ef", "value": "1536:CxoG6KpY6Qi3yj2wyq4HwiMO10HVLCJRpsWr6cdaWPBJYYf7QJ:genkyfPAwiMq0RqRfbaWZJYYf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782140114, "uuid": "f87220a8-1ceb-4919-b1da-d5eed9befacb", "value": 83160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782140114, "uuid": "9dc9c744-8d85-482d-b3fd-5e23bf667076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140114, "uuid": "e7f8cc14-5883-4428-98a4-853c106c659d", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e122c5-6e75-11f1-ae13-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1782158599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782158599, "uuid": "aaf90732-42f2-48c9-8df1-57a32a42fafb", "comment": "Malware payload (PureLogsStealer)", "value": "59f36483be922804461e990db2be7805", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782158599, "uuid": "a170da6b-be12-4048-bfb0-f88c6f8a6a71", "comment": "Malware payload (PureLogsStealer)", "value": "0b72a884e9dd5dea37718d7e7a99efbd167b53e24f49bbece1e169645ecc2513", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782158599, "uuid": "8374e7e6-a19d-48d2-b0b9-0898e8c2f451", "comment": "Malware payload (PureLogsStealer)", "value": "e60b3bf80a4360e2777a65a7bea85fcc30753a29", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782158599, "uuid": "be01a4a2-a97f-41a8-ae6a-20c2a3540f60", "comment": "Malware payload (PureLogsStealer)", "value": "ee587132c7c015d14f07d0a805ffeeb01747fa7702c46b2bfedb25c6684dcd2cbe69dc226b513fc7db8809b0fe7f4f07", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782158599, "uuid": "8f4eca59-58c8-4958-912a-7f038f743c81", "value": "T1A246F76203949232B324AFDD1639FD34A40E598755E9DB0036AED729323DC27A3797F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782158599, "uuid": "f7b30246-2e02-4780-a562-c8901af55f51", "value": "98304:XpDaqej+k7Run1I0atCkF8j1b+QQMzsGMARihWXF+EEIZaLvjr/anXN2C3UVef3X:X0jRcn1bUCkF8j1buMzsGMARihWXF+Ev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782158599, "uuid": "85e4d1ac-d014-47f1-8c64-b60827ab56ea", "value": 5630155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782158599, "uuid": "64f89539-b06e-4dee-9e60-30a114fb5bd6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782158599, "uuid": "ae1c75b0-5ede-4d5b-bec5-fa4708cc7e3b", "value": "reatwonderthingswhichgivenbestheartcondition.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e23563d-6dde-11f1-ae13-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1782093644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782093644, "uuid": "867585c3-8b27-4fa1-9349-b83e978137d1", "comment": "Malware payload (SalatStealer)", "value": "72cc8e3d5bb03a4ee445735a529f2e58", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782093644, "uuid": "57ac6a60-2eed-4950-a9ee-cbcfad0a5d3d", "comment": "Malware payload (SalatStealer)", "value": "0b8cae277bf0e3f0f33c5c44e5fd0dac50278086dd5769f9d96c44d748d8a90b", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782093644, "uuid": "f6cc4fb5-63b1-4acf-8dfd-db3f69c039d5", "comment": "Malware payload (SalatStealer)", "value": "951bf64ab8bb44148d29ea2ad3499f706d55e711", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782093644, "uuid": "df0d4fae-61e0-466e-9f11-c06cac437ca4", "comment": "Malware payload (SalatStealer)", "value": "30435fef056587db68d5c6a7ec357bdd716fe87e9f99bcb1564826b604be15482f42d6355dc04101d7225dd714a61650", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782093644, "uuid": "200c31df-c22b-45a1-99d3-5570541c4cbc", "value": "T17606330B695045F9CC858D30C3959776A23274970B251EFB2BF0B0BD7AFA8E15AB2770", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782093644, "uuid": "d0691cfd-80ef-4d04-a950-994f815fc882", "value": "ff8df06a6509fbcb86f708535c6adc45", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782093644, "uuid": "4bf8a498-5ae7-45c5-b4d2-38209b46e60c", "value": "98304:IVVMMrfvgSSg+g5NjyIwf1OyIwZ8FoKHb57:QVMMr15+gPnHTwtK757", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782093644, "uuid": "f3cb22e2-8153-4c3d-af6f-0dda9108f657", "value": 3747840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782093644, "uuid": "558384f6-8d3c-4bae-9ca0-a9c47f4882c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782093644, "uuid": "929d55a4-e3fb-4ac8-a114-69883d7cb2d4", "value": "SynInstallerV2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010ce8ef-6e57-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782145538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145538, "uuid": "6c901793-fe21-4814-9137-3c45780c73e4", "comment": "Malware payload (Mirai)", "value": "2fe3d750709af03393841e535a0c38ef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145538, "uuid": "11aa5865-9e83-4df3-8264-98368b5d7e97", "comment": "Malware payload (Mirai)", "value": "0bc4cf3fed9fd5c474fd5a3cfd4b8b47b3f559942eeecad0066bb507a1e0e25f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145538, "uuid": "134201df-3c0d-4d3a-b9ea-3f4aae05c5da", "comment": "Malware payload (Mirai)", "value": "8e75b2d56b133b2ed15ccd29dd628c113300900e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145538, "uuid": "6eea5208-ae49-4217-957f-17dba0047d4a", "comment": "Malware payload (Mirai)", "value": "5f911f685021965916c175f7a0f4bf48c8a548cfd054fd02ec3455022cd64b3e58e6955f9124143427d0331a76615a1b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145538, "uuid": "7cf924b0-ecb8-4c84-bb03-7fb357d694b7", "value": "T1DC310C9F00106F792257CADE77B33948780CC2FF2C8BD7A499480EA986495C8B5A5BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145538, "uuid": "87e8bd56-51d5-48ad-bd51-b42937add0f3", "value": "12:UHL6HF13Qr6rT0dKwCx6CK7lQC26COEiI6Ei3pC9tDu6EDbi+6iTYlC96ur6CEMN:vT01UEFQ9wTYlC9REMdsJ/Q8TWFf92x2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782145538, "uuid": "c1ce5286-7307-42a1-a26e-9cb5a83b690e", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782145538, "uuid": "d1b7829c-493d-4f8f-a7b3-5aac13b0abd1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145538, "uuid": "fae61468-ef44-4fbe-96c6-049d78b4befe", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f9c2d0-6e22-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782123150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782123150, "uuid": "a4d38368-6e1a-4839-a959-351245c0debc", "comment": "Malware payload (Mirai)", "value": "c0ef74a885964c7ac28291ed92f366d7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782123150, "uuid": "f35f8be1-b723-484b-9e1a-3cbfd664b9c9", "comment": "Malware payload (Mirai)", "value": "0c711259ab729314fb99f4fc2e4d415c5b649b0619c93205a1ad0b027d6a65ac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782123150, "uuid": "3e1e45e6-e936-47e3-ae56-f1aabe7345a5", "comment": "Malware payload (Mirai)", "value": "19fab0785444aba809044d3c98aaf387584ee717", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782123150, "uuid": "6ac90483-5b32-4ffc-9ba4-56474ea65665", "comment": "Malware payload (Mirai)", "value": "f2a676081971f8cfd5c94d2397733336ab34979e079478cde3f5f31fb76b6255849163edb34a75df8b090b40112254fc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782123150, "uuid": "65dc80a5-fc13-4bfa-8e37-bac47b246dcb", "value": "T1AB3396896E329FEDF66C823547B74B20A3A833D522E1DB84E29CD5041F7038D955F7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782123150, "uuid": "5983c562-1b31-470e-adad-0970ca419567", "value": "768:kaYdN/COk+N8w1TwJ8Rr5CwkmPyBFDelQgLUIf:kJHU+yw1TwaRVEpe/LU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782123150, "uuid": "11a6031a-f326-4cb4-b25f-0aa203301d1d", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782123150, "uuid": "8946efb7-c778-4864-b5d1-992693709691", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782123150, "uuid": "31b32dbd-b21f-4c60-bc95-bc7f53cea31c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43e78c2-6de2-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782095587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095587, "uuid": "a106ef74-61ba-4c34-ad99-4ed4e5d995cc", "comment": "Malware payload (Mirai)", "value": "c49410048280d5045bf9b3db7253dd3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095587, "uuid": "bc6c8d9b-fa36-40ec-b059-1c3260d11b24", "comment": "Malware payload (Mirai)", "value": "0d4ecc9f1c7e94da3e93389cc98088fe162a4ef1ba90d54330411fd92ea3ed3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095587, "uuid": "1d7d5688-039d-4cc2-9d02-265a21f2eabc", "comment": "Malware payload (Mirai)", "value": "9db97a15da70e9bb43689fc1199b8d8b457181bc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095587, "uuid": "77a00f53-583f-47ff-8458-af3375495869", "comment": "Malware payload (Mirai)", "value": "d919bd8da309652116c3a34d738b4bfe707d95d221ab080c8f6e49ed1de86487a6a94bc9ced9a253ad1574e553505a4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095587, "uuid": "ffc10349-92de-48f0-ac26-b74d5fd530f7", "value": "T113E2E1D55576A878CEB10D7AFC670B4E2539C6FC86FB10226BF4372423B09AA4BB0452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095587, "uuid": "aaaf44ac-b0fb-43ae-b5f2-0b1a8a1b9d32", "value": "768:q8Lm6COq1fewdHy62pud4yNOYSOyB8LrBf1s9q3UELde:zLJCmjpkcMKUJ11LA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782095587, "uuid": "b1054c99-27fd-4d0e-9beb-28800c448095", "value": 31864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782095587, "uuid": "0f1da360-fc80-43cd-9931-479a1834b9d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095587, "uuid": "d6b0fd1d-fdd5-444e-8a41-3f32207cac73", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20b6f48-6e22-11f1-ae13-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782123152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782123152, "uuid": "2a4af36e-c5ad-4467-b5b1-19ad7c685ea8", "comment": "Malware payload (Gafgyt)", "value": "4faa279fd7f52486da38ae7e588fdc2c", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782123152, "uuid": "d5f28d49-535b-4057-84d9-4dca1c2f4792", "comment": "Malware payload (Gafgyt)", "value": "0db5b34a15acfb0fd656abc18fecabd244b74f09976aaef4038b0ef2a8c45e08", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782123152, "uuid": "405f0f99-af62-43ca-84f4-aa9a2a655747", "comment": "Malware payload (Gafgyt)", "value": "d28f7cf18abff4a066ff3102c765f83727364476", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782123152, "uuid": "cffaf21c-09f3-424a-9011-7cde2aec7f87", "comment": "Malware payload (Gafgyt)", "value": "c5db98c49b0162fcbc5981fb8a5979fb2bdf75c97f58f4bad5aeab25b02775a86c4842065f4db5f192def42c63b71ea6", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782123152, "uuid": "97fe34d6-3e66-42af-9807-7cf0214276e4", "value": "T15AE26B63CD292E1CD99E86B6B5344F3E1B63E615A2471FAF007AC26D8853D8CF9053B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782123152, "uuid": "96dda9ed-b95e-404c-8f7c-a9b6ecdd9b4b", "value": "768:gmZM1zvU2KzWD5aCAoTYAtFCJ+5R+fDLP0I:gmZ2LKzWD0CvTBFCJhLM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782123152, "uuid": "62e4a8ec-2f84-423f-bb3c-70bba8dda0de", "value": 32200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782123152, "uuid": "1c14714b-64e3-483f-ba0a-d6913ca8e54a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782123152, "uuid": "8377c492-f8f9-4674-8b0f-9e7958ee63a0", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2478e4-6e17-11f1-ae13-42010a9c0009", "comment": "Malware payload (Kimsuky)", "timestamp": 1782118446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782118446, "uuid": "cbe6ff0d-c39a-4594-8dd0-50de0682c2d9", "comment": "Malware payload (Kimsuky)", "value": "e092e459bf259a8fc372d152c4a84245", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782118446, "uuid": "953596ba-db9c-4235-8112-85d2f9c594df", "comment": "Malware payload (Kimsuky)", "value": "0efbd18c77479b458078521c18bdad84852b71250122a17cb8105c10d3df38d4", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782118446, "uuid": "e8212eae-b14f-4357-930b-73a9ff01deb0", "comment": "Malware payload (Kimsuky)", "value": "4d9e2af49ebd0e4e490b4e2f85797da9244a16a4", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782118446, "uuid": "a2288cd6-a6be-4ce8-9699-c19818541250", "comment": "Malware payload (Kimsuky)", "value": "c7bde6aae936c5edb6d2e64dd206ceb784c81b418bebfa3b7ef3eb526b81ee5930cbaaf03c3709bb0f8740d417daca30", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "DPRK", "colour": "#B8D77C", "exportable": true, "hide_tag": false }, { "name": "Kimsuky", "colour": "#11A812", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782118446, "uuid": "02b6f6ee-e435-4144-af7a-b05754d2dfdf", "value": "T150627D2A35748727D2080F303BDB90D59F395CD2AD750B0BC19BBB1DA9BA24E5E948D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782118446, "uuid": "d337465c-1fd8-4ee9-a712-c5e45ccaf25f", "value": "192:tGn97B9lPmEVSxFuEbFIqayFnrcUug6M41Q:tGtgEVqFuEJrrtrXZg1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782118446, "uuid": "3841fec7-f287-4166-be14-16801387e564", "value": 15686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782118446, "uuid": "e46ef117-b2cb-40bb-961d-19b14977130e", "value": "application/vnd.ms-htmlhelp", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782118446, "uuid": "75b6440b-a200-4cbd-bcc3-e7c7fba10753", "value": "Review.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8b597c-6e52-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782143465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143465, "uuid": "7f1764fc-8223-435e-827f-6619f63cde6a", "comment": "Malware payload (Mirai)", "value": "e71079204bd480603a24cfd52ed0af27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143465, "uuid": "5a962567-9db6-4f23-b671-8a5361d9debb", "comment": "Malware payload (Mirai)", "value": "0fe15cedd90891bec7a445c68956fc2a5d8cf2eebc6e2238991c96aeaf77b5cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143465, "uuid": "19e2fdae-a4b7-4602-bda0-c483b7cf332d", "comment": "Malware payload (Mirai)", "value": "f44b91fd5b1f78ec2bf462cd928dca6974cbe380", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143465, "uuid": "1be93622-c1a9-4728-8cd9-220b0a8f91e4", "comment": "Malware payload (Mirai)", "value": "a2ac9916e142497168f0cf94d729b0dc9ab7bef1853e3e6034461c4fdf1714a566a614eb7ee34d517759ab0979b352ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143465, "uuid": "3cbe9751-d93d-4322-9d69-4f526ee10a8a", "value": "T1EBF30885FC915B26C6C622BBFB5E428D772A17B8D3EB71038D255B20378A86B0E37541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143465, "uuid": "a5782b20-81ad-4b7e-908f-3854cd53ca88", "value": "1536:3HfrHpr24D4wCEOhF9GyfQc+q8mEKBWHW5zI2T5634Vg6LTf1YaW1254MrLQlheu:XdrJ4wAhMcb8r9KzIR4bL71CS4G3jq+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782143465, "uuid": "efed9e15-dd91-4d08-b4bc-768fc39d297f", "value": 162316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782143465, "uuid": "131efe5d-1d27-4ac7-8ed7-d728cd95eaf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143465, "uuid": "0febcb4c-ae35-4659-a3ca-25ee92618473", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90bfca0f-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1782141914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141914, "uuid": "00af3f89-1012-4659-b8e5-40970c7ef7e9", "comment": "Malware payload (AsyncRAT)", "value": "069aae98c613a3efad4d84d4d7bddd78", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141914, "uuid": "1f0350a9-b77c-4a14-bf02-8b9ee87cd799", "comment": "Malware payload (AsyncRAT)", "value": "10e2ae86cdd60ba9851b6e2bd676a3621f404c217baf00a7d6a74d976e6808e0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141914, "uuid": "2ee3b9da-610e-46da-8b20-f893fe7b59f2", "comment": "Malware payload (AsyncRAT)", "value": "1e750a9375cdf65106508eb48f0e54e9874932fe", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141914, "uuid": "3d0dfc79-77e8-4f5c-8fb3-e435385aac9a", "comment": "Malware payload (AsyncRAT)", "value": "ea45e22f278de1d662ce2c7f0c0d605e7cdf585a5b38f847f3183f2b7e9f3f203530fd6531980442932448b24a26be97", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141914, "uuid": "3a095aa3-97a9-4c7d-bfaa-ad0af49cd9db", "value": "T1F874AD802BC079C4175BAF3E723BB1D9E05A0CDE79C4564BE321FCA6F966606B6D1234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141914, "uuid": "45727afb-875e-4e68-8183-4375cc1c2cb7", "value": "6144:VK67A9R+oAp0u2rujiH+CK7+EdKqtQuAswUUDCniMUK9jWoh5:VKeA9RAC1zH+xvRQe3VniHuKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141914, "uuid": "e3a50582-47c6-48f7-8a0e-931ff872ae01", "value": 346336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141914, "uuid": "97a25e0b-7342-4d39-b334-78528aad0f22", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141914, "uuid": "13ef2b4d-625b-4929-8562-aba245980b30", "value": "Components _Spare_Parts.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb799d53-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141663, "uuid": "05979baa-51c0-43f7-b45f-f7ed24721dc2", "comment": "Malware payload", "value": "7ee2a747ae81a0d39a3b78e4e52873b0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141663, "uuid": "4d862251-8730-4f84-a7a7-1dd1474c2f33", "comment": "Malware payload", "value": "1127b44dacdac4cec9a6be99d7e5e78c34a1a184e98264322b07da37f6355345", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141663, "uuid": "69a59c44-611e-474a-ba80-0d57d215ef74", "comment": "Malware payload", "value": "16be315e656edc2ddfd6940ebc6c3fba01fc47e3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141663, "uuid": "2fefec43-f653-4107-8004-83ac4bb81b8f", "comment": "Malware payload", "value": "74ad7625de7562915fcd7bc6ae6fe7cadd0ccd71ece645d34ca35fe8bdab91db4ff6242fc9e8c67cbd128c8c67e589f1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141663, "uuid": "3c9ad8d6-a75b-4ff5-97ed-227e248b6ef3", "value": "T1929522199B07C27B8C94DE4A55813B53895E5A3B23EF2BE5EDF82ECE07439607430D68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141663, "uuid": "57dbc6ea-1e3a-4394-ab43-e66fc7ef24c8", "value": "3072:SGL81M5mv9uVyVJyjREFFNaLkkxB5jjYp4lmuyzS14CY3Si//FsP+wVnA/UIEnyj:ifreOv//FltN2S8bgym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141663, "uuid": "630ab4f7-4988-416b-b637-f358df33fd10", "value": 1900678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141663, "uuid": "d6052c60-5506-42a4-b0d3-8115d70428b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141663, "uuid": "97942b36-d3e2-486e-b140-bb28121d3c9b", "value": "SCANDOC192.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9433cba9-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782115291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115291, "uuid": "4527cbd8-0cb1-4f4b-90cb-93e765d35a95", "comment": "Malware payload", "value": "69418a861a4b3b941bea525095313011", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115291, "uuid": "bad44958-602d-45a0-9cf1-f57607316a2a", "comment": "Malware payload", "value": "11c8ef600cbf4ca6d53fa8d3b2b74c033471d91bf469f53bc59b522f1c6152e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115291, "uuid": "fdbc2292-6558-4c4b-b2ac-3d3c446377ab", "comment": "Malware payload", "value": "2e25d8e03b8584e8f152263257139f42e0b7992a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115291, "uuid": "176d6e5c-c224-4d2b-9af3-a0a1cebc74b4", "comment": "Malware payload", "value": "c21cb57e2ffd0f9b4b856eea2855c78c6a3c0c638df5ce9c9f4650527d15f421003ee86bd1b749fde4886f6e4d61d6c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115291, "uuid": "c6234eac-df76-4203-a8de-d59f7ffa125e", "value": "T11717335067E018BBDAF65A7AC036E16891A2B4124B81C1EF5BFCD31A5F6B6E03D3CD05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115291, "uuid": "e70acdcc-4c9c-4104-a864-982a85bc8bef", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115291, "uuid": "86e29cd0-cdb7-49fc-b28c-452b396af67c", "value": "393216:785vzasFl7dCR1C99OXr8Lg5lQbZklOIl2lInEroX314S2kIn8vaxbc50BcPmT1m:I5vzJFlUR1OOb8aQQLErUqkWMaxA50By", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115291, "uuid": "d964625d-1c9b-442c-9b6b-653c4b65eccd", "value": 19291319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115291, "uuid": "790dd90a-c0f5-4f37-9b8f-4dd3ef2e65fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115291, "uuid": "b779f5b8-0ff3-49df-a6ed-4bfad378c3b6", "value": "69418a861a4b3b941bea525095313011", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "882748ef-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1782115270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115270, "uuid": "37dc2af2-28cb-49dc-b4f6-86b3391dbb1c", "comment": "Malware payload (PhantomStealer)", "value": "059288a7f75595dbbdb7712e9c493fea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115270, "uuid": "1c1d0fdb-789d-4779-a5b3-47b48e853fd2", "comment": "Malware payload (PhantomStealer)", "value": "1277eba7151e5cd202713bd63622050f291a3448289f1ee636d49c42ee9ed1e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115270, "uuid": "55f6eac4-0ffd-4836-a789-8414e9b81e84", "comment": "Malware payload (PhantomStealer)", "value": "f2171ec69a8cb8711dcecae2dbb16a956fd1af8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115270, "uuid": "75c2bfe5-c3da-4763-b5dd-917890a26ad7", "comment": "Malware payload (PhantomStealer)", "value": "966bee09eb8225839bc05a3d0dd1c42457157e4dfc103e7a9be6838d33b43c5b26dafdd648836dd35474c81004538692", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115270, "uuid": "ecaddf02-7aec-45da-a391-3c504ce900dc", "value": "T1B865225C470AC42BD540277C1EB1F5B42B289FA9B811E6631FECFEAB7825A540D487E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115270, "uuid": "25b17703-e63b-4678-b7b2-10393476f720", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115270, "uuid": "f0c725b1-cf7f-431e-857f-423f9457e2e1", "value": "24576:zT6NKx20djlDcAuO5QvSDc2iJfOk4B4I6siVanZulO8atG04DVmb3ez:RvdpDHYQcRJfl4CIKaQc8aQ04sbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115270, "uuid": "eec0877b-2536-46de-818a-6b21d5e16e2c", "value": 1526784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115270, "uuid": "02e0daba-8414-4ecf-9f9c-15628f69dab4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115270, "uuid": "00594b1b-1279-4b0e-89a1-04afedc230ce", "value": "4NTAEZRucHI0QET.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b5ec91-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141781, "uuid": "797172dc-2e54-4b71-899a-2a23a6d95b10", "comment": "Malware payload (AgentTesla)", "value": "e9b9c32602aaecc89225cbebbe78b340", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141781, "uuid": "3ca88e42-041a-4df3-9e77-cd227482bef6", "comment": "Malware payload (AgentTesla)", "value": "12a0143bf4da5fdd8277f8f51dc6c5414b3cca94e58a00fef70ae07abe5cca8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141781, "uuid": "f38dda37-fd2c-476c-8192-06b5431f975d", "comment": "Malware payload (AgentTesla)", "value": "695b971b4e65a14fa55ca6f0dab87015ab3287a7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141781, "uuid": "89197fa8-e018-420a-a39c-3c2eb5900562", "comment": "Malware payload (AgentTesla)", "value": "18c54ca696fe5966be6c12ee86db7fa1e6da707cac088a4d689848cdace1575a9a79bd5aefab5059f66a6d02da2db74c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141781, "uuid": "e56d18be-aa4d-42e3-94ff-d937b350de01", "value": "T1A9F268364D39BA340851505BE9448CD5A9BCC90DBB7342AFFACA8137AB294DC04EED73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141781, "uuid": "e7ef9d40-e34a-4049-a589-4424cbfb76c4", "value": "768:FJIC6u18cPKRF+E754dbnM/v4XYujBlFQcrAI:FJIC6u18cPKRF+E754dbnM/v4XYujBlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141781, "uuid": "d26137f9-faa8-43bb-b50a-4dadaad832d9", "value": 37073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141781, "uuid": "73d4868b-be0f-4d45-8994-4667aa9f2606", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141781, "uuid": "eb9d430c-ffd7-46e3-800a-91240d27a6c6", "value": "Nowe zam\u00f3wienie PO-2087441006.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac91541-6e3b-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782133824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133824, "uuid": "73864065-f556-42a4-864d-353fa497a92e", "comment": "Malware payload (Mirai)", "value": "46e918867e788cda8656a8388762816d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133824, "uuid": "f8da1143-8e18-4219-a2b0-af75476c4c5b", "comment": "Malware payload (Mirai)", "value": "12ac6aee3f7bf1f492edf716382ba926b6ed684214b8c33afd06441c71ce2a91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133824, "uuid": "4ceed6c2-bff7-43cf-b527-76c6791ace10", "comment": "Malware payload (Mirai)", "value": "b1dbd739078a974d168e23cdb9a9f1dff3cf2c0a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133824, "uuid": "805c989c-330a-4563-b9a5-a40c6d480d8c", "comment": "Malware payload (Mirai)", "value": "52ac633323ef5d180709311f4db2365207945290e709e42fbd8862fbd97b9d466b6f19d7a2e8451ab0403b21f2d63f95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133824, "uuid": "b6051643-b2cf-4bb7-a7ee-02ff05055221", "value": "T1C963F684F5CB41F5C517493460EEF33FCA32E57A807196ADEF8A9F32D727A01921225A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133824, "uuid": "04a6c5ea-8edd-4f27-8424-b1d001ac8f30", "value": "1536:oiIu5vb9AumFFekRVwzsYCZl1Nah1yfOxIPxAFcfS:mu5vb9AumFFek/YCZl81yfOGJAFcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782133824, "uuid": "507df84f-ba00-48f6-ae78-c43a6d712124", "value": 71696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782133824, "uuid": "6632b720-61ac-4689-83fb-53ace9d85938", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133824, "uuid": "43e30bbb-2365-4336-8350-070f3b462cdb", "value": "2f25ceebd97d6e43373c0e2bb120208c3e0b8f3b9d840ac5970b47fb39741efd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5655473-6e4a-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782140257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140257, "uuid": "8b153518-2fb7-45a3-8ea0-ab4529e9955f", "comment": "Malware payload (CoinMiner)", "value": "0c4f98399c7d35ad1158f92ee7043b3b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140257, "uuid": "4a69173c-c9f6-4b57-bd62-8e115b261962", "comment": "Malware payload (CoinMiner)", "value": "12b90ddb368ab4ffcc98171a59b8a19a07aeb6017b3ec08a06b3b1eecdd9fdd4", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140257, "uuid": "0fe7e003-29e5-4456-9b83-04b227768b0a", "comment": "Malware payload (CoinMiner)", "value": "08f68b73d628e543ead4fc92ef9c0fdb37b8acfb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140257, "uuid": "dd8e3fc8-5faf-4a3c-95cf-cc6f0e47b9f1", "comment": "Malware payload (CoinMiner)", "value": "6b865592a5638aa2c03deb3f240e31ac99a955c6adb791d4b57ce15dc0e0487ceccc12e6dc054c7902b600e4eedb1f0e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140257, "uuid": "bc946b4a-c8b9-450f-8714-068f19c79f6d", "value": "T1B457335B8D34F39AE2BF1375BE90B6B8CA1C25625F31D8EEA058DD152C2214D813BC97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140257, "uuid": "db395a2a-9775-4929-baae-94f9a1706ede", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140257, "uuid": "bb1f9d12-09fb-45f7-b47e-b982d434c862", "value": "786432:WxpZicOvGVjmo4JjiUGjw+yvUMPzqqFp9B+q0kox:epHO+VS9Gnjw3sdqf91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782140257, "uuid": "93b06d88-8bc7-4d06-a66f-e2b96fc9b231", "value": 27507200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782140257, "uuid": "c98ca457-23ad-42d9-adf2-2d78fff5da53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140257, "uuid": "d19a5965-4a58-48fe-afb4-550c18c445a9", "value": "BLAZE FREE INTERNAL Cracked.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df68087-6e11-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782115548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115548, "uuid": "684aaf6d-5867-4024-9c62-7316b9d186a1", "comment": "Malware payload", "value": "c0e72473f2bb0faceb2040fb5a920f48", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115548, "uuid": "45c187b7-8336-4e50-b705-5eb2ab1ca55d", "comment": "Malware payload", "value": "12fb847aa77c71c499314a222b77cd97a6e6faa9e9f717c414a432562b6ae8e7", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115548, "uuid": "bf4bd384-6cfc-40cc-89f9-f6273b7bd078", "comment": "Malware payload", "value": "8f4c70c5c4f35c4cba83302e11b2d9a1b62201f4", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115548, "uuid": "a789354d-f9fb-4ace-8b70-0f4424d484c0", "comment": "Malware payload", "value": "9fcc5b1d7aea749ad71a79f914388133ce0805deedaa402e074c635efb5dd34cab5b19dcf5af50b7a59463662131d20e", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115548, "uuid": "5f132a96-6423-4031-bd5e-6779f8386193", "value": "T1C7B601C9A71305F4C389863485E78E272EE36C0016E8254B5779A31DBFB22F55AB1FD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115548, "uuid": "bcb2bf84-68c0-45a1-a26f-84f3f46bdd92", "value": "98304:IhP9PVFN0oRQB898jOJvNOLWlGX/guMFSlcG+iaG+bFK7KP5qyBgkT4QH2B57WAa:gfFGGf21YuMFOcVinmxqydT4QAR1y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115548, "uuid": "adae9e24-f78c-4c5e-8e5c-366a3efc0810", "value": 10878976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115548, "uuid": "f3d63efa-0e37-42e2-8dd2-8c7e09c7d277", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115548, "uuid": "3a049ad2-f326-4e31-ae96-98a846a30eeb", "value": "WebWare_Edition.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41d348e-6de7-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782097842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097842, "uuid": "9220165c-76d9-46b5-8563-e71326d61bb8", "comment": "Malware payload (Mirai)", "value": "469e50f1396e689ba2be532bc207868d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097842, "uuid": "4bd3292f-90c8-4785-b2a4-c2b64096121e", "comment": "Malware payload (Mirai)", "value": "135984a39fef8cc561b56a3331c9217ac30617a6dce97840519bad571e6c433e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097842, "uuid": "efc70f6b-3e26-4a20-84f1-f74bac580696", "comment": "Malware payload (Mirai)", "value": "d426fe2d1bfe5d6ead86618d40d4b27c8e3dc22f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097842, "uuid": "6b4fcd88-28a8-455b-951a-a279e7a61760", "comment": "Malware payload (Mirai)", "value": "fe9bb125e2f9fcd6c7d5c007098a0d0b2f3fb2cd95e049269b483513d80e4ada899d9d7b2cc8174cefd66c0f409d64fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097842, "uuid": "86b891a5-08c4-4079-a6c4-739c60818517", "value": "T15F732A26B97A1E26C0D4B57E60FB8B11F6E1278E26B4C50A7D720E5EEF147006502AF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097842, "uuid": "017587da-cd08-49ee-a796-7715c9afd978", "value": "1536:hD/B6f6UD5hAS7mo0DCCAXpSKV6v3G78nN9WQ:927jqCt8v3GI/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782097842, "uuid": "43c74030-3d33-41a9-a0dc-41c018449e70", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782097842, "uuid": "21c50e65-2f21-4bee-9d91-b9afdf56b8c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097842, "uuid": "7dd57a3f-dc76-4faa-b15f-9409f16f76a4", "value": "sora.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ca5ec0d-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782115170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115170, "uuid": "b8e68151-fa4a-4b66-b65f-b62a141f3022", "comment": "Malware payload (Vidar)", "value": "91cd5d939a7d25a4a9ef90e41066e3e1", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115170, "uuid": "46c38b3a-5485-4c32-8109-47babd47baba", "comment": "Malware payload (Vidar)", "value": "15d1a76ada779d4de1899f494bbccdd9edbd29f0f7ee739267bd93de997360a1", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115170, "uuid": "76114565-7319-43f2-a94c-59f38e7a66ca", "comment": "Malware payload (Vidar)", "value": "77d6bcb08bdff6f9617a2d52836bf6f7b78a8a2e", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115170, "uuid": "6403492a-4faf-4ced-bee5-56a2e2b8169b", "comment": "Malware payload (Vidar)", "value": "c2fd6fcc780c1dded2303e5cb5af9b6afa07136a7191d214041ae45767a858942c8832188c51fe782242ed8c3b30eab6", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115170, "uuid": "91e0b7f3-a31a-427c-a589-ba931ca716e7", "value": "T1F3B523C3C6C11D86CDD558386C7B8F701B21D8AAF812CA638F72A66E9FD73948C1A15D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115170, "uuid": "802b97b5-d69d-49fc-8184-a89907f5903f", "value": "49152:eQxDr4msfW7J0LgFCLZ5UqT4Kaaie/M6dJb5D:eQx34i7KuuT4Kaah/M6d3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115170, "uuid": "065346a6-f6ac-4d39-9a01-5862502b28ed", "value": 2438998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115170, "uuid": "b52b4b0f-5dd3-444f-ad49-5e97b81c9df0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115170, "uuid": "859496ad-2877-43ab-a49e-a116bcbb50a1", "value": "Launcher.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbf91aa0-6dfe-11f1-ae13-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1782107734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782107734, "uuid": "a7383e3b-10ff-45ab-9de1-0d3558646c5d", "comment": "Malware payload (GuLoader)", "value": "83c0f168151d8428d6bdd3fa7d47e9c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782107734, "uuid": "564c126f-644b-4fa8-8b27-40ac4df00fcf", "comment": "Malware payload (GuLoader)", "value": "166e0b889d42908d544d47be2a2131793b150ea2f3f93ddd7e58669fd99586f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782107734, "uuid": "8f0aef43-df13-4812-813b-0f4b41688085", "comment": "Malware payload (GuLoader)", "value": "baae95ec91d4834de956d969cf41ca5ee833d737", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782107734, "uuid": "4e039934-b67a-4fec-9999-53573d919da2", "comment": "Malware payload (GuLoader)", "value": "4f3adcdc8ec9107e7b12299512da3dabdee74a37cc752910ae3a3bc584e78a5f76ffa2a3dd913a6f11028a9bb123706f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782107734, "uuid": "76bf9db8-5a2d-46d9-83c0-10fadcba2557", "value": "T11D341211B6D0D55BDDE3933038BAAD721AB27B9947EA1D43A3505A403FD3780462F3A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782107734, "uuid": "3c4871b8-1ac7-4245-bb71-e4b7a8340c28", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782107734, "uuid": "8ede04d9-a016-4e48-aae8-bdd297d71a11", "value": "6144:nfY+onP0DXqtllGNCgx0y5c2ZgKAmaYxokhJS1X9qrwc:nfYgXSloNbzFompZhJSZ43", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782107734, "uuid": "2eaa1859-235f-437d-a25b-f8040030e808", "value": 246728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782107734, "uuid": "5ad09a99-4911-4ead-b8f9-2d4e6856787d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782107734, "uuid": "d487f58a-87ed-418e-a556-42d1c1ede278", "value": "2026 New Order_001122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6279da7a-6e48-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782139259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139259, "uuid": "042d311c-03f3-4b4f-9b11-d50d9847f285", "comment": "Malware payload", "value": "1688a855869a249114084ae11f82fd8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139259, "uuid": "2d6daa8a-447b-4407-b448-6dbe7eb40801", "comment": "Malware payload", "value": "16de32e17a14655141f063827249f1f8eda41d1f06b1df399e5a8cae08db6555", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139259, "uuid": "db8c3b29-87d2-400f-9801-f4811384eafe", "comment": "Malware payload", "value": "476b43568053d086ce5c4917201ee02d2e421637", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139259, "uuid": "4692f197-e666-4415-bbc1-c86e3ec3bb26", "comment": "Malware payload", "value": "636e760d360c7db887a49bd71ae4d300d07b09a0375a7dd5de530d91390ea9934b25bafd7e290dfa071635dff40c9a91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139259, "uuid": "9415f80c-ec8b-40bc-a438-272a2122c562", "value": "T14D858E47B2B500FCD06BC178C9566907EBB2B80613749BDB16D086A66F33EE15A7E334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139259, "uuid": "12764112-902c-41b4-995a-b73e67c36de3", "value": "67e5d0850f40f9e0c0c28f32970a4a32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139259, "uuid": "e73da0af-5c70-47ed-b9d8-6655f3c3c98e", "value": "24576:7eRXxoS6XnsPll7EOcBKpOZaFpqQk8ZKMcMqaVD2RJP/kpsTNB0e96WTqoUvWds:MiX8zE7ZmqQa81ckpsBB39nVUOi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782139259, "uuid": "f62e016d-3f3b-43bb-9084-60c2a83c387e", "value": 1721856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782139259, "uuid": "894fae03-e1f4-43a8-a4b5-bf2d10a0df40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139259, "uuid": "ec11efc5-dbb1-4a77-8d83-f49b439a0704", "value": "1688a855869a249114084ae11f82fd8e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84cf10f2-6e29-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782126002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782126002, "uuid": "961e24d3-64dd-4897-a59d-e63c87ce4fe3", "comment": "Malware payload (Mirai)", "value": "64792c4715f296682aa86f11c70064fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782126002, "uuid": "f685085d-67d5-46d9-8e5f-79bfb6330370", "comment": "Malware payload (Mirai)", "value": "183aa37a52def14427670f3934b74f7a0cbddc64f5cf2f98a9eba2da1d2b86b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782126002, "uuid": "ec003868-954b-4416-b5d4-d4ef79f0d9ee", "comment": "Malware payload (Mirai)", "value": "3ffb48c5669f2fc9941514fd6e6efc06ea85f869", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782126002, "uuid": "e7502304-ff78-4e37-9870-2dabcc9a3826", "comment": "Malware payload (Mirai)", "value": "99bf199ce159e1fe39ca23e2f676846c3561fc46f67ae618380728e10058f1311e1f6548d6e96fc50690f29e963adb71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782126002, "uuid": "18abe99b-6659-4cfc-a607-f568d6f04d9f", "value": "T192C30A09BF601DBBD81FCD3709E90A4239CC965762953B753578DB1CBB4A94B0AE3CA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782126002, "uuid": "263005de-c755-4067-9273-3eabdcb452fc", "value": "1536:KAXFkQZtZiXIqaEMDkws4hm+6Dt5I/8g2UcJGrqnhk0QMvkJasdzcJAa:KckCtZiX85w8/wUehlKWAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782126002, "uuid": "7da28446-9c79-41f7-ad8d-0f774302558b", "value": 122120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782126002, "uuid": "2727bc61-6f1d-4480-9ac3-c5273e68415b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782126002, "uuid": "bdfc3470-085b-4834-83ee-197b712e5508", "value": "rH4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1751e6c6-6e52-11f1-ae13-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782143428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143428, "uuid": "d6659509-c21c-4408-a7cd-281fe87fd28d", "comment": "Malware payload (ValleyRAT)", "value": "c3d6b73e54ff4efd29651e46f751fe5b", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143428, "uuid": "bac2db81-031b-4895-b72f-be8bcdcddaa3", "comment": "Malware payload (ValleyRAT)", "value": "1859950b3f410ae37bf115ab107917f6af6313a598f76ddbb0225d9cc85518a5", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143428, "uuid": "bbadb070-ed58-4a2b-b31c-72e2330ef98a", "comment": "Malware payload (ValleyRAT)", "value": "a4358deca3180c3864cd4030d9ac3eea5634a7b3", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143428, "uuid": "797febfd-23c6-436f-a247-428bb90d6568", "comment": "Malware payload (ValleyRAT)", "value": "1d3da1024545cd273c8d432ca80207643cfba47d018ce93f34fdd265b42939f5640292d399d23605332b2fe8b587d513", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143428, "uuid": "dc0d6390-b3e9-4e25-ab83-83e29482e15d", "value": "T117457D47B3B801ADD0A7C178C927570BEBB1744513649BEB469086AE6F23FE116BE324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143428, "uuid": "3c6ca96f-9189-491a-80e5-648f0fd24f3d", "value": "ae9b317f257f74d6e6aeb5209030410d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143428, "uuid": "784bfeb3-5ead-4bcd-91db-217a8092a254", "value": "24576:ZxOmhbPt4M/eTGtckjzy7Buz8NQksDi31:Gys6ki8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782143428, "uuid": "f067572b-1900-4c34-b83e-f54371617356", "value": 1180160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782143428, "uuid": "5948067e-0942-4e83-a7f9-ac04ba5d12fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143428, "uuid": "1382e6c8-9793-4f58-a702-2656071f5343", "value": "vtksqlite-9.6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10291d34-6dd1-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782088011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782088011, "uuid": "1ec5db98-0221-49fb-b7fe-2956deff9901", "comment": "Malware payload", "value": "376fdb7bf467b3f48fd206bae7e573c9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782088011, "uuid": "86f76bc9-f1d3-45e2-b9df-7137bcaf0381", "comment": "Malware payload", "value": "19d7901717a2bb73ff855bc3e5e652305aa97bd9bb9584ee6efd1b8dc9c5426b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782088011, "uuid": "5a096a04-9688-4635-af3c-8d0b0a08c8d6", "comment": "Malware payload", "value": "1c0561e53024e81e4356590a55fad2c76ff88435", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782088011, "uuid": "c61e2e2d-9789-48c5-89be-c8713997f91e", "comment": "Malware payload", "value": "b8c41c01f6cb06ab98ae48a3bccdfb18ad51e72a4b0275785cfb51b5f0312e32367f1f9430affb7f2dc1fb0174136c17", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782088011, "uuid": "fedb1936-39e3-4dab-a2c0-744d6b7190c5", "value": "T1AED56C07FCE148BAD4AA963189729261BB31BC442F3223D72A90BB783FB77D05935754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782088011, "uuid": "49e71f8c-5de3-4799-a2d8-d5f8b7cdb3cd", "value": "4d791c7ff8a04656c4df23bdb9ebb892", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782088011, "uuid": "57f5ac40-e5e4-44b5-9f78-f5832e6902a1", "value": "24576:UTh0RtDIR0Zv8NbeAwlvguPC1U1Dgl0wCbfUjrAq6PMU49mESBeleDQaFSbla4KZ:UThqJI2v8N6ASNa1EZ1wrAq6PORhji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782088011, "uuid": "aaef2d1e-b38b-44d0-97da-f723ee6170ab", "value": 2757744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782088011, "uuid": "f86698f6-c5d5-40c5-b41e-0d1ac30b6a56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782088011, "uuid": "bbc7a162-648a-463a-9708-87b780870ca7", "value": "gup_util.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3efa6fb2-6e3c-11f1-ae13-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782134045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782134045, "uuid": "9ad4cc04-5a55-4fc0-ac79-2b1586f5cb82", "comment": "Malware payload (WannaCry)", "value": "0a7d93346a2139fac588820c491c49d8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782134045, "uuid": "72697ad3-f1f4-425f-9250-9ada4cb0bc1d", "comment": "Malware payload (WannaCry)", "value": "19ede46effb82553d3c75e9421c58b8b416b0bbcdcb018f8d01131f93fa555eb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782134045, "uuid": "02552ebd-f834-4e1a-9689-4073af6a45ff", "comment": "Malware payload (WannaCry)", "value": "48f2e8d41396e0dddafe6773fef4ef17a977a11b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782134045, "uuid": "bd858c66-2062-4805-a1b7-1cfc82d16b3c", "comment": "Malware payload (WannaCry)", "value": "3abb39340902d6572ec37e69ad5f22946a05d86d9f9ccedea22bee3e8a36d84bb26b7207b66f7e032cd2c83be6514087", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782134045, "uuid": "1a0f4fc0-72bc-45a7-b4fd-f0513ea70cdb", "value": "T125362801D2E53A60DAF26AF6266EDB10433A6E458D5BA66F1221500F0C77F1CDDE6F2C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782134045, "uuid": "b09d88fc-b5ef-4b6a-9f8d-ecfff48abe73", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782134045, "uuid": "b093f471-1b86-45fe-8204-4991edddf47c", "value": "49152:SnAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAZ0vZ6GIk:+DqPoBhz1aRxcSUDk36SAc0B6GIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782134045, "uuid": "658dad96-d28b-46e8-8651-c07b797e6c63", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782134045, "uuid": "702e323b-9f4b-4335-93e7-65263c5bc324", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782134045, "uuid": "038fc14c-181a-46ab-bb53-89c25fe8e114", "value": "0a7d93346a2139fac588820c491c49d8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a53113-6e52-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782143578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143578, "uuid": "d966a246-2a4e-4acb-ba45-4359bb008839", "comment": "Malware payload", "value": "01f6dacb127f0b79c060fd33f9244405", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143578, "uuid": "47668a4f-f1a4-4d43-9f16-24c00c4afcd2", "comment": "Malware payload", "value": "1af67ceea36bff5a3f2b7cbb68072f5293cab80c9c824085ab1fe33ac8dae7f8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143578, "uuid": "3d4fb3a7-ca2a-49b7-8e46-ef2cd5acd75d", "comment": "Malware payload", "value": "4221208c1fd756576f2bb574054e7d87fec215b6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143578, "uuid": "cabc6cab-dc51-4942-a263-ea6e70a01ea6", "comment": "Malware payload", "value": "f3c4dbb450fd8982ff8fc5e2658dfba33d61789079ae244407704d9c8c0ca1ae69c86028c09b6fa7e8acadf88a59ea05", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143578, "uuid": "a24ba036-8c10-42e4-9959-b49671d9f628", "value": "T1A9625157F760C63FD96C4374449B4134B2B6B860F73243173A187A342E127189F2BEAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143578, "uuid": "00977815-52ae-4e55-a20a-6c7bb6ceb36b", "value": "96:RSw+TzzB+B0w/ozrMCtQX/x/j/9gP/voQWK90oiV63Wf:RAnzw2w/bCtQXZ7qP3o+90oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782143578, "uuid": "b2bd741a-3d39-41dc-b702-0ca36d27f464", "value": 14560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782143578, "uuid": "fa4267a4-698b-4851-9f88-53931af845f1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143578, "uuid": "d743882d-18bc-4180-8580-1fa7c3325bb8", "value": "c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884fac33-6e38-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782132450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782132450, "uuid": "ac625ba7-2ffb-4343-a750-85b1a4fcbb30", "comment": "Malware payload (AgentTesla)", "value": "9b76d12f3786d918ffd01eefedd10026", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782132450, "uuid": "c6d94d26-8d38-4fcc-8d1c-de937c09169d", "comment": "Malware payload (AgentTesla)", "value": "1d47d23590a3fa04729bb611f7b69356b47639667b83cdfe38eeee77e7f1601c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782132450, "uuid": "2375c973-28b0-464d-8620-6ae4a1b09b81", "comment": "Malware payload (AgentTesla)", "value": "39f24666b2fcff117ed4526118a44d6853cc2a82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782132450, "uuid": "2573467b-80ef-4cc5-b29a-bfb6ad0369d4", "comment": "Malware payload (AgentTesla)", "value": "c031216d1e6df0965abcdc03924a4ffd1e364dac8aaae56d825e4723f2f5a6ba6be52bcfc170acad9a4a8a26bcb3c82c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782132450, "uuid": "bc2115d9-8bc9-4113-ae40-5053faea2120", "value": "T14A84128220B1C43BE5F44E31C97A67F96096FD1ACDB21A4767847E6C74712C2BE0EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782132450, "uuid": "8c10ee11-6df0-463a-a47c-573eaa97fd38", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782132450, "uuid": "2b8bed7e-2e8a-4d28-911f-35e24febaf27", "value": "6144:SMm4CCEv3liZFEDwxQRy4Cm4k2WQ5s9PxMWJ12VkqoutiE/VQxGlXF+kY3N4:SMw3v3lisDpRfr4c6iPxMWJ1MoKisyYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782132450, "uuid": "5783f4ea-64bb-4172-9199-39d5ed9b6a19", "value": 379104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782132450, "uuid": "29e64752-c2c7-4232-88d8-ca9c25bd217e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782132450, "uuid": "f60a6daf-84fe-4db8-80eb-965f2bdf42c8", "value": "Directrices de pol\u00edticas para empleados_2026.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83901e88-6e07-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782111397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111397, "uuid": "8281386d-17cd-477a-b269-d4b542d9abbb", "comment": "Malware payload (Mirai)", "value": "30bf99317b3e7697ed649896096de6ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111397, "uuid": "fce8c421-d125-41b0-a7fd-76fb958d644a", "comment": "Malware payload (Mirai)", "value": "1ece38f76d2242025915a4c8e1373d07b372f4d54844dfe1d1fc4568bdbf0f4b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111397, "uuid": "2dbc47bf-41ac-4838-9627-b4e48a90af5f", "comment": "Malware payload (Mirai)", "value": "59d991212b63dba749e8bcc61f2f05ef9ab7f568", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111397, "uuid": "f31285f0-d417-4bca-a1c5-24a13ff4feab", "comment": "Malware payload (Mirai)", "value": "cb603dab81c9e30d3b1f54be366e29c3f4d70437b68b512cc975310657a16650a70ee16a9e39dcffe0fed75112694d8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111397, "uuid": "ecdcf323-86ab-49d4-9b1a-5e011d86133c", "value": "T1D9649733C82589A5E0148CB2226732515D4787BF88EB26D3EE2A59A0FF3545F51BFEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111397, "uuid": "3c2192be-2556-4592-a197-5c7e25e27098", "value": "3072:ILoSa+F2K+XaXyFqQGGKwjoCbrBYmmaWcsrHqa01N/:ILPa+F3C5G9wjoyYmmaWcsrHqa01N/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782111397, "uuid": "2d628683-a2de-4bf9-b2a8-a339ce029462", "value": 336314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782111397, "uuid": "67a6507e-e722-43f6-b9ff-41131bd639a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111397, "uuid": "afbf1497-f649-4cc8-ae0f-8306d0b1c18c", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0a7fc4-6dda-11f1-ae13-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1782091873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782091873, "uuid": "a4b33c81-733a-4024-948b-b5f7a85e1748", "comment": "Malware payload (GuLoader)", "value": "62ed34cc988cbb5781823b067fa82522", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782091873, "uuid": "6a7822db-4907-41a2-8730-0d018d810895", "comment": "Malware payload (GuLoader)", "value": "1f3e92fb275fbea7f31629cfc5621c0e190d0ac7f97bde500b8c029ae2fa1fd1", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782091873, "uuid": "dbb431ea-5742-4aef-958a-8175abd1536e", "comment": "Malware payload (GuLoader)", "value": "4d1d672c040b57ed7e5ec3b1931f476331621216", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782091873, "uuid": "6db3bcc5-9319-4690-ba46-9f979013b181", "comment": "Malware payload (GuLoader)", "value": "bf783308ff2c6cdb15255594f2cde04a464c3157f100814b1119a4fa0af8a92d33a0a8b80ce187218db3149048eb9b76", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782091873, "uuid": "c6c62bd5-508a-45c0-be5f-2b63877b44a4", "value": "T1FA742354E800CC3A6FB699F6136391E123AA2D8872F7A1D67DFDD9356A3406CE5380DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782091873, "uuid": "f4f9f141-f4f0-485e-b0ff-70d17c1c5978", "value": "6144:BG/aNAAw3HQFRdMvwEq5SIEE2ylgI4yco8K7hsqm+IltnDO49qSs+uTny/8pd:aXAmH2RdMvwEqjwylVMaffIldKAqSsjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782091873, "uuid": "1f29025c-150f-4d25-b7f2-a2859c2c350e", "value": 342070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782091873, "uuid": "867fa923-3834-48a4-acbd-af07703d4cf0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782091873, "uuid": "128d4037-19ee-4cdb-b8e3-ebce5fe020ec", "value": "nxEDticas_para_empleados_2026_pdf.bz2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5d0d266-6e0e-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782114542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114542, "uuid": "af1fa1c9-2016-4e9d-bb6f-8e7abdd70eec", "comment": "Malware payload", "value": "956fa823e5029b6d396bca8b42cfd884", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114542, "uuid": "115ab458-39ad-4d99-8994-7a8e5296937d", "comment": "Malware payload", "value": "1f62857fcc24f17c6fa05f3fcf44f7d5de734f329e27a374f27204e305517cac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114542, "uuid": "77ab1d8e-97ed-40bb-bd95-84321a553270", "comment": "Malware payload", "value": "19038b0108050538faf8b511795eb50333461d5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114542, "uuid": "574d3dd9-059a-41a8-9ec4-5e8e1690c1de", "comment": "Malware payload", "value": "9d291cb6424a8161797cb6d02ff0072f36e9ff6a450b51e3f1c239f6aad8dbc34f04b57479865db297ddcba836b771fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114542, "uuid": "1339f20a-7952-4cef-ac5e-502fb43b4f99", "value": "T18B45F003BF40C546D59A5E3099B5D7F86330FC58AA26874B30E6AE2BBDDD6C34E122D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114542, "uuid": "649ede22-d307-421a-931b-bbe0a1868ee6", "value": "ba028ec6d8e2bcde182b2571d10c180a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114542, "uuid": "661ac579-b34e-4de9-87b2-0f904095a27a", "value": "24576:himJtSg7oS7cp3DuhTE8Y3s2IfY80RYkpofFk:hiGtdy3sTE8Yc2qYPRnv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782114542, "uuid": "6547ae4e-195c-49ea-b585-1acc83839287", "value": 1254920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782114542, "uuid": "2b3063b9-deac-4dc9-98b8-e414d8613e28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114542, "uuid": "ebe11fce-953d-4ee9-a015-1637072fd014", "value": "Voltix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4caee728-6e13-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782116459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782116459, "uuid": "30bfa10e-0062-49b5-aa31-cb446bb63561", "comment": "Malware payload (AgentTesla)", "value": "bd9d6c8361b4d9ab9cf22f177273ca03", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782116459, "uuid": "388891c7-b268-4bc0-bcfe-787de3be8a15", "comment": "Malware payload (AgentTesla)", "value": "2009c2095160ce4c016855f7af23529a143e7533a5624b60f4dbc277ae9a7bbf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782116459, "uuid": "a97bcaf5-c98d-4f82-afbe-30f78216f279", "comment": "Malware payload (AgentTesla)", "value": "a33adebc327a5548fda826b1c0cdf55899af31e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782116459, "uuid": "e8947cdc-6130-4cc6-9189-1d3b3100c7b6", "comment": "Malware payload (AgentTesla)", "value": "fd25504a72f157a91aa3802b9db8bb27c43f4f5d4dcca10f0c26acadf17834f4d40b0bb7c8e1b9b96520c1046cd41c04", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782116459, "uuid": "13b10eff-4d47-447e-ba1f-44a25be8c1e4", "value": "T1AB3402417FC0E006DA9262396CB93F7693B52E7AD6D38B9F4390A7483ED2782015F653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782116459, "uuid": "8f80e031-5653-4cd7-896e-f57e6640996e", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782116459, "uuid": "aa0a4f7b-1427-4bfa-899a-eaffa77d475c", "value": "6144:8fY+onP0DOYpTXPtd/d3u08BuOwiGoqrwZi:8fYgOYpTXP/E08BMigii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782116459, "uuid": "58073f75-bca5-454d-a9aa-8fd4a88575a2", "value": 234872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782116459, "uuid": "a5bef851-65d8-44bb-913a-d569f41d14c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782116459, "uuid": "9035431b-66c7-44a1-ac74-c8f7f3aa3d19", "value": "Scan002233220626.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912a5b0b-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782115285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115285, "uuid": "abb32b22-6f79-43bf-a6be-07a702a4a7bb", "comment": "Malware payload", "value": "64b60010cc156309516057415e2eb462", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115285, "uuid": "86f1fec9-aa89-4748-b1ca-a1c421acf7b7", "comment": "Malware payload", "value": "20175164f65e166c5fd9fbd90fb6d2f44a0202621fa84d772a500e140704ee03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115285, "uuid": "fc021563-b9cc-4e55-8802-55efa02120dd", "comment": "Malware payload", "value": "23e1e21bef9468ff828608102aa2ee1973658947", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115285, "uuid": "705b353c-2214-4e1e-b070-db487964fe40", "comment": "Malware payload", "value": "e7889a79b629704d4729475677f7f4b06556ae24a9629487b2e0464675c2437b493cac7fbc4ff5d153ced2433689cd74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115285, "uuid": "68dded26-0242-4e8c-871f-5c5a6bb31171", "value": "T10217335067E018BBDAF65A7AC036E16891A2B4124B81C1EF5BFCD31A5F6B7E03D38D05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115285, "uuid": "efd5e54e-b498-4365-a935-77c70eecf84f", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115285, "uuid": "aae36916-eaab-4782-b5a2-2f7896d53b1e", "value": "393216:785vzasFl7dCR1C99OXr8Lg5lQbZklOIl2lInEroX314S2kIn8vaxbc50BcPmT1q:I5vzJFlUR1OOb8aQQLErUqkWMaxA50BO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115285, "uuid": "0d98757d-c85b-40f2-81ed-9b745853c50d", "value": 19291319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115285, "uuid": "670f6a43-2bb7-4242-8544-f8f191995d44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115285, "uuid": "2ad70f2b-d3f8-4cbf-a5cf-43860bc71220", "value": "64b60010cc156309516057415e2eb462", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216e8fcb-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141297, "uuid": "607a13c4-a796-4ca0-b1dc-24fc5cdf328d", "comment": "Malware payload", "value": "90cf7fbf97a23e02509313f647f31716", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141297, "uuid": "2cd5264f-ec90-4e9c-a8ac-a75d82290357", "comment": "Malware payload", "value": "214de53f2e06cc87fec0c6ad1eb9af8953eccbab1abae15d602aba20025faafb", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141297, "uuid": "63dd3eee-7799-4a47-aac8-7b760c5f3a1e", "comment": "Malware payload", "value": "6405f80f6358e0279352d94eff95c652952c233b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141297, "uuid": "e6c4f73b-2a05-4cc6-8d34-81aa2b4fe6a9", "comment": "Malware payload", "value": "ee5b1c511521ffa294fc7c4d1900fca6432e3deb4becfcb6ba86a787b898d1902beb31789c96510d731e5958ded5f3ca", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141297, "uuid": "ecccee0c-0653-46a4-9e39-ff577c7e5b47", "value": "T1AE9568AB16AF339E693FAFF85A4EBC45E09B88D1C3405BE535860170881ED374AE5D4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141297, "uuid": "717bdf0a-7f91-4f44-9775-84d036c21646", "value": "192:hIRIRIRIRIRIRIRIRIRIRIRIRIRIRIRIRIRIRIRIRIRIRIRIRIRIRIRIRIRIRIRO:lB6YoOxxDI0tJyxY2lP/6EWcMwXXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141297, "uuid": "f7f3c724-4589-46f1-97a4-10cf8bf35da9", "value": 1881008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141297, "uuid": "6d5e40b2-b023-46d6-bfd3-7aebbf4e2bc6", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141297, "uuid": "aebd9ee3-2cae-4a4e-88ce-f23a6511da94", "value": "Account Statement 0220626.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a656a101-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782115321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115321, "uuid": "92a4cc98-e0c6-4385-9919-3dbe2a7e7e70", "comment": "Malware payload (Vidar)", "value": "be0afa6b88f180fca9fbef78a4206283", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115321, "uuid": "7e75599f-f0fa-4a5b-83ab-efe5967abbfd", "comment": "Malware payload (Vidar)", "value": "2172b92bf5a298d1d99dd4f827c581fb86a3f81dac4f8d64394f507a7116b386", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115321, "uuid": "ceb430f4-ce78-43c3-add5-fcee9fc9b86e", "comment": "Malware payload (Vidar)", "value": "560840d4772533a016994cb21046929f6f0460f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115321, "uuid": "aaaff388-d06b-48d1-8c25-609ef5f27ea3", "comment": "Malware payload (Vidar)", "value": "a76b39fbacf27f0c4d494192d798108dab874658a6353a6fc75c38bdc9d63a38a569eb14693c5ef721de437eec516046", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115321, "uuid": "02e7ce64-b6e4-4ee9-ae99-8132d84058ad", "value": "T100424BC2F2D5E4F8D0F6C3B9E96B109B81643804171296FF33DD8A586ECB721767858A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115321, "uuid": "aa0f65cb-c738-4547-8397-87028a1f4cf6", "value": "0c46c7fafa1efaedd2bd2c7fa5773426", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115321, "uuid": "66013864-7ec1-4752-bed5-f4d2c6666016", "value": "192:OmrodAB5O9R1T52qYPfF8FPsVYLexjN2nmC63d9+KEjiL38E3VRlX:OMoWzOT32qKMPOhjcnm13CF/ElR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115321, "uuid": "ea3c2ada-0dcb-4573-9eaf-3f5163fd5862", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115321, "uuid": "b687e00f-9904-47f8-a1b5-54bc735882a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115321, "uuid": "daa49c9b-7bb0-49b5-83d8-d40ec657cce6", "value": "be0afa6b88f180fca9fbef78a4206283", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d320177-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141908, "uuid": "b39986c9-b1b7-4d32-918b-7726e233dfd9", "comment": "Malware payload (AgentTesla)", "value": "4bc6d7697b5fd603aa8525d9358db9b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141908, "uuid": "7ebf122e-197d-4a20-a304-d618ebf13703", "comment": "Malware payload (AgentTesla)", "value": "22664b468509d5a3ef8d156c623b64fd1acf1ebb19d175af6990cfac6178b557", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141908, "uuid": "fd531748-e950-410b-a352-98c504ab3bb1", "comment": "Malware payload (AgentTesla)", "value": "3b419805a27d46fd695a56601260b894d2f9be75", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141908, "uuid": "0ade6458-e40c-4e7b-9111-4125068e81e9", "comment": "Malware payload (AgentTesla)", "value": "54575fb9535b967d8bdfb44f9cb83159355936b68ac2f2d133ec0f670ae31975cfdbdc7a49b2e2fae6c09236d0d98d78", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141908, "uuid": "8da7cc80-f1dd-4d13-8e12-165e784278ae", "value": "T17906E4915BB1A17677A0D7EE9137DF34A40E60031AE9CF44311FE228780DD8B6359AEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141908, "uuid": "2d6658eb-0763-4338-83f5-c961af1863c9", "value": "98304:MvGY5O9LF6Heg0yJ/dHvQytb+3lhYPYvCFDXe45kF/0WXl/E3/K2qgbEBAaC/mTL:MJgsxHvQy5+3lhYPYvCFDXe45kF/0WXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141908, "uuid": "eabc27a1-3152-406a-a7f6-368c067c4877", "value": 3761552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141908, "uuid": "98af0ac2-0231-4a65-b5e7-80fb6f9263d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141908, "uuid": "5f351419-d6ee-4a21-8334-2fa20f7a1c7e", "value": "SOA MAY 2026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77598d09-6df5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782103646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103646, "uuid": "19d7e3ad-d368-4925-9df9-6368482eaf99", "comment": "Malware payload (Mirai)", "value": "ad7cfa5a1beeacb45f477ffa33b92051", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103646, "uuid": "6f6ba3ea-513d-4f6f-971a-db38bf9fc7fe", "comment": "Malware payload (Mirai)", "value": "2522ea59162e569aa18244b99521f597f0bd5082c767b80c6cf09d0dd3c8b9a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103646, "uuid": "a82e562b-e7fd-4788-889b-6e66de6d28b8", "comment": "Malware payload (Mirai)", "value": "6da100e1fc45cdddb2953d98b7b7941e9b52436c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103646, "uuid": "003fcf5a-eecf-449a-ae2f-2fe16b67a6f8", "comment": "Malware payload (Mirai)", "value": "8d672b6bce98196e1cac8c8cd2866b3066692317a83086c503212a88532955cfd0ca92a2eb1a19f04c37986c28252e9c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103646, "uuid": "135df597-ec8d-4340-ad39-897d8c1b7be0", "value": "T156935BC1E653E8F5ED1705751133E33B4B37F539102DD697DBA8AA32BCA2A00D5262AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103646, "uuid": "8de09e28-0821-4eda-bd65-37d17e200cfc", "value": "1536:Lh+jn2+ifI/EIzRBIepUGzX+VCW+XpElUxc2V7pd3OQ37PKlCdg71G+dkChCz:9+jn2tA/EIzPIepUG6VCPulY7p9OQ3rz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782103646, "uuid": "651e65e9-d619-4b77-a19b-ec868521bb42", "value": 91860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782103646, "uuid": "0e7285b2-1f06-46dc-8b16-3667cf45b618", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103646, "uuid": "88dbc39e-9894-4218-9702-127b068383be", "value": "nerv.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106cfbe3-6e4f-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782142128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142128, "uuid": "a24e4615-bbbe-4c65-ab17-3a1edb207787", "comment": "Malware payload", "value": "e2c0f08277e8364f59988407ac731b0b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142128, "uuid": "ed1bf3a5-9bc8-4886-965f-3b4da8f53a9e", "comment": "Malware payload", "value": "2609eb61e87a6c1cb07876b8a9772fb81cb4d3dfbe2b8c32c8af3296c3247ac8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142128, "uuid": "4ade8101-63dc-4721-b161-3e5f6e9717bd", "comment": "Malware payload", "value": "c7865f4f11fefd61decd829a86aa29ea50a61c52", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142128, "uuid": "206b1633-5a18-4dda-bb75-20e79f8304d4", "comment": "Malware payload", "value": "857fc1a0f6941c1d964a51d2fb56f7d9cefee3a400215b8b0aa06a76ba05c130c2ca10ee8110b0d05df58c3405d31b2e", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142128, "uuid": "3998da86-6380-441e-a1bc-02003e0e7d14", "value": "T110B5E6E3079C07EEAB9459D6850D3617A4FBC27B2C5E1288F5E21943F13ED21B626B70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142128, "uuid": "338469e2-e33c-49d8-9111-6c2f53d1d8e1", "value": "1536:upAZ1OUf7wZkL976N8odeOMATYJMkBFHntcZNE84rvRFQrXyAnkAg7Sv0Wqpin3O:hGRm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782142128, "uuid": "564d5722-97a3-4716-a24e-cb10608d6a66", "value": 2382725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782142128, "uuid": "05884029-3e4b-4b26-8761-28e10001b1e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142128, "uuid": "3c71956c-bbfe-4418-b8f6-01795327e795", "value": "index.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59ce37ae-6df4-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782103167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103167, "uuid": "dbe8d3d2-4732-45f0-bf40-523fe7a997c7", "comment": "Malware payload", "value": "7bebc76359e50b4e24cffbce895dd4a2", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103167, "uuid": "80ac7e05-b212-493f-9c45-813317d27ec4", "comment": "Malware payload", "value": "262f001ebc264ea9f90b90f9abcfdbfa5781811e01cf7ca74f95a92238a857fe", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103167, "uuid": "cd630fd9-7dbe-4c3f-8513-bbcd1c106af2", "comment": "Malware payload", "value": "43ba339a94021e6c86db74de180d15b64e97923c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103167, "uuid": "3d4785da-6b45-4083-8b4e-607811cab6cb", "comment": "Malware payload", "value": "9a4213a0f52ce4dc7608688cc353462b046aa91f9ebac4f2fb0156402dba9404a85d0ee50cac3da1de32602082f5b84e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103167, "uuid": "a139a50f-8916-477e-b2b7-c7220fe982fe", "value": "T129C08CEA98CF0AE8CB45EB017DFD2406A50FC0CA22714828AE0354207A8405BAE2618B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103167, "uuid": "544b6352-ea29-455a-835d-8a244eac780a", "value": "3:BKDD/2qJJyQZTGNjmsKLxvMIMLkXiEIusKpFbAsGIBJpQXbJJFISFeBgolCVJov:STGGGhukIMCiRb8bQ98SFMlCLov", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782103167, "uuid": "c93a40ca-e1d9-4cc1-95a5-396a4c5c7553", "value": 164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782103167, "uuid": "38bd7f0e-1fca-45d4-bd97-d70a1a57ffc9", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103167, "uuid": "c79353d8-546c-4de6-a84f-07311a4d5913", "value": "tmp_downloader.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d342bacc-6e50-11f1-ae13-42010a9c0009", "comment": "Malware payload (ConnectBack)", "timestamp": 1782142884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142884, "uuid": "7206bf4d-ed9c-482a-b11c-3893657828b5", "comment": "Malware payload (ConnectBack)", "value": "f20bce33daac921c7cc64cb81ac01f80", "object_relation": "md5", "Tag": [ { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142884, "uuid": "4a766aa1-855a-47cf-9fe9-2b5e757110cb", "comment": "Malware payload (ConnectBack)", "value": "263c72fe081c8e25693d9beea424519d895fe3176b18129c4f4bb6c06daf5283", "object_relation": "sha256", "Tag": [ { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142884, "uuid": "3f0ad51b-20e3-467a-b3fc-dd020f0e0957", "comment": "Malware payload (ConnectBack)", "value": "f19be8cd4c09b92507bf761ec1000e4b3e7427c7", "object_relation": "sha1", "Tag": [ { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142884, "uuid": "2bf192d4-50d7-439f-bebd-f76573cd297a", "comment": "Malware payload (ConnectBack)", "value": "0a43892737fce12de3389a2962ff532848db78704faf0ab4b095da68abc77e8d3aa9356f503a452fec21c0e200faf468", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectBack", "colour": "#9A8DB1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142884, "uuid": "bff2cf91-0a90-4f07-b6f8-c2c029975647", "value": "T158D080330B0A41DADAD5123F6678595CD77B8976574966310860DC010C09A045F53C76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142884, "uuid": "ec0a4b79-42ec-4f9b-b351-74d9c657b05f", "value": "6:BnX//In8/r1uBxHocmTno9Q3RQdygg5XJYD:BvwncrAH3mH532D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782142884, "uuid": "9ed0ec07-72b1-49f8-8545-b9c388a5a23b", "value": 250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782142884, "uuid": "af987402-7645-4a00-b3dd-be3409aa4a05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142884, "uuid": "b0a84d3b-67c0-4754-b7a5-244b5fcd0fad", "value": "d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cc7566c-6e01-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782108675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782108675, "uuid": "532538f4-6178-428a-8627-26c25afee49b", "comment": "Malware payload", "value": "daab835e7540f7543f73be80ff41321e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vanta", "colour": "#252EE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782108675, "uuid": "bae6de57-1be4-43e6-beb3-4d4b48421eb2", "comment": "Malware payload", "value": "267d33672cd843a9833aa25916414a3148a0d1893ba9b777a8a5638a5bb1329a", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vanta", "colour": "#252EE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782108675, "uuid": "6a0db9f0-10d9-4bc4-8d16-bad12e57ba0e", "comment": "Malware payload", "value": "5f2c9291b536e46a475af8e33313a00bb473a5e1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vanta", "colour": "#252EE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782108675, "uuid": "3101efc1-28ca-46fc-bf31-c9548d154d17", "comment": "Malware payload", "value": "916169472ae05e204f9086417ad6c89a7bd21e427fb54670d311084ea4c8b69891273d76831635d16689122c6180aab9", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vanta", "colour": "#252EE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782108675, "uuid": "4c1115df-5132-4750-8dc3-14b84cd8ca9e", "value": "T10FB2C0736D94FD3ED48B98358615E863E12902BDE50999CF07B084FD1BAC2861B0BADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782108675, "uuid": "b0e35646-6934-4e12-a8d0-48aba6253e2b", "value": "384:HjUMluQT62hDxs/+JwuoIh8Ljy/mDfUjM6WJ3MKjDtE/9Rj3w9gntrRuBN:Hgq3XJwuhuu/mrUjMvhFjDtE/9R79nv+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782108675, "uuid": "0fae5397-2bd4-4c0e-b4d3-6ef469016fdb", "value": 24267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782108675, "uuid": "9e7624b6-4829-4254-a9f1-7da4f4748cbe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782108675, "uuid": "3deaa983-d2d9-4954-8e97-7c2ded380460", "value": "Vanta.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26119f25-6e02-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782109093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109093, "uuid": "b012d81b-e4ea-4b67-ab1c-90b48d2526f6", "comment": "Malware payload (Vidar)", "value": "502044456ff04bb6ed77ad6ecfa51da5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109093, "uuid": "929c1a30-b036-40a4-91d9-60f30fb50efa", "comment": "Malware payload (Vidar)", "value": "2736f5de45c8f90998998de0ce2db18fd182df2532350c2c7a162985e2703415", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109093, "uuid": "ba8c8285-9672-4e65-ac35-1aea38142ede", "comment": "Malware payload (Vidar)", "value": "4b298b981b2fb6cd6ded55bbc324b1df7c35ebdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109093, "uuid": "ca422f12-5aa8-46d3-8a6c-be4e33b7085d", "comment": "Malware payload (Vidar)", "value": "b069b65c3e795301963ef399b7cb6868bf40ac56e5e9352e06e8f895ac2ea5fd358b1d005f83344d12cca8c0c84748a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109093, "uuid": "b8a18c07-1a6f-47df-b452-cc3d765722a9", "value": "T1CFF42B7DAC60F362FA0C90BEE185D3529E2178110236AAD319BE932412459B3DF577FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109093, "uuid": "99cf8253-bb08-4013-955b-54bb05193037", "value": "c2b8721531ba16342fecd7811f685732", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109093, "uuid": "8df30f9c-39bc-42e8-bdfd-88cee7398358", "value": "6144:Diy/0WhBGtUK8z88VeLQiI8MvCobILNkJnDCikykXhCgp/1JsUzvE4w6JOOunamW:BcDv87KkkykT/sUAgsdBiBNlin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782109093, "uuid": "d75e0796-c44a-48cb-acbd-9ff34b648d3a", "value": 781352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782109093, "uuid": "fbbe0f83-c5b8-4998-b826-5dee0bb98153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109093, "uuid": "f63e6235-eee7-4f0c-a7b5-a55fb0cc1491", "value": "2736f5de45c8f90998998de0ce2db18fd182df2532350c2c7a162985e2703415.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a7c6e21-6ddd-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782093370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782093370, "uuid": "e98344ef-5d7d-4cb7-a0e5-d54481461949", "comment": "Malware payload", "value": "158aa7ed51ab2b75ceb37d9b4aa02a7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782093370, "uuid": "a0f862df-a8b4-4bd2-bc02-697311fcbbff", "comment": "Malware payload", "value": "273ec09aec45d6a7996f61e2d4fca07bea84a00f3544fad64091c239f4d93312", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782093370, "uuid": "15e9e9ae-e298-4165-87b6-895f5ad43c87", "comment": "Malware payload", "value": "4a6e763dc386bdac25a3c93e0c057ccffcffd660", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782093370, "uuid": "7e944bdd-deb8-4791-8f43-c6de0b570eae", "comment": "Malware payload", "value": "f390d0166272db6fe41853e3c7525e997e69d8b25deefb1a2ab27004f39eb37f7daafed1eaafeb0623df99ac66d42f64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782093370, "uuid": "1855bc79-c447-47bf-83a1-2380979e893e", "value": "T14472E84D378244FDC916C5B4E6FB5B75EAB1B80115101B3E4720E73B1EB0AB0AE7EA49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782093370, "uuid": "7b6246ce-b5d8-432c-9da0-3ded5f583484", "value": "1ad721fd16e1c587fb1df68e5a8a9e9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782093370, "uuid": "ba870760-ce7f-4080-9346-278c7b2ae460", "value": "192:uMrKqtE8IRPGA76jJm18iqehNE2efWEQiYAmTCMa6Q7XXSDa5KS62PqTyusqq22:uqgR+Bm18avEBdQtw5KDnTynqqT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782093370, "uuid": "e6083b80-bd70-46ef-bacb-7b9638d870d3", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782093370, "uuid": "7745ef5e-2de6-44ca-8705-0609b104dc85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782093370, "uuid": "1ed3d743-116f-406f-a17b-de76db75027b", "value": "app1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "571f7f2c-6dd3-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782088989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782088989, "uuid": "0e058e75-add6-4cdb-81a1-d33e529a48ee", "comment": "Malware payload", "value": "96ba02421f8b40e0f8ac834b3db0f309", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782088989, "uuid": "b551df12-c491-41d5-b2ef-ceb9e7a388a1", "comment": "Malware payload", "value": "27be02890b7e55b800c6b5cdab16f66af68246472644a2127a564f04f62cde25", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782088989, "uuid": "a854fe7b-9110-41ed-9502-402958909c13", "comment": "Malware payload", "value": "15e0fb07a24ce0cb647df8ac104f2e5c3c8905cd", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782088989, "uuid": "fb5e30d5-bca6-4a41-a1da-653b9df7cf06", "comment": "Malware payload", "value": "6fe0e4214308fa123944c4559ccb06b8f22f8e85465790db5f58e99524d6f7a21bdc99b6a66f62d156d3f5686f4ef76b", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782088989, "uuid": "79d170d3-3054-4369-b0f5-9293b600201f", "value": "T15A45AEEA1E1F11B1CCD6E8B96A1010E3789552966DC2D8DC96DAFF0D2BD784C22F3B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782088989, "uuid": "ebbfc327-49ba-4f05-8ef8-fc2421194cf7", "value": "c129097361b8295c6461feaed5b0ddf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782088989, "uuid": "6d6ebfb9-9ff9-4534-be90-befe40a00001", "value": "24576:Pk/rVwkuxQuix2KuD8HQ1/D9kIW3RETcJJbghuDxMZJyJx:sJuxvuuDNR4ETcJJbGoxM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782088989, "uuid": "49a33a89-8461-4167-8f5c-0a878772b88a", "value": 1273344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782088989, "uuid": "c9fe008b-ca16-42b0-990c-d3c920a15a21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782088989, "uuid": "bd0bd24e-c7a6-4b6b-a971-e4b2e7363fce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f29620-6e4c-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141067, "uuid": "88f2b352-b303-4884-98ff-040370bbeb8c", "comment": "Malware payload", "value": "5b060d86fcf9234abd07e19510142ece", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141067, "uuid": "87ecec41-f4c5-4ae9-948b-b2e0f794b3df", "comment": "Malware payload", "value": "281b4ce4e71f0ebf1fe6bf8119cee048845323d7977b65c19b1fa9e63ba781fc", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141067, "uuid": "813728f9-ebd2-463f-8ae3-1d3ab95eb6f5", "comment": "Malware payload", "value": "dee9a9ba43ff7907e27dd4518fc3eacf54253f58", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141067, "uuid": "41e7f4d7-d2c6-41f7-8857-0fcc310f9717", "comment": "Malware payload", "value": "96faa43e08cf18cca757a0e26393505572855a880716878e3b90f3111f961de3fd508980bf322fbeaa30b3818782a7da", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141067, "uuid": "436b695e-823a-4a9d-9efd-924d6d42d5f0", "value": "T19E41C7387B68A170330F8B54781F1E29D3B152D77105A8C6778EB4C17B89602C574BAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141067, "uuid": "77e2144f-fad7-4870-9def-593850c5f1a3", "value": "48:IYIEktISz3fML/J+1k3yM6nMSdK+w3ZeLytzX6S3bk7vvQ/qR:VIEVYfqJ+OD6nxxO4LytztA7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141067, "uuid": "c362e66b-bd6f-403b-bca6-4fd0dddd2111", "value": 2157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141067, "uuid": "8ad62a90-6f6b-4686-9c18-56a69791f9e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141067, "uuid": "341cf3eb-0c32-4d62-9d69-302505b2a323", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3b643ff-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782141650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141650, "uuid": "8bc7a8ba-04fb-45c0-945c-8d22989347ec", "comment": "Malware payload (Formbook)", "value": "14803e369161251e217411aba885b64c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141650, "uuid": "f478867f-f8d5-4cbe-8944-0cadbf74ea68", "comment": "Malware payload (Formbook)", "value": "28daa7354a3ae40d93b1c6000e0019565c37044305660eee36fd70742a0036c0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141650, "uuid": "9a7184ad-4323-4777-a219-fd707dabe521", "comment": "Malware payload (Formbook)", "value": "c3f334bb30e589e79d8ca4861ca22659e74164a0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141650, "uuid": "14792daf-b20b-46a8-8c7b-502410c3b9d7", "comment": "Malware payload (Formbook)", "value": "987b9e5bc6f786486b20dceffa3e7ae287187baa5d2ab4a36052553e3b0d14c42e9292eee3eefc3262808ad382195bbe", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141650, "uuid": "595ceccf-ee3a-45ba-ac25-b19dbbba1631", "value": "T1C855285303851BBDF69D0EC9C94B215B20F2D46B7D251298EBB36EEBBC3B9845430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141650, "uuid": "968c3447-a4ab-4d3a-9670-8cf9adecd41a", "value": "1536:tGRxgxblD7fHrAVwvXWI7sEZ1gqiXAOyDnxv9y/wKXmOpjKBkb5rXA+nQUI6WwbX:K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141650, "uuid": "4599cde5-e7ea-4b52-a268-75997b1fcaa5", "value": 1396450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141650, "uuid": "29a44b6d-9537-4f72-9889-854bc35ad094", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141650, "uuid": "445b8470-edc3-4b43-9a3e-53adb25a7736", "value": "Payment copy (HSBC A2rKEW3FwXGU).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c554d4-6e29-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782126109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782126109, "uuid": "976b59fc-944d-41ae-93e2-610eb1c75f61", "comment": "Malware payload (Vidar)", "value": "86db7353d79a3b44770de794d76c7f6b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782126109, "uuid": "e71ba663-aeb3-4b46-a31b-96776f8cdf00", "comment": "Malware payload (Vidar)", "value": "28fb3127d5e68e4436fc9c8c83556f41d9f644df94157d1f99ae00288b9572cb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782126109, "uuid": "02d2cc54-4c10-45cd-b681-880a7f4af1d5", "comment": "Malware payload (Vidar)", "value": "29fe07a5605099c1342267ea76989f07346bc9e2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782126109, "uuid": "81dce9a2-c2b9-4b20-9197-3582b9f28fa4", "comment": "Malware payload (Vidar)", "value": "833d5ce274ef6cc733641d71ff0e2a0d3adbee2dd5c85f7ba28cde3e7cccc1b2f39e368379faced6c451ad6b73d5fd7c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "U", "colour": "#417F84", "exportable": true, "hide_tag": false }, { "name": "UNIQ.file", "colour": "#191708", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782126109, "uuid": "60bb5448-f0ff-4e21-801e-42dcc7557cb4", "value": "T136F58E02FDD549E9C4AAA23189B69295BB34BC082B3227D72E90B3383F76FD41D71754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782126109, "uuid": "17b0675a-35ec-45fa-bdd1-440baf00f6ff", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782126109, "uuid": "d379b17b-0e06-4942-85d5-d0760222aaa1", "value": "98304:nlzPimVJ1EFqR7hfi1uHBYqhvGgyuq3WZEcDDtnJoMpe80DXz:nB6eC2MmN4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782126109, "uuid": "02dcbcd7-20ee-4f28-9dd8-3ef4e8c5caaa", "value": 3394408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782126109, "uuid": "8475ae34-f9a6-497b-9710-a0a0a02c2ea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782126109, "uuid": "53b9ebd6-9941-4401-b53a-afa3cc4158a9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a81e4c60-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782115324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115324, "uuid": "81471a60-187c-4c3d-9cc6-36e387d225e1", "comment": "Malware payload", "value": "cb06b63c5ad02f7c6c33afd6ecfe3b14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115324, "uuid": "ff048f12-e809-423c-8907-4799df7bb86b", "comment": "Malware payload", "value": "2a2a3680315e27c9253656b935841cb64c80ddd8f4516243050a753f32d9037d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115324, "uuid": "d030ad21-1ced-4bae-8a80-90f6392a0e3f", "comment": "Malware payload", "value": "d9bb5247ebc903b174629329e0fd6e3eefbcbfd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115324, "uuid": "c6cb8507-d4a7-4aac-8d45-3ea35fe659fe", "comment": "Malware payload", "value": "032e1576273202263b955207d70a22a2f8f8e9e64c83a797b52a2b31c65c4f92a553eb4e5edf1cc997dd1b0b05a9c4f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115324, "uuid": "f5613d01-a5a9-46b1-96d9-e328e52b7e75", "value": "T12E17335067E018BBDAF65A7AC036E16891A2B4124B81C1EF5BFCD31A5F6B6F03D38D05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115324, "uuid": "cee5965b-87bc-4cf9-bb05-b1573151833d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115324, "uuid": "68856866-e3e3-4b46-9c4a-cddc85aa65bc", "value": "393216:785vzasFl7dCR1C99OXr8Lg5lQbZklOIl2lInEroX314S2kIn8vaxbc50BcPmT1u:I5vzJFlUR1OOb8aQQLErUqkWMaxA50Bq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115324, "uuid": "392f37e9-d93c-429d-b117-4f90eef129fa", "value": 19291319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115324, "uuid": "bad90128-47d4-49b1-84ed-5bc889f449bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115324, "uuid": "0eddb098-5791-4d1c-beb5-42fa3d996401", "value": "cb06b63c5ad02f7c6c33afd6ecfe3b14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8279752-6e0a-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782112774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782112774, "uuid": "426c68b4-93a5-40bf-904e-8b8016112af7", "comment": "Malware payload", "value": "05fe479368179099a9ee67e9c0dfa085", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782112774, "uuid": "c3e7ca92-be21-410e-80a5-5cb92addd2a7", "comment": "Malware payload", "value": "2af66155c2e3e53b7068e820f6387d18fdfa4276faa18b1d0337410d096336e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782112774, "uuid": "bc8ea0ab-b44f-486d-8c7f-68d6d7fa9e0b", "comment": "Malware payload", "value": "185b64b062fb6e56b8230814b857d108e41e309b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782112774, "uuid": "a128c916-76b8-454d-84aa-b8440e0f2a99", "comment": "Malware payload", "value": "16ec1dc48f9a8f0de65893f25c39b99d90194e2a63117be59976620772f1cf378b03397e4735a395e9084f1db8d0dc65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782112774, "uuid": "4fbfd8ed-109e-477c-a1f7-15cf10a3ad60", "value": "T14B07338393A089FBD3818474C099E7656AB2B53E9F6605063EE465CD3F0BB94187EF31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782112774, "uuid": "de21639b-8f54-4e98-8751-4c093842d08b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782112774, "uuid": "37050d21-a90b-4d1f-b8b7-d96e51e14c8c", "value": "196608:TP4FMIZETSRjPePdrQJF0BAnPh4OKJsTBq3hNA0nZSfBZYZee8p8rJup6EjS8XTI:bQETSRvJFDxdBohNdn8Eee8gaTde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782112774, "uuid": "e3510614-dbf9-4eff-9fb7-83668ede0c08", "value": 17059840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782112774, "uuid": "5698e39d-592f-4062-bf10-4ced62254c59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782112774, "uuid": "79daf130-b657-4afa-ab66-533ac2a581b1", "value": "plaguecheat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59268bba-6df9-11f1-ae13-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782105313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782105313, "uuid": "6ac96184-8b4d-498b-8fa7-a02af0cbc3a2", "comment": "Malware payload (WannaCry)", "value": "f2c8937f009447ae8b2cd293ea28f5d1", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782105313, "uuid": "57bb992a-ae4c-46d9-82aa-285b03bf4a20", "comment": "Malware payload (WannaCry)", "value": "2b188dfd9fd2275fc1da25e159ed1d4c765d03db073e72210043556ad2baf1e5", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782105313, "uuid": "bb791f2e-f276-410c-b3f2-4e099d9c84e9", "comment": "Malware payload (WannaCry)", "value": "2f6edb119475b7a7b41b1186eedb3057efb96d04", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782105313, "uuid": "b9e43d1b-d00d-4c85-8f7b-bd44d096c17d", "comment": "Malware payload (WannaCry)", "value": "75584c087a23e1638ea9d88fe62ba5a054e11d4d8fd5ee5b7c2b5cdcc05969a842b762ea7aa35a392dcdc23ac2ec866b", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782105313, "uuid": "ad7d0f18-b2fb-4ab5-ba69-444c36ffdcdf", "value": "T1BC36F115B1E85A70E6F31EB2217B8B1047797E458967928E2760A04F1C33F5CDEB2F29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782105313, "uuid": "84ea471f-6c04-4525-a473-ac442e61e12c", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782105313, "uuid": "5ee7d0a1-465d-4863-8998-f2d1880be86b", "value": "49152:jnsnpEKUacBVQej/1INRx+TSqTdX1HkQo6SAA:DMpyfBhz1aRxcSUDk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782105313, "uuid": "9685fd4f-e72f-4956-b963-55cd80ce3c8f", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782105313, "uuid": "f24e8773-8a03-46fc-9acc-a00226a1fb50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782105313, "uuid": "f4d3a12d-332f-496a-a462-4a1c1acdba0c", "value": "2b188dfd9fd2275fc1da25e159ed1d4c765d03db073e72210043556ad2baf1e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab080578-6e3b-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782133797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133797, "uuid": "74d14879-3c34-4a48-9f20-6e92fb9a430e", "comment": "Malware payload (Mirai)", "value": "baea00aaa8d80d0a5d905dc8c539e1a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133797, "uuid": "2df00bff-aacd-428d-b6f7-504314064553", "comment": "Malware payload (Mirai)", "value": "2be0b02a52b7db8e423f2208be85ac6e52bdd26e70313f298028e8348830b3e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133797, "uuid": "0cf6f8de-c231-4b27-9ff3-6447f0d32714", "comment": "Malware payload (Mirai)", "value": "0074cfb7a2220a89b7bc21215d09ff75e0e02ab0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133797, "uuid": "8da54833-d85b-4168-b88b-4f9f57e06d1b", "comment": "Malware payload (Mirai)", "value": "0987060a3d16b292da119b85897c82fce6542bece9e853d7fce07f8c98d24bd28516d591cd85a63ac61ac059a3786d62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133797, "uuid": "4731037b-0665-4a45-8df8-e56cc3a7bdbf", "value": "T1835349C8A0D3E8F6DC11093D30BAAF625E73E53F7036DA8BD7D97963A803602950625D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133797, "uuid": "2092d3c2-2a11-4752-8718-8fb72e25b62b", "value": "1536:edotLv8xHcuKT83SMINWZzv4grKUXWqPmCx+O8fHafNZkmsv+jjE:edotLv8xHcuKT83LINa4geInmCx+p6rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782133797, "uuid": "1d2f3a78-ad74-4c68-966b-16b61e1648dc", "value": 63792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782133797, "uuid": "429cb592-0fba-4fee-8c2d-7ad3b8d31ae0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133797, "uuid": "dfb52af2-3e69-44e1-bae8-8f6e6ca4c3dd", "value": "06f8f80d7a6c9ba13bc7dd02f97c2c662e11f5bf342161bb9293500a89c7eada", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5819db-6de0-11f1-ae13-42010a9c0009", "comment": "Malware payload (NWHStealer)", "timestamp": 1782094636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782094636, "uuid": "951bcabe-79a4-4397-82a7-c347055bbc2b", "comment": "Malware payload (NWHStealer)", "value": "818f02e595eb7faa11e0812a11c4a110", "object_relation": "md5", "Tag": [ { "name": "bun", "colour": "#5F490E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782094636, "uuid": "ec59d4a6-bd67-4336-ab1f-25b7940de980", "comment": "Malware payload (NWHStealer)", "value": "2c5260360de10f214b6ed6b612ad463bb5341ffd17d4900b50bf607d4e94d17e", "object_relation": "sha256", "Tag": [ { "name": "bun", "colour": "#5F490E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782094636, "uuid": "ba6c82a4-62f9-4953-92a2-62e8dd899ad9", "comment": "Malware payload (NWHStealer)", "value": "2590e55014369f1cc7280596d52e147f3da07065", "object_relation": "sha1", "Tag": [ { "name": "bun", "colour": "#5F490E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782094636, "uuid": "64c411b0-a209-42de-a001-f97cfd04a521", "comment": "Malware payload (NWHStealer)", "value": "067be861ab81666385316c54b49585c64b3067f2b5bc4d5d35ca9ea0c169341abb2ecbc1124c581bbe89ed78b4e162f4", "object_relation": "sha3-384", "Tag": [ { "name": "bun", "colour": "#5F490E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NWHStealer", "colour": "#9B559B", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782094636, "uuid": "a7cd68f9-1143-4b26-b4f8-cf0b60a87f27", "value": "T11F9733DCCD17164FD4F2783786A5FEDAD7C980A0C4A74933646EC36B0ACB9DA211688D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782094636, "uuid": "192df29f-61a0-42e8-b5d8-e82a24916d91", "value": "786432:4GycAlwvZlDIHlBCQhRbCZPULyNQ9ELFMNk4Sd4ZqgQqiyGnJrqPEkMwDAH+n:9ILCQhVCZPq4YUtFKxONqPzMwUen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782094636, "uuid": "05197210-7805-4dc8-bb10-b17b3a443a56", "value": 41926584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782094636, "uuid": "c69569d6-2895-4265-b8a7-28507e0a05a1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782094636, "uuid": "5f208017-d19d-4f8f-a573-ef96b14ccd3e", "value": "loader.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ee2445-6e06-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782110863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782110863, "uuid": "c9ab9423-2dc7-4388-a1b9-ebc929bf5855", "comment": "Malware payload", "value": "4e85a98252e2d257fea5bd92c49a6ce7", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782110863, "uuid": "ed88af3c-06a3-466b-87bc-fe629eedf66d", "comment": "Malware payload", "value": "2de3d98017c6d89237e12941b4de22299a73e028a5328fc01d3738d9ed67ca03", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782110863, "uuid": "102840ba-3e25-49c2-a70f-2926e45031d4", "comment": "Malware payload", "value": "2e4e77d9004f58b24874508c66a686b91081ebee", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782110863, "uuid": "6ba7f372-cd97-4327-8a95-d32102bbc32f", "comment": "Malware payload", "value": "5b2a16ebd30f732d52a4d96e3eae65717700226a8da9ed4441bb72589eab57c62cece6ca6b75207585a52e7e43dd5aa0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782110863, "uuid": "5afe58bf-6941-44dd-aaf5-c82f6933e5c0", "value": "T165136C6566913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782110863, "uuid": "0adc6f5c-961c-48e8-9e09-c41fe1f8523f", "value": "768:hXRWNGxVg9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:blxDco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782110863, "uuid": "cad7dae8-f8ad-4dad-90b3-5ad65875cee9", "value": 45541, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782110863, "uuid": "316d166e-48b1-4303-b0b5-5b0476c6f99a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782110863, "uuid": "80920ef7-fa57-497c-8a77-665ea5cc8b57", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ecd8b72-6e4c-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782140998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140998, "uuid": "acdd71e0-23a7-4d88-98c0-3ab9068e2ae1", "comment": "Malware payload", "value": "37ea837eca297fbce77b5280e3dfca5d", "object_relation": "md5", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140998, "uuid": "ead211f0-32e8-4a90-b2c9-e17b67f6688b", "comment": "Malware payload", "value": "2dee3209d21d07503a3a8047332a3e515b18b8ad5c262bbae40965d4702336b4", "object_relation": "sha256", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140998, "uuid": "52c7c714-8de7-468b-a7db-6857e5ec2548", "comment": "Malware payload", "value": "b6dff40b4cda013d12e4023c3f09acf97ac71614", "object_relation": "sha1", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140998, "uuid": "7baae7c8-f5ff-4690-b264-416ff38dd042", "comment": "Malware payload", "value": "c76f2be007975e172dec7718896d22a8e3f9fc10e949ce7bae1f318e6c0c618675a36f9c8a58a509b3b1a0c96308b4ae", "object_relation": "sha3-384", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "htm", "colour": "#8E475F", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140998, "uuid": "393acae1-6334-439d-bd30-1c638c098085", "value": "T17C6423109BFB7DAC0779F610A26BADC1598D97835040F0CA75E82BC60FAC79696D2C29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140998, "uuid": "cef959bc-7d24-4aac-9e21-61cb30c6b32e", "value": "6144:65dci6dvwpUBl0rzs+alUeop3CBv0cR25yGP3n3pfVbDJ6Qe4XgK5qxcG7qVOwI2:65dF6dvwpG0AUlxCBvdRJOn3pWQe4QLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782140998, "uuid": "090cb963-f73e-4982-95b7-932afba36615", "value": 308236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782140998, "uuid": "18033437-e4ea-436e-863c-3595c754839f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140998, "uuid": "63b207de-8716-42c2-b61d-9b44e896b534", "value": "Bonifico_Bancario.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34d4b8e-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782115343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115343, "uuid": "cd6e2dea-5ef4-4e2e-a868-0c28a6edb4fb", "comment": "Malware payload (RemcosRAT)", "value": "572ee6e985c588c4a66fe7d5ab13ae05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115343, "uuid": "81e2121d-a25a-4558-8374-4d1f8b0154c3", "comment": "Malware payload (RemcosRAT)", "value": "2e4845a187fa3a02cac09ca22d314d3f924c8bf63bf877d23e8645f7bac8cf55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115343, "uuid": "50dcb448-78c5-49da-a4a1-9f3889ca09c9", "comment": "Malware payload (RemcosRAT)", "value": "3b1dec5c00a60dd99a41e9085f8956e2fee6f8c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115343, "uuid": "f740055c-2ba6-4836-a353-0ee9a1633841", "comment": "Malware payload (RemcosRAT)", "value": "de9e227866a568ee75acee92e99788e400f5b0ff153d9427b2fbb86c693d7e43df4edaf785ee64d1f0a56496191fd3e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115343, "uuid": "5574433c-b447-4fae-a6e0-e169437e1b58", "value": "T1D894E0897B80D4AFDB524A729EF2F77C6269AFD13D1102032784374D3F76A6D2B42606", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115343, "uuid": "d8cfc3e3-5eeb-42e4-a925-3f0eb661892d", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115343, "uuid": "6149eb6f-2652-45fc-b716-371c09d9213b", "value": "6144:hLsBN8xoIP1Lr3S8CkVTAqlIoY/53YDDs0PlQcNUCU73f9gMjG5E1v3CuKlbmjQL:SBoBJrVT+QXlQRCq3a5E1auG6xHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115343, "uuid": "1b5f8510-d0b7-4a15-a778-6d6c13392bde", "value": 428000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115343, "uuid": "5cc6259a-e173-47c3-a4eb-c773c203c9bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115343, "uuid": "4751a472-63f8-4ee3-80ae-abe08ca601bd", "value": "ekstre.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906617f3-6e0b-11f1-ae13-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782113137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113137, "uuid": "01e8245b-2a73-4d00-9c26-8f8c723b1eff", "comment": "Malware payload (SilentNet)", "value": "2e250fcc79d103b6b2abbb9d8f2c868a", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113137, "uuid": "732d07c3-4caf-437a-9e70-25b304e27191", "comment": "Malware payload (SilentNet)", "value": "2e77b0706b9b35a589395e12aeb994b6b07fff9bf9f69edc3b8363cdae5e9140", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113137, "uuid": "f2d12a3e-4b40-45e5-9d72-c1da04409113", "comment": "Malware payload (SilentNet)", "value": "f2d338d0a782c7ed72e66ef0bac9adf2a0f76e29", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113137, "uuid": "07e1ff71-a1c6-4ba4-a806-39430eb54b4a", "comment": "Malware payload (SilentNet)", "value": "9f99cd4b9037621e9e970c00a6ae914599c2a6d3980b0d00aded82630284037d1fefea0208809f50a680b107920082e5", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113137, "uuid": "4d851d85-4e03-41f6-b786-9b2fc7fc92ad", "value": "T1729302A4DD02C46CC9131DBCCCA97BCADC9E716F45576C2BF35142A4E4A2E161A270FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113137, "uuid": "959dac50-0667-4209-a4c5-158ed46f8d43", "value": "1536:mtMkafKHZhn/VxShm8H1Q1yPvRBFoVpKP16Z4sNKmzUppxLXKHPwNy3+pjHPEj:mtMBfA/3u1QmvRBFoVpKd6d+pcI6j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782113137, "uuid": "1e42b8d3-37e8-4e66-a36f-1af820975c22", "value": 90311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782113137, "uuid": "25921d73-f1c6-4694-a5a6-4f4e04d78c5a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113137, "uuid": "98d8f842-e4af-4193-ab68-0d41f0729c33", "value": "DonutDupe.jar.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799097f8-6df5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782103649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103649, "uuid": "0b7f74ef-9b71-4f43-b605-afdc918af54d", "comment": "Malware payload (Mirai)", "value": "837e17f7f0c271785f3cec21142334e2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103649, "uuid": "e82017b1-eceb-4632-994f-ee0f9bc78971", "comment": "Malware payload (Mirai)", "value": "2ea382e20ccd7f1909e432fecf9ce41594a3a49e9a1a692433a982d2a778312b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103649, "uuid": "2fe80fb6-60b1-4776-88f1-76f91ea414a4", "comment": "Malware payload (Mirai)", "value": "5632776e1f14abdeb2cf348e14fc5c47e3e224c7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103649, "uuid": "7736b11e-5d95-4111-903c-d3305d50734c", "comment": "Malware payload (Mirai)", "value": "50296f5edbffa76409fe1a5db8b4905e7fc69cfa143dc2770f071064cae288be1c30aa14ff807fb78e5eea6d8371c639", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103649, "uuid": "9e15ffb9-90b8-4934-a832-a95a7dc5103c", "value": "T11C410BD6200107E64F1BCD68FEAA5CDD460E41EEB25B8675CBC0C829F85C6283CB5A86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103649, "uuid": "67d3b92c-4046-413f-aeef-3428d00c097d", "value": "48:a7l1WcWh0GOlQVUR/Th/TG0vHV1EwkjrWxKZdFx3tnIEucsn:a7fWVh0GOlQVUR/l/awHV1E5jrWxKZd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782103649, "uuid": "7d9e108b-b985-4535-b691-02627cee82ba", "value": 1914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782103649, "uuid": "b3c22536-4d8d-45ac-bf31-4cf4a6ed8d99", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103649, "uuid": "1b36232c-5adc-4571-8e67-ec463e012a6b", "value": "adb.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de256d0e-6de2-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782095658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095658, "uuid": "41318c6b-4035-46c4-90d9-57ca3904cddf", "comment": "Malware payload (Mirai)", "value": "873970375886a32afcc8c2a885c4d52c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095658, "uuid": "cb21fced-5dfc-4f9a-ad5f-bb91940b9328", "comment": "Malware payload (Mirai)", "value": "2ec11059183fff0a0da44a9e8a4bffea0d55dd8e31dc966bbb52c5435530dc48", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095658, "uuid": "9b650975-fbd4-46fe-a03d-bc92ca9307de", "comment": "Malware payload (Mirai)", "value": "8ed7ed488f074eb7bcf5cc856b43d07a192ebdf3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095658, "uuid": "39c3e605-19ac-416a-a2db-7b934b849aa6", "comment": "Malware payload (Mirai)", "value": "a6dffa8895325a2d27da485a557eace0942e57107b4841c387c5df352215d6afb0551bf98066723b3a1c2eb1f9a758e4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095658, "uuid": "ca618911-c281-4e83-89e9-47a8ef388cf2", "value": "T198312E9A05155B3A0242CADE737B368CB00CC5FB2C5FD794DD894EA982985CDB262BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095658, "uuid": "e3f56cc5-adf5-4b43-b2f5-c2f141fb0cdb", "value": "12:Ubx6bXDxkIZt5ljr6l/q2XgwB6qpq5hAtL6AtyJzY86oKmgqlM6+nqcHPZ6Pd+t9:GWXDKUtHo/DJkhM8S2sHHAb4cFP+PXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782095658, "uuid": "de1a87de-5a9b-4497-a71e-9f4785cf2a88", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782095658, "uuid": "50b2a27a-0bf5-43b2-b3a7-f7a578e651a2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095658, "uuid": "d85794e0-65b4-4a29-8b0e-32f0db4e8a9e", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ed9526f-6e3b-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782133750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133750, "uuid": "95d70330-4e23-40f5-9b3b-d44c48294e20", "comment": "Malware payload (Mirai)", "value": "6b53409c7a0e26b0777db90b59b9b3a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133750, "uuid": "498fa1fb-8c59-4d33-9862-beff977f6871", "comment": "Malware payload (Mirai)", "value": "2f25ceebd97d6e43373c0e2bb120208c3e0b8f3b9d840ac5970b47fb39741efd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133750, "uuid": "2c9a8b52-f41d-4048-9082-74860688db96", "comment": "Malware payload (Mirai)", "value": "67fd6acadbe9c82f1eb7601d5f9e3a7bc0db3792", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133750, "uuid": "9bfd7a03-06b4-4cda-aea2-3673ef56d7a1", "comment": "Malware payload (Mirai)", "value": "dc22421ee9fd6a98564346d744d16adae7a83fb045272b85f47d3a5d69e2edd26a97109a0b5927ef3d3ba41887da96d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133750, "uuid": "92c1c562-ddee-4413-a903-63dc1a0dd59c", "value": "T17ED2F1907C35A3FFC60AB737092BD82210445B08526B82A675D6A80A4DFEBFC9F1994D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133750, "uuid": "11a585c5-c62e-4ef2-ac14-d57916270fc3", "value": "384:M/nxxQh/ydIlne/a3G3/Hcuz5nsDShztOV2PBxfH1l5hcQRZXiHn2ppWV1NEN73M:2nxxMg6C5nIOzgVGBZH1xLXm2kNEIgC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782133750, "uuid": "7fdd13a0-f343-4278-803e-d4531ac45c6c", "value": 30360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782133750, "uuid": "b35eae4f-23a5-402a-8b6a-ff45e0c2bdda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133750, "uuid": "e8f161c0-6d49-45ee-9130-75b3969a544b", "value": "2f25ceebd97d6e43373c0e2bb120208c3e0b8f3b9d840ac5970b47fb39741efd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a7e72e-6dd1-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782088391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782088391, "uuid": "f62ede1f-c972-4f04-a650-590cd3cb30d4", "comment": "Malware payload (RemusStealer)", "value": "55a2bc9a672184ab0657983b7a8ee391", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782088391, "uuid": "cea3a014-e833-4015-9811-008cb947b020", "comment": "Malware payload (RemusStealer)", "value": "30a67224d05ec98f9412a89018bfebe705d55d36a66e1acaf633713e65f322f8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782088391, "uuid": "d0bb58c6-40d9-4317-9066-31e901eaee3d", "comment": "Malware payload (RemusStealer)", "value": "8bd83a23b58f0cc3188b4ad1d347f927cc5f7299", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782088391, "uuid": "96e69f0e-6f26-43b1-9e92-9dd0e54b1c32", "comment": "Malware payload (RemusStealer)", "value": "2177f7290eaf838535bebb13fe309e6fdec80543693f9534bddfac4ff21156b4e798592b7193bdb7ab03222028df06f3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782088391, "uuid": "5f786a52-c87a-45d7-a439-c6eb83ec2f3c", "value": "T1C326AF07EED54869C49AA23188A39391777CFC441B3237D73F90B6BA2E72BD05A36714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782088391, "uuid": "23abe566-7eeb-49bc-bac7-e620e18540d5", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782088391, "uuid": "6a08674c-7614-4157-bad7-a64b33fc207e", "value": "98304:ELU6IsRLF7WB9JlzU0wbUxp9X6yIdBxCCw:EYRKLFWB9JR0Ujl678", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782088391, "uuid": "8b4f2aa2-2015-4237-b180-6413ad5408c4", "value": 4670232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782088391, "uuid": "27072096-b6ef-4a06-b8d7-a249535d4327", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782088391, "uuid": "5f156aea-29ca-4b6b-b35d-c1ec107661ac", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c8be780-6e67-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782152671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782152671, "uuid": "14f85221-9558-4adb-bbf2-fea83c7ce4fe", "comment": "Malware payload", "value": "0bb7874bfbc2ac43e2b341f232b6206d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782152671, "uuid": "02e8f70a-3f04-408e-807a-3766eb6e354b", "comment": "Malware payload", "value": "30c822a44c228df0c2207bc375bbad7899e1428d996791c1ad796cf8d867763a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782152671, "uuid": "740aad55-d68d-4828-a3f3-6bc794a7b38a", "comment": "Malware payload", "value": "1ac3125e50b62f5389e4c010a3715cd5165a6db2", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782152671, "uuid": "d92a3e0c-2fb3-433e-9f13-3d2413532e10", "comment": "Malware payload", "value": "db4db7024415a9babfb0ed9d55b68b7770f3fff846c367b9fc43e0b530b71bd0a03abf66f180ffb2a01a7d1ce2431afb", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782152671, "uuid": "3732bb90-ed8a-46fd-acb5-19de3c89e82c", "value": "T18201C2CA8150A900411DE65E72EB6290B920C3CF09CA4B78BF9C5D2CF78C904B026F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782152671, "uuid": "49076461-96c4-4b58-a214-d701b05a4944", "value": "24:kXCKysE2hi0ziQvZohaMzEgJRFZOUhBAF7:e9Qp+MsMzEqFcUhK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782152671, "uuid": "20d54927-7c54-489f-9f4a-26b5b9b1c6b1", "value": 831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782152671, "uuid": "dfb15c98-1e15-42f6-86bb-afd860f4ba24", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782152671, "uuid": "91124567-5214-4c20-b9b0-56ae2723a78d", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ee27af9-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782115282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115282, "uuid": "3809ccc9-2c20-4781-81c8-2b8e3f58e72d", "comment": "Malware payload", "value": "566242844be58d9682a7fa46fd189dbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115282, "uuid": "26652695-4928-46b7-ab93-46d992479971", "comment": "Malware payload", "value": "30ea733fad9cd688172ab3a97cddcfed20b64f961b4530927e13aec775575259", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115282, "uuid": "10917944-0cf3-4e72-97aa-43fc24ca1d6a", "comment": "Malware payload", "value": "93ef2146bdc5d44d7f4386a7922290129e8f7410", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115282, "uuid": "faf7a86e-ad67-4e33-a7c4-b789dca129e2", "comment": "Malware payload", "value": "ea55e41579edfaa62e3cd62ea06eae4ea83e71913da2fb7f0eb1bd0d8e89593f5e40b3ba113805527a0eef4055000b99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115282, "uuid": "458e679a-9cc9-4544-944e-c869dbd2a9a7", "value": "T1C80833A5ABC4A4D7D7198733C136DA14AC62FC0D074788EF27A849563E6F2E839BDD10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115282, "uuid": "ca170ed2-97d7-4582-a85d-48b366d0a0e3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115282, "uuid": "26d0ac59-9bf6-4899-b5f3-9103e6f3ebda", "value": "1572864:N9zyznEWOQWPVr6LrtO5SrjtAsIgqTcaNH21A/QE5oeOwJ1crzZOc:N92znEWOdPJKrtOsHtAsg7lx76elKrzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115282, "uuid": "9516d6ce-f372-4269-bee7-58d59357489a", "value": 80374297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115282, "uuid": "727929f4-9d5e-442a-8a57-fcaac396a953", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115282, "uuid": "f8ea097a-03a6-49d3-9e59-d232577db1b6", "value": "566242844be58d9682a7fa46fd189dbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5519b67-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782142055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142055, "uuid": "7e769b85-ddc6-43a3-b47d-330490789005", "comment": "Malware payload", "value": "d76c0065af4321d366d745b67fe3075d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142055, "uuid": "2fe2a418-eaa6-4bc7-977a-8565fbf6fcee", "comment": "Malware payload", "value": "311d54e12ae256738d0e458101e8cb49c61ad87e9baa3b55c212cc2ed988eb2b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142055, "uuid": "4895e954-df56-4b3d-b9e5-8a25bc307546", "comment": "Malware payload", "value": "d364e6560656c1f5f37413483fabca4d0a571327", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142055, "uuid": "4d4751a9-ead1-4df0-9aae-42c942373ebb", "comment": "Malware payload", "value": "5f4b968a393042911e8e8553c49267b04c5b20211e188e2de9ab28de30f55b33da5972cd0df12ed6a4c81c22e615a82f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142055, "uuid": "3d43861b-17cc-438f-bf0d-baf70b68a4fc", "value": "T16141E4D925950E796EA0AF23F3BB85D53181EEC698C17F5458DDB8E4908CE48BE40AC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142055, "uuid": "69158efa-308e-47aa-b6be-39b16a6cb646", "value": "24:vpRX+pqipSmp4CaspkSpbdsphibpmipWcJptGprypump3nB:vGBdvbv8qBfJqspVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782142055, "uuid": "87065ee1-6474-40c5-993e-8994020e7bce", "value": 2138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782142055, "uuid": "ce169ce1-922b-469c-adbc-3d1bb5ccc8e0", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142055, "uuid": "1f50676b-67d6-48ed-ad62-da9c604ad851", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a430270-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141500, "uuid": "6f9e86ca-221b-45c8-baeb-2dfbcc7fcd0f", "comment": "Malware payload", "value": "9d5eb5e0592fc5017e73d67bce9bb2c5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141500, "uuid": "227ef747-c4e6-4ee8-8e18-b33384adc32f", "comment": "Malware payload", "value": "317b82cad1feb6a0c367b0ab5b0eed44928a7f648ca260c0b8b9b99e9e2e66bd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141500, "uuid": "c51ca720-9c88-497c-8719-95d18ce0756c", "comment": "Malware payload", "value": "f8e9efcf98fe2295da2515c276e7e8a140788281", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141500, "uuid": "2bb29258-86ba-4c2c-990f-65ded0d27455", "comment": "Malware payload", "value": "c662153d93213a61efa01f9a09bd4b535b5c8b68031fde836cdd88a1ab0406426d886fca6a9192a30bd653d0789211d6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141500, "uuid": "f6788afd-5bb5-48b0-9895-e38afc63dc4e", "value": "T1CC367D406474A3C71C78EB67D81E3FC73A8F69F35974ED8532BE88799488F0529341AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141500, "uuid": "c7dbde8a-1f67-4f2e-93c6-f543f24ab986", "value": "98304:79Bd2f1s58OWW0rA0zb1/rTgxrx9xevDoDss0M5HoilgvFwWEYGHRrkae2YuHnBv:793ZlQrA0v1zTmx9MDoDswhowgvFwLRl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141500, "uuid": "4d332286-a59b-4f7c-9aa2-68efe5b8e9c9", "value": 5164057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141500, "uuid": "b5511f6b-cea9-4e21-9744-7ff7c18507cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141500, "uuid": "582083ac-0787-4fb6-9df2-5577460b4c00", "value": "Products_List.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c04ecd-6df5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782103527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103527, "uuid": "7f0c69a3-83a6-4423-95b0-4681e095e3e5", "comment": "Malware payload (Mirai)", "value": "6ccd7a789f27d801374e8285d7228c31", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103527, "uuid": "36c2d2a8-f307-4436-9d85-d34e92622e76", "comment": "Malware payload (Mirai)", "value": "31ce2168fbd4fd0f4c42fd9eb59b581384784e363bc0fc07f008076644b42623", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103527, "uuid": "ec4f37a3-1165-4c7d-adba-fb8e52e48b67", "comment": "Malware payload (Mirai)", "value": "d682967dc70d2530ca7b73fa09afd3b227e8ebb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103527, "uuid": "aa0fdcdd-20a8-4e7a-ad14-78def502016f", "comment": "Malware payload (Mirai)", "value": "9ee1994fd9f75725d69c3f0f61d1bde505c720392f64ccce716a67581978378564458f75ebea9e8e593bb2b7feec3c72", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103527, "uuid": "cd40c1ca-4d34-49b6-88e5-c4f34043770e", "value": "T19593AD33C92A6DD4E6519674E4F48AF81B63E50082671FBB19D8C5B95087EBCF2093F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103527, "uuid": "dfab182f-6ebe-46b7-ab47-f83a7457493d", "value": "1536:CGKS0rFc8wtAGzd8qjeCckbJcNcnwCQQjCTFilb76KGUFeo7UzECUvCxuJo99C8K:CG70rFc89GBxjeCcEeWnDWY7dGOmECU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782103527, "uuid": "96889aa1-ff6b-4248-a4ba-d5fb4f08f54c", "value": 95692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782103527, "uuid": "bfbe91ad-300d-452d-b185-248a2c1cf7c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103527, "uuid": "cb6d0ebc-a0fc-4e22-8605-60ec4c6968c1", "value": "nerv.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775b92b1-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141871, "uuid": "572f68eb-65d4-4b97-8fa4-9981d3572fba", "comment": "Malware payload (AgentTesla)", "value": "501c35eb70b8871d0ec135e164f05773", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141871, "uuid": "8fab97b4-abcc-4a09-b46a-3b9aaa4ec876", "comment": "Malware payload (AgentTesla)", "value": "3205d3115baa4425ea811672c5087631297e8a791437b020503351a1b0330a89", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141871, "uuid": "2a39372b-9931-4011-bbbf-0a9250b50961", "comment": "Malware payload (AgentTesla)", "value": "0ac60e8001bec866d8b1c1307f3ac46af138e373", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141871, "uuid": "2fc318b4-7f86-4f0f-94bf-a326d1f3b58d", "comment": "Malware payload (AgentTesla)", "value": "0252f38c4c277a29c8df480ae0cf8899e758900f4be305a43adfbb8b5375895c8ab094e3f4c3ae33dda4fbf27c1d2a2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141871, "uuid": "3db3055f-f950-4f5e-8382-e490a8acce0c", "value": "T128E53A8557A0A2323764D7AD9137EE74980F541328DACF14302EE3287A1CE4B6799BF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141871, "uuid": "1aa494ea-d2f0-46a7-8863-fa5aa7e36bb9", "value": "98304:634rblpmwal4pEUtfjsXVU0oxAwFFptAyJ3MsuYBSqNvrqE8yiqcT:dXmwsOE6fjslHoOwFftAHdY88O2iqcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141871, "uuid": "00fb9990-ecac-410d-9590-71c61c3e6735", "value": 3319945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141871, "uuid": "23707735-0834-4c2f-8a10-577990fa8e48", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141871, "uuid": "a9e51bc4-f3c3-4ab9-a773-cd074c4be348", "value": "Quotation 6000042898 AUTOLIV ROMANIA SRL.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6fc9fc-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141529, "uuid": "2ca759e6-5d9f-4e63-aa67-fec41f77550c", "comment": "Malware payload (RemcosRAT)", "value": "930cb9f58f2af52e24930c69471056d7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141529, "uuid": "cad34b14-9159-4596-b137-6612df5f900b", "comment": "Malware payload (RemcosRAT)", "value": "320e1f0e1ebc1faa07e434e5b76e64078d208adac7ae738e75cb03928a434e0c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141529, "uuid": "a4c2e24b-8637-4630-9748-5aae79fa57c3", "comment": "Malware payload (RemcosRAT)", "value": "a40e38bdd69da84bf0649f790cd898fa3459d0a2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141529, "uuid": "0a05e7f9-f03f-4bd7-9713-783ceb199d1c", "comment": "Malware payload (RemcosRAT)", "value": "e9abab24a117d4361902c6f0b59fd52c6f66b3a314005a6c61e82c901a0b8f9b63c7a08da300eb890da8630b1746aae7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141529, "uuid": "9db289d7-bd9b-4bcf-a274-cf73c0c95053", "value": "T122E5021189C46FB5CF9D5B1D90BE260EE3E00A8E9015798AEB33BD46EFF7604510B1B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141529, "uuid": "aa552cbc-fa06-4152-9e2c-3968b8bb52f5", "value": "49152:aFQV+y9GAsvamveCn1SKgVePRjQk+ZCmz:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141529, "uuid": "29ae78e4-5faa-46df-a085-32c70777c82c", "value": 3263383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141529, "uuid": "2462be47-10d4-4bfb-88ef-870faaaa0065", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141529, "uuid": "4a247ad7-6137-495f-89e9-b928646f8930", "value": "Request For Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36d4b5d0-6e57-11f1-ae13-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1782145628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145628, "uuid": "975d9784-82d3-4fe7-9ed2-500002781e7b", "comment": "Malware payload (AsyncRAT)", "value": "4fdce94b52db5a3aca4d1209c8766efb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145628, "uuid": "916da503-47ea-4311-b1fd-217118d18f6a", "comment": "Malware payload (AsyncRAT)", "value": "329fe66050a30e4ac33af24c1fef4486fee65da730d95fb6d51b9054a24c365a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145628, "uuid": "079e34cb-5363-45f3-bdef-4fc4fab5cbb0", "comment": "Malware payload (AsyncRAT)", "value": "73eb43bca7d90852f0fd1803aa8895e3f15d3180", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145628, "uuid": "a7dbb417-b8cc-4dba-ac27-cd20d9828874", "comment": "Malware payload (AsyncRAT)", "value": "52a856f4b2f49a189fd54e18db86dfb9ee8fa3c910893975f81d0bf3a62508dc973c2a10bd3b57ffec07effb0b4c1a54", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145628, "uuid": "251e2716-4bd5-4b2b-9c3c-cd038c69cfb9", "value": "T1A01412402FCABF854F7445393659FC6F63C96A2F1C02D2DE5805DA3687BBE0D8EA8425", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145628, "uuid": "442b7f53-99dc-4c35-9979-3b3319754e69", "value": "3072:+vKNB9gRAbGxa+o64934Sud3f+eHAMzBbDJoJw2qVaFGkWmvthU:+iH9g2bGUN9IPd3f++1JuJw3a8kWmF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782145628, "uuid": "a65e781c-5640-472b-ae9f-e3093f38ac1d", "value": 194943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782145628, "uuid": "0df13635-34bb-4828-9286-495ba29f183a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145628, "uuid": "519c96a3-c6d0-4554-a7cc-4fc0f3e8d9d8", "value": "ps_wq5h792ftL1n_1782142105368.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e38783-6e04-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782110059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782110059, "uuid": "cb60408d-e4fb-4a41-86f4-beba7a2c9bcf", "comment": "Malware payload (Mirai)", "value": "d4a5ee31a98f370beeb63cfe28908914", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782110059, "uuid": "4c108bb1-7e7a-4350-89db-b5c024f098ed", "comment": "Malware payload (Mirai)", "value": "32f28732b38c43553192b27e648c079b1cbd24372426083ebc6ab96065ed577b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782110059, "uuid": "e723b828-2057-4fb3-b4f0-f1bd797b0f28", "comment": "Malware payload (Mirai)", "value": "ca0b8776ad9330731f19a233794d0cde8b275ee2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782110059, "uuid": "e5a6b741-0daa-457f-b652-3a65e7492fdf", "comment": "Malware payload (Mirai)", "value": "799358ca041d9b5ab6dc1a5f3c81af70139f37326dd5fc4dbd1055f62cfb63103b92a6a168f20eeeae9a80e274946196", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782110059, "uuid": "1a1deae2-482a-4221-9a3b-fe80209ec4a5", "value": "T1F374983399194595E0158CF2227733919D4B87BF88E722D3EE1A5D90FF3142B52BAEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782110059, "uuid": "4174fa70-c75a-4dbd-b1f8-f1de26d5a656", "value": "3072:hHYVUNLFHUWLf1KwjoCrcgWFwmX/VcseRia0ANb:hHyMxUWLAwjoWcLGmX/VcseRia0ANb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782110059, "uuid": "a8056970-87ba-49b3-b7d6-745692dbef21", "value": 343407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782110059, "uuid": "b475111f-3102-41f8-aa7c-011e42502d39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782110059, "uuid": "6f81d46c-5142-4a25-9eb5-e16e5f7afc2a", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b25f0e-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782141459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141459, "uuid": "c4a97925-326c-4453-973d-c16cb2869593", "comment": "Malware payload (Formbook)", "value": "a1b0d87eb544b36839509587b52b9c5c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141459, "uuid": "f97ea98a-7026-41da-9465-034df2d15cbd", "comment": "Malware payload (Formbook)", "value": "331712785d2f4d9f0a25a558d3e8782652c6ec026d96c2fa67bbad0db15e941e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141459, "uuid": "a28d0aea-c061-42cd-9ccd-42b784441c71", "comment": "Malware payload (Formbook)", "value": "8c0c16a7d601f1e395df018cabdcd6970db65351", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141459, "uuid": "4c023740-f708-4123-87dc-2728f78021ed", "comment": "Malware payload (Formbook)", "value": "42dd5e0db92275b221df77b2021e8ca3d9154893fc1a962fa1fe9af5e27e2a1b9aa9218e52151bbfa35f4c450a58c222", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141459, "uuid": "fe7fcae3-000d-49ab-b90d-9f4aa4f27f9c", "value": "T19565E93CDE687C3A63B8CA2E4A9D87AD570732B33A5EEC4D14E1124C4116C51BAE527F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141459, "uuid": "c384ffd8-1cf7-4ce0-89b6-ccaf5f20d458", "value": "3072:VFvAzRjEkomHRDXfPm++o3UrJOfjjv0aIhA3iYg+WCH1adqEEcbThH24VmBBy/KD:HeNEVme1Xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141459, "uuid": "cec08e41-d7f8-4c4f-b02f-043779e8be70", "value": 1546982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141459, "uuid": "59a9e137-307d-41d7-8a7b-f20e58a69ad6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141459, "uuid": "7caf6b6b-41a4-4730-9aed-4e7d72797d4b", "value": "Purchase Order_Data sheet for 20ft.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc0f771-6e63-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782151012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782151012, "uuid": "ac0c3030-cc90-479e-9b07-747fe314e3ce", "comment": "Malware payload", "value": "dfebdae188b3c237f080d724cf8e2e85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782151012, "uuid": "d6c8300c-cd4c-4c28-8e13-67ba5fecd618", "comment": "Malware payload", "value": "332baa267135ea684a1e6283fa7efbeeb9538656b123ee3340ff8c1345ae4988", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782151012, "uuid": "b441804c-cc4f-4d9d-b8be-1c8525069c90", "comment": "Malware payload", "value": "19d04b760e37409c39eb2b3e958471b1c3b74463", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782151012, "uuid": "220f0242-92a0-463c-8eca-d3aca159af62", "comment": "Malware payload", "value": "5e26699b10f04162045b67cb49977c8e34b261efc6363e8bfd307e602c3869d063cc63584f45612a89c1895c33fd2ecb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782151012, "uuid": "39a4b1f4-4e9c-4b83-b20a-6725d49b0a02", "value": "T173F4CE437F40C841D4621E748971CBF99720FC48EA62879B34D6BE1BBDEEAC25E062D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782151012, "uuid": "6c1be9b4-f761-41c4-b5de-ada4e3d3142e", "value": "539462a8f2f20faf88e91f954553265d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782151012, "uuid": "a0fbc0db-7b31-4734-aa38-d14290f4befd", "value": "12288:005JPnh0U1VeVdfByinU04x/8kwc9Ofv1LACL86Hbdp+eq5zmj0xOOW:0UJ50U1MV+io6tcUf1L9HPzImj00OW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782151012, "uuid": "33883abd-9e66-4d5d-b277-6c2c5374cf17", "value": 791336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782151012, "uuid": "badcc9dd-c705-401d-8bea-319a31d12875", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782151012, "uuid": "18d587f8-7772-4017-893f-ba4ff0d3a95a", "value": "Voltix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a63d2f-6e50-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782142883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142883, "uuid": "c925c3b3-2cf4-47ab-a21d-7aa8286ea2fd", "comment": "Malware payload", "value": "1faa00141c6164ed17492e84144f1a66", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142883, "uuid": "f6c73cb8-eac0-43f9-ade0-8eb468a92073", "comment": "Malware payload", "value": "33f5d2dbff7f33fdeb68029a169076bf418dc21a662c38b8235c815c66fe44eb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142883, "uuid": "0730757e-11bf-4b71-b728-77f887e893e7", "comment": "Malware payload", "value": "2845ea0466546f8043f0bdad7ff78093a12a1793", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142883, "uuid": "eb59c0df-2b89-4b8b-ba94-58d978b8921b", "comment": "Malware payload", "value": "e1cba7740fd1a90db2a0892c9bb127de7cc4eb1f14667d66d6f4d0fca70a12a05383664f088b659a0025e8a0ac7994ea", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142883, "uuid": "0a5ad015-d229-4471-be63-5f8d512d1298", "value": "T16B726517F750CE7BCCD8933800A7073062B6E871AB662317261426B51D437C89F6BF9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142883, "uuid": "e63aaa0b-3def-447d-a93e-2fa416f76d94", "value": "192:RLJnSwY49HtgBy0st+XPVjhhbz1LUICMDu/q8nkvi:UgtKI+XPVjrvq2X8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782142883, "uuid": "b8bd32d2-8934-432c-a767-4aabed4768cf", "value": 17360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782142883, "uuid": "421e12d6-7cd0-4f64-ab88-aeab76ce97d1", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142883, "uuid": "26d3c0e6-b46b-4bf2-9f67-428002614d9d", "value": "b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "173d6215-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141280, "uuid": "41c58284-bca9-44b7-8e6c-4acd3a192a03", "comment": "Malware payload (AgentTesla)", "value": "47ccbbc7eb2a6da3de4e3078eacf357a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141280, "uuid": "05f096b9-06ad-4899-82e9-a42877876c92", "comment": "Malware payload (AgentTesla)", "value": "345c5005adad32db067d925928218389412c685a70de995fccbedd15b58e8283", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141280, "uuid": "811a517a-8aba-414d-bb51-c16cea9eeeb1", "comment": "Malware payload (AgentTesla)", "value": "cba24b5d0609213538fdcb6d6096df86cce9a47a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141280, "uuid": "0a4b29c8-fb33-4a2e-8855-d8dddcf8ac61", "comment": "Malware payload (AgentTesla)", "value": "69ac9e2cb627ce9df78840c1ce95bcd549cccc3cf1201bd61782757a215e2ac8a9ce15399c7f2d56d7704d82be87ddca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141280, "uuid": "205d9524-5661-4104-b963-7a10f796e811", "value": "T10D958F6100CB95F1011F238FB2C199AE592B84642AEA6EEB19DD00EA1C7F711F3DD5F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141280, "uuid": "67898500-e134-46a7-9623-e7279df11973", "value": "192:Dl658Bm24RrVNJnIfowCTeBEnrg9xB1nMYt/YOvmlUTTmxw3VRxv5S9HgZUAeCZY:BC0Erc74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141280, "uuid": "85da5d1d-987f-4a6e-8390-9d73942a064f", "value": 1875127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141280, "uuid": "ceb7c00c-df14-4464-9875-46c727f2d339", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141280, "uuid": "fcced188-4a95-49b3-82bb-ec9371ee3b00", "value": "Orden de compra POF0000095.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d16617c-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (SiriusRAT)", "timestamp": 1782141451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141451, "uuid": "11317902-9ed6-471c-945f-290bd3e17adc", "comment": "Malware payload (SiriusRAT)", "value": "75757460119ac9a01665a0e268bab386", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141451, "uuid": "699a51b0-2acf-4099-b266-76f23a45fa64", "comment": "Malware payload (SiriusRAT)", "value": "3483b7680898f8691b352ba248dc962c3e7734e7da76f78dcd4a31e2a2342ea1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141451, "uuid": "8d2a4a07-2b18-4293-bccc-fdbad67f9938", "comment": "Malware payload (SiriusRAT)", "value": "eb2807792d9638986206622279ccb2f62c8a4331", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141451, "uuid": "6b0cac83-c417-4bf6-ab13-f6ce0d04c65c", "comment": "Malware payload (SiriusRAT)", "value": "11e2e25e4e7f1fda7970f820f06665af22a805bfbe437b0d1240aefc07e683131e10f3230ec6e9a9ec39d687a1eb1a15", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141451, "uuid": "86255513-58dc-4d37-9459-0b4172b39b82", "value": "T1B8C5CA68CFA291509122EB169DE22161626F236737DB6D3C347F0FDC1B126F6513AB0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141451, "uuid": "1832f680-f420-434d-9d5a-cbf63e132081", "value": "12288:pPly9JGCkCKvkS9/yx1xs8HbUQyUUU/UCUeUUUXUh5:QV7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141451, "uuid": "0ae188bc-ea7a-4516-942d-cab7f268ad4e", "value": 2700262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141451, "uuid": "0c297c8b-88c9-4605-b0ad-fa89c11e257e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141451, "uuid": "ab056868-ac67-4daf-897e-68484c5931c5", "value": "ET8356296342523.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2289ae9a-6de5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782096631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096631, "uuid": "b1f7a3d1-195e-417c-b392-d03f1cbe3253", "comment": "Malware payload (Mirai)", "value": "caee427aa16d2ec15ded83a7934d7ce4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096631, "uuid": "8448db4b-d7d6-47ee-bc26-4fe676551f7f", "comment": "Malware payload (Mirai)", "value": "3585bbb1adae6cca2e8c084e893cc05c81c11fab54f53c22567bc683aa0f8774", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096631, "uuid": "cf6443a2-6724-4da5-b432-3bcd45021711", "comment": "Malware payload (Mirai)", "value": "958cf6ea61616a5441fad255ef1a4b1e5f1626fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096631, "uuid": "4bc4ee8a-5cc8-4660-8214-0a6adb37a516", "comment": "Malware payload (Mirai)", "value": "87ed4c64414386d69cbd20d26f443f3c0773596cb008e8d929fb82b537b03de7a72bc8a5d458abeba31ed501ef39c34d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096631, "uuid": "dc871202-5061-4b77-be65-6fe38e46d535", "value": "T1A5538D75D15DAEA8C0414AB4A9198E704F13E4C046733EFBEA9587A68443DBCF858FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096631, "uuid": "42a98bdf-353e-4fca-b3d2-6747cad0c8a2", "value": "1536:ragXV1f1Fl/wtknCPQauiufs3Ii3O/qyD6EZeCc:r57f1b/0QHf+Iey6EZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782096631, "uuid": "d3bd57ca-73b2-4711-a21c-60107043b99d", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782096631, "uuid": "4f569709-4421-4817-afb5-bd5459e22781", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096631, "uuid": "dd742360-5c88-4ef6-bf65-06de2f5be25f", "value": "sora.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7cfa492-6e54-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782144663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782144663, "uuid": "e7ab66cd-27ea-44bc-8edc-c65e246b42a8", "comment": "Malware payload (RemcosRAT)", "value": "1277177e9e12414f50182a8bb5463a7a", "object_relation": "md5", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782144663, "uuid": "4f7835c5-6b88-4509-8632-590691f123a1", "comment": "Malware payload (RemcosRAT)", "value": "3832eea5221afb6554def361abd9abed7258c0916fc34ecbd19191131f462fba", "object_relation": "sha256", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782144663, "uuid": "69c9b5eb-9596-4c94-8cea-5e409593aa7c", "comment": "Malware payload (RemcosRAT)", "value": "41b27584362b4fff75ab23fb0caa2968609fd570", "object_relation": "sha1", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782144663, "uuid": "38d8e463-bedd-4d5f-9aeb-caa59402240c", "comment": "Malware payload (RemcosRAT)", "value": "4a685f150117d60ad9dd23a9c75642a86edf974c8c63cd7195ea125755eca0be5b5b75acc121f47160586cc2d2a26e12", "object_relation": "sha3-384", "Tag": [ { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782144663, "uuid": "f6978a08-4bd0-4196-ad03-671b03934a9e", "value": "T1BB34128DFA1AD811E1D646374502E9F475F02D8A24833863C2D6BEA7FD8E6D1FAC4542", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782144663, "uuid": "9f4ca302-6696-4ff8-a9f0-ff1fdebc848b", "value": "d088a458e3bc38146c36192dbe7cb4f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782144663, "uuid": "c6da3807-d9c0-4e78-976d-f07261b024fe", "value": "3072:aIbA1f6jEiCmry9X82uyy8l4H+r4O4jSLxmZ9mklyNwn42KrUzSe5T71x5SfXaKv:K1SjQmry9eJ+r47L42KgpP5SfWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782144663, "uuid": "32c53640-7661-42c3-85ff-778fb6463b83", "value": 244736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782144663, "uuid": "c954d16a-c059-4fd6-9e5c-cb70b7b8f632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782144663, "uuid": "9a571f2b-b051-4f18-bda8-e9ce913fde73", "value": "66lottery.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95032a4-6de6-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782097421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097421, "uuid": "fd287096-41f8-4cd2-911d-da2df58890b1", "comment": "Malware payload (Mirai)", "value": "bf70855b305c11f43cb5d94f0c2488f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097421, "uuid": "ce902b8e-3d15-490d-92d6-6fd3bb2e8ad3", "comment": "Malware payload (Mirai)", "value": "3838403ebb9150e24ab326f6b72f3dabab0804d5ccd83a5805a2fc1a48cdf27c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097421, "uuid": "2c98265c-46b2-4b4b-a149-fd67662e68d5", "comment": "Malware payload (Mirai)", "value": "96b284f26cb4d36606c5bc18628b2afc51c76fb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097421, "uuid": "ee2e1076-4e98-47c4-b080-b3d9a04836f3", "comment": "Malware payload (Mirai)", "value": "e60498f7be90598fb3234080bd0580b99f160652789c15dd486a1e41038a191bea8e6eb724b163e5a7abf0fb3c77b8fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097421, "uuid": "710d5fae-8e18-47a7-ad9e-858520878f74", "value": "T115630891B881A626C2D1537BFA6F008E372457D8E2DA33139D255FA0778AC1F0D57F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097421, "uuid": "2ab18de3-656e-4850-921b-c8e942566e0c", "value": "1536:pOTAiIYaMBktkIwn8U0yaPSmuSt8M8fhWtu5v36L:pOTAiLaMH+uSerpeu5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782097421, "uuid": "7cda0a9c-54dd-45d2-8090-654dd200c166", "value": 70856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782097421, "uuid": "75af5ba9-f2a6-4a41-a385-02cbf302efed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097421, "uuid": "c1c40be4-d055-4a74-8ce0-d9f0628ad8a1", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92581edc-6dde-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782093813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782093813, "uuid": "3f219bb0-d3d9-4e8f-b556-22bad17cedab", "comment": "Malware payload (RemcosRAT)", "value": "862ce69fbc11bac8f9f122cd40967f63", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782093813, "uuid": "cc6c7bd0-b4d8-42a0-8e5b-013509ace820", "comment": "Malware payload (RemcosRAT)", "value": "3898a662f25925b6b46700297832940cfc026f5e59815fe670328a0213094a3b", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782093813, "uuid": "b760bb43-111f-40bd-a1fa-49b4894ad204", "comment": "Malware payload (RemcosRAT)", "value": "7f574cc31b6a54f454d962344969a55bf64f8afb", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782093813, "uuid": "2092b1b3-af5c-4ffc-adef-311e017b5e04", "comment": "Malware payload (RemcosRAT)", "value": "215f5ee11aac8ab859788a7a29e5066915c11f7b0f8473ffb028f8d86a9feac20a5caac28ebf1e4b1368dfd9931593cc", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782093813, "uuid": "3ec0f4e0-d4de-4e7b-9cbe-69307dc69362", "value": "T106934A21CE6403994E4B17EDFC961A61C9BDC619013310F5FEEA170D600A9ACF7BEA6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782093813, "uuid": "bdbdd086-bb1e-479b-afdf-0f4c9ee8dda2", "value": "1536:v2A74T55qnFOTrslIasg2iE+ZQOAKvLhZjucflo1pkJUzQfH:vB74T5MO3lipZQOAKjTjuIo1WUzQfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782093813, "uuid": "b806b96c-1754-495b-b7b6-ffa80d396960", "value": 96533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782093813, "uuid": "3afae096-46e9-438b-89c2-d56348b67fb7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782093813, "uuid": "dcf98062-7f8b-49e6-9667-37f1af467ca7", "value": "Requirement.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b637b869-6e4a-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782140258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140258, "uuid": "b116646e-574e-4b79-a94a-8eee2675031a", "comment": "Malware payload", "value": "73f8b1defc80ba1c97cf9c30f26ffaba", "object_relation": "md5", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140258, "uuid": "5ba24900-4ab8-4bda-96d2-e2299310237d", "comment": "Malware payload", "value": "38ac227c825ab5a013ac64a5167abef0e82210792e04d5ad2b8519b91bc0ad53", "object_relation": "sha256", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140258, "uuid": "8efad953-438d-478a-8010-60ceecf5df6d", "comment": "Malware payload", "value": "b1500c00134b08507ce99ca4af5f5dfabf5e1157", "object_relation": "sha1", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140258, "uuid": "12de2aac-004b-4035-8e22-1eabfd4438a6", "comment": "Malware payload", "value": "41d182a94ea33ea75e96b8aa007afc8dd9d63d3af2a3e7bcc9b59f5d896003fffd31e3e8155e5b942ed32d2f3c914e35", "object_relation": "sha3-384", "Tag": [ { "name": "docm", "colour": "#502578", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140258, "uuid": "2a574670-5e97-4246-bdc6-35d87388d9a9", "value": "T1B984129DAEA64F90D0E883F00128BA337709D9F6D7CFE72F304E2D7A2B6462D6551254", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140258, "uuid": "3499e924-e050-46b5-a427-40b7dc0f4a48", "value": "6144:6pIN2A8OShfqT7xlIOEGG71alLrVaVOP6RkzMjyZH4i19qmBXCTNC07Fw7gDQF0h:6pIN2AdjVlIXN1alLRFEkzMjyB0mBXqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782140258, "uuid": "2c9a52f2-a00f-43b3-a8f1-6d81850f8b22", "value": 376730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782140258, "uuid": "20ba8032-4a3c-45c4-92d7-77799d56f9b3", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140258, "uuid": "6c6dd9e8-060a-4a63-a1cc-626e6d8ae9ed", "value": "Purchase Order for 20ft.docm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81507f07-6e79-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782160356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782160356, "uuid": "1d91f605-d90d-48ae-9331-0dee8e92c9f1", "comment": "Malware payload", "value": "43e8d15cb7ffae0bc6280add98d6f31c", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782160356, "uuid": "83b2a94b-b3f4-4509-b8f8-eb70c9ce41e4", "comment": "Malware payload", "value": "39614a5587a9d13d814d70c6855834f61107ea7d9a1c1716237946cb595fa8c7", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782160356, "uuid": "b0255704-dd0f-42b9-94d0-0d04a04e4452", "comment": "Malware payload", "value": "cf5674419f1d22cf4b011b2fb7a8b7fcf56b77ab", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782160356, "uuid": "6b4ab598-7b38-4e7b-90e0-7b66d21c868a", "comment": "Malware payload", "value": "cc77cc76bb8003f541f2c23af6ddc75249b63cc1ef74614b6dcab57c36ce881df47aa43477c7c0fd46046ef8e93ed570", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782160356, "uuid": "33f5decc-4252-496d-940d-186adcf972b9", "value": "T1BA9533C11C2CBD8BD0C95F7299695A61B23795CC0C6A8B3BA24BFFCD45E26853DF1026", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782160356, "uuid": "f46ef867-4f44-4f1f-9324-c2c028842ba4", "value": "93f5418d49b9d5fa371bd3c33af0387b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782160356, "uuid": "f26bbef7-8387-48ba-93c9-33f0bdce8c3b", "value": "49152:S+/VDPuKlLmr6PNt85s2ToFkeJCFat05Yq0LdEIXhNaPRAUrl:S+nlWt5TCFJCFpq5dEasyu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782160356, "uuid": "97b09c58-a409-488b-a829-8eabf1f40354", "value": 2000408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782160356, "uuid": "ebe36589-c7d6-41e6-a113-d786916ed5e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782160356, "uuid": "1ec745c4-0375-4d41-bd51-d7eb5965d919", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383ee197-6de7-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782097527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097527, "uuid": "2068208e-88b4-4f0e-80c0-b55abbd43f28", "comment": "Malware payload (Mirai)", "value": "ddbc9edf3723f92a749154b93aee403e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097527, "uuid": "3244de4f-48da-4141-b68b-8e1f6436a70e", "comment": "Malware payload (Mirai)", "value": "3a016609b672a54877b85f589ebf5ced4ee41503c850d5798fce36325f20f96f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097527, "uuid": "ae784f50-b963-4d62-b40a-b0e719e6551e", "comment": "Malware payload (Mirai)", "value": "b2abcaddbb7da2723c4591109c79e21d1f92bfea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097527, "uuid": "80c3700a-48e6-4cb2-ad6f-a74c5740233e", "comment": "Malware payload (Mirai)", "value": "e9a87460cc603a32c43e3a7044d479205298a3670a593e8e68c0d630443ef6782ab263877b51fb1271dd18e9717c9b2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097527, "uuid": "2ac9cb6e-da66-4eff-95ff-cc82b298b6f9", "value": "T1E1245B43EE890ADFC86BCDF086BE83AB1DE7559B48C1F2F5447C8C4C745D28956A3688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097527, "uuid": "e18b5619-b2b4-42cd-82eb-7892710efff2", "value": "3072:xK5B+osGSVQkCzq3/hiOZgldQ/ek3uSIyLrj6laktvzS2fksDrq4+qzi:xKnfsVMi5cQbNIyLrjq/vb3Drq4+qO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782097527, "uuid": "40982abb-be52-4355-baa2-db9644d0b379", "value": 217416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782097527, "uuid": "990bcc24-865b-4eaf-87b9-471091dd2447", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097527, "uuid": "35158ac3-f407-47e4-9ba0-d17cd7ad95ec", "value": "data_mipsel-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07411389-6dff-11f1-ae13-42010a9c0009", "comment": "Malware payload (BlankStealer)", "timestamp": 1782107753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782107753, "uuid": "81902647-1655-4a75-8d76-52f6c57d25b9", "comment": "Malware payload (BlankStealer)", "value": "b9aecfac8f9e76d6ad2b512cc30b2a31", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "BlankStealer", "colour": "#7BCFD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782107753, "uuid": "8fbb4790-2421-4bcc-890f-9e5f1ac4a003", "comment": "Malware payload (BlankStealer)", "value": "3a9135be5e52f62e7d36c257a9691e5c20ec0d526af39ea22fe7c3ec379fd8d8", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "BlankStealer", "colour": "#7BCFD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782107753, "uuid": "0fc5af66-55d0-4f8b-858d-5c08cb5a4c4a", "comment": "Malware payload (BlankStealer)", "value": "27e60d483222c3254b33ff80959fc1e422c74b28", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "BlankStealer", "colour": "#7BCFD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782107753, "uuid": "76f71e36-b7d2-4108-aa24-1b7160dbe701", "comment": "Malware payload (BlankStealer)", "value": "d37b44b4eed65686be91e6b020485cca3d62c51b829b65d62addd873f5e7da566dd807d0cbfc430d1a4d7a187fade2fd", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "BlankStealer", "colour": "#7BCFD1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782107753, "uuid": "176cf809-7493-4ac0-acfd-4e566890ab90", "value": "T1B9F63305672521E6FCFA493E618B6984D535B8312BB0C6CF13B987241E576F08E3FB4A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782107753, "uuid": "927fe83b-b112-4157-b860-04198bd6420f", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782107753, "uuid": "52c9e003-dbe7-420d-8a07-b5e9279b9d3c", "value": "393216:dk+SayfcByDCF2XnMPh56igzAgSoIusHfb2+dDx:dk+SffwyDC8AP6N8gSmSDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782107753, "uuid": "56be19b6-460d-4f78-96a1-66a6a46ca528", "value": 16720335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782107753, "uuid": "4c33cd2e-962f-4d2a-a091-6dfa88b189af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782107753, "uuid": "08131efc-ce2e-4504-931c-2df1aaec7ea4", "value": "FC.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "604a2814-6e63-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782150852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782150852, "uuid": "eb72b4f6-e87f-4cd4-8fcd-79de33b84801", "comment": "Malware payload", "value": "a8619784bfe927e551e831d4adaf8ba5", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782150852, "uuid": "93b6c76b-a229-4ae5-9813-9820ae3cfa56", "comment": "Malware payload", "value": "3ab56c9fb6b7c404c1e5b36788959c877ea819fb124c3847fa0498e9915ef9a7", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782150852, "uuid": "df3dd045-2511-4fea-ab5c-014ba385f164", "comment": "Malware payload", "value": "1a5f6531962a08b29c8b5f1572383b52434f1428", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782150852, "uuid": "627bc2a8-f70b-482f-bc9d-4a41b4bda167", "comment": "Malware payload", "value": "7fc22fa18d21c004b911d55fa082ea7b9be39c776725bd1d40cd6591730734763be2d3503f3c20b436b5141c362667d5", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782150852, "uuid": "80083911-aea0-4c78-8735-9027e56eba03", "value": "T137F46E36EA6800FCE077C279CA664D13F7B2B84603716ADB07909AA61F176D45F3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782150852, "uuid": "28228eda-376a-4fdb-a9a1-d61218d83805", "value": "a1473d612f2a3526dd38dd97cf1d1992", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782150852, "uuid": "8b779715-ca66-4709-af60-f194de5e6607", "value": "12288:w43c3JDEcd2nlZNG8Qy8cJyQNSUeMJ0e7nARq2qPeori+:D3car0FiJf9nGq2qPeori", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782150852, "uuid": "5795a3db-b0fa-4b77-b8af-78f82a02a7af", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782150852, "uuid": "9bea0cc8-ed84-4437-8b29-78e3d5b77867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782150852, "uuid": "55af49a7-1251-4eb0-b99a-cd0d2416d2c7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efffe73-6e45-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782137830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137830, "uuid": "5d140797-f78e-4a36-b387-e07017df5f66", "comment": "Malware payload (Mirai)", "value": "59b98f52977620c5e3356981226afc7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137830, "uuid": "dfff9cf2-8fb2-4596-b08d-bce7655eb594", "comment": "Malware payload (Mirai)", "value": "3ad48bae18b7ea8e7ffe3608b6eeaa4673b6ff47e9e6a21def774eecba66364a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137830, "uuid": "cad04754-83df-4897-99ad-44ac2127e8fd", "comment": "Malware payload (Mirai)", "value": "95940e97688109bec4bb27124828abff8272119a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137830, "uuid": "f5d92baf-f6a5-42e6-8ea1-4e82b4c891e2", "comment": "Malware payload (Mirai)", "value": "777f18161e7176cef091859fcfb9b38d99a83540121c8438242bc3b92d2c489e949952562bb2e4234ecd45e64b8a5792", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137830, "uuid": "9abf436c-95de-418f-aa55-3c213d39ee5c", "value": "T111C329C6E347C0FAE81508F1216BB73299B7C13F542BDA93EB654D61BD529828036BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137830, "uuid": "92a92129-440f-450b-869d-3378568deb58", "value": "3072:P43/Qco2DWxDoB7SFM2L3GeCxDYKDen621IS:P4vDDWtoB7iNLQle/IS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782137830, "uuid": "c3ed9b67-3b7e-4577-adc1-d6a6c0fac6f9", "value": 124180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782137830, "uuid": "38bd84b9-05d0-4cb9-91cc-851a753380c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137830, "uuid": "fa82ae6c-f9c3-4a43-840d-bc41c5e294ce", "value": "3ad48bae18b7ea8e7ffe3608b6eeaa4673b6ff47e9e6a21def774eecba66364a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f7de18-6e29-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782126004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782126004, "uuid": "6a20a0bc-68fc-4708-94e7-675f4f4f59e9", "comment": "Malware payload (Mirai)", "value": "4e6bb012211903b572f54bb9fa6cf3f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782126004, "uuid": "a43ce7bb-734a-4773-a122-2d87aefe8374", "comment": "Malware payload (Mirai)", "value": "3adcd5178028d79745ea68d32b894d03cbfa80c11aa3cdbf8b16a74913e471f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782126004, "uuid": "79a09334-e966-468a-9140-c5dc03ba95f1", "comment": "Malware payload (Mirai)", "value": "a66d78c14ed33a591a9cde971cd0b8ae660def62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782126004, "uuid": "52dcc746-b041-4512-b4fa-d3ccaa4bf838", "comment": "Malware payload (Mirai)", "value": "ea0bf19c73047fe51e3f19c3d5282aca2c980fcc795ca40a04dd521f2e218d7a5bec995761c4411663bfd69273e6c2f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782126004, "uuid": "8176e6bb-d770-43dc-bec7-216cacdbfd3f", "value": "T1F393181AB881AF51C5C6057AFE1E534E335327ACD3DE7213FA14AB2C378B55B0E2A152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782126004, "uuid": "f81522c2-266c-4284-be78-63f3c5843d4b", "value": "1536:dAnGtC2RUDHBFakNF0eKQwFMMMMMMMMMMMMM0On8R4cwV4Dfi2P8xQMIaHcfFZr0:nFehFLF0eKQwxC4nP8xQMIaHkDrzHlH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782126004, "uuid": "846ed700-0eaa-4b75-9cd7-a9e3fa545b60", "value": 92972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782126004, "uuid": "19e27585-286a-4795-8ebd-93ac936c53ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782126004, "uuid": "5d910c26-3280-4375-ab85-b36ea83d5fe6", "value": "XKw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "234cfa4c-6de5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782096633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096633, "uuid": "b8a68698-aa36-49af-b12d-6ed4b4792981", "comment": "Malware payload (Mirai)", "value": "e887f45934e73f7257aa5fd81fb1cba3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096633, "uuid": "11aeb25f-1340-4752-be4d-414def9e6119", "comment": "Malware payload (Mirai)", "value": "3b11d33e8f3ca26375350fe631f78c09d42a017d156c8022b74c4a9c280c1381", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096633, "uuid": "42a8eaf6-ae82-464c-bcf3-20114527cee6", "comment": "Malware payload (Mirai)", "value": "99892a76c13ed20a478b8843e65f33764f691df6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096633, "uuid": "cae9ec8b-2860-4505-a449-b69e453a6cc8", "comment": "Malware payload (Mirai)", "value": "5c3036a995645a1fc6fecde4f23d46c9874996916186ce6509b2c8cf75eaa02b69d9f6676d37fc9473910a6c99f9edfd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096633, "uuid": "cc924085-d498-4f95-97f0-a18f1c37632b", "value": "T1F204E50AAB610FF7E86BDD7706E90B0528CCB91B15A53B797538EC18B50B18B49D3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096633, "uuid": "d3fce3f7-ebfd-4e56-9eb4-43f777489588", "value": "3072:Q/r7lPt/EHPwNQqIqjKQ15Rp2/+aBAIBBrE:QVqWQqIqjKQ1BA+ai4E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782096633, "uuid": "79984669-f67a-4e44-8cff-7826a8634366", "value": 174504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782096633, "uuid": "65df2e8e-bcf6-4f89-9629-39b7920fc933", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096633, "uuid": "23f397c4-1772-475f-9508-0a6a61dd016e", "value": "data_mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd62b5a1-6dea-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782099039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782099039, "uuid": "67c00920-e37c-48db-888e-29111b985fb0", "comment": "Malware payload (Mirai)", "value": "ebe31d53fe27dc0a0981a772d397410e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782099039, "uuid": "4d266b05-65d4-4a92-b5eb-c25b9bd0e5b9", "comment": "Malware payload (Mirai)", "value": "3c685414f77a1f913c1cf41c95c1bf74c067687366be3d451db9b4dd1b1631dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782099039, "uuid": "7f894d6f-f5dc-4820-97fd-00fa81e2e027", "comment": "Malware payload (Mirai)", "value": "d41306b4b0d37f8376ddcfdeffebedfc888aeff8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782099039, "uuid": "63e3a211-8af2-4a48-b038-ee0d5caa052a", "comment": "Malware payload (Mirai)", "value": "d3fbacf4297a57da84b9c35bcc13716fd01ae05cee3ef022a000f6aeb692a06df8cc822678661d7708f1558d84e2c8f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782099039, "uuid": "284609b1-f75b-4c3c-9573-4361fe03d36c", "value": "T1E9D31952B9528B12D1C311BAFB9F518D33136FB8E3ED32029D246F60678B9DB0E76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782099039, "uuid": "24d3a759-a723-43b2-b214-6e88aa4f4ed1", "value": "3072:8VavE23NpT9SmpWXWP6yGAXW/VxoM79PaYjd0BfsqO5rKK3:8Ox9pTYmpWXK8Vxl7NaCYfspKK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782099039, "uuid": "146982ac-de5d-4420-8114-634dd13528ea", "value": 138012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782099039, "uuid": "7947a832-9857-4389-9436-a90a57297763", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782099039, "uuid": "0de28738-b545-4e14-a9c1-9c464e852548", "value": "data_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c374c1c-6e1d-11f1-ae13-42010a9c0009", "comment": "Malware payload (NetSupport)", "timestamp": 1782120807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120807, "uuid": "813e028c-b5e6-4fca-a465-ec2768e5938e", "comment": "Malware payload (NetSupport)", "value": "7b6dd46c5960165fffb9554f1d686972", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "gatehostip-hopto-org", "colour": "#9A0AB4", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120807, "uuid": "d984fe69-c794-45ae-bf7d-c69e8a0dcd20", "comment": "Malware payload (NetSupport)", "value": "3cb9e0d74cb2ddba6a150fa6957dfb314b750903fc95415ce1e9b7824e0c50ed", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "gatehostip-hopto-org", "colour": "#9A0AB4", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120807, "uuid": "a463c369-305a-41ac-9ec4-f01280110c29", "comment": "Malware payload (NetSupport)", "value": "0f5d2b2818588b1451b3a940f3315f377075a550", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "gatehostip-hopto-org", "colour": "#9A0AB4", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120807, "uuid": "a4868441-8a24-4f0a-a861-650ffd96b0bb", "comment": "Malware payload (NetSupport)", "value": "2147cc788685b7a104abd564991bb6b7139280883a3bd9aa5f0aa35ee83bef9d45ac4028a503c960403d6925df1d1fb2", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "gatehostip-hopto-org", "colour": "#9A0AB4", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782120807, "uuid": "dff14ec1-a593-4a8b-b251-a16c99b57c1f", "value": "T102263332458C8F18FAB2E4A9745862D1878B7F5ADF93BB98507AC8303C535508D7FC9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782120807, "uuid": "16236920-b09c-43af-9484-8d1b07543041", "value": "98304:uwNpf+zCPtp/1Vf6biuSHBdrcVn3NzwgU4g:uwP2zC1tKDS+3Nbbg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782120807, "uuid": "2b6b2e32-dc05-4c99-8b3b-d8da1200bced", "value": 4602383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782120807, "uuid": "fab099cb-531d-4550-a52a-8f76ab5c8052", "value": "application/vnd.ms-cab-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782120807, "uuid": "4119a3b0-6710-487f-bf6c-740f3d816f9c", "value": "3cb9e0d74cb2ddba6a150fa6957dfb314b750903fc95415ce1e9b7824e0c50ed.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da892634-6e94-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782172102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172102, "uuid": "cc039fc1-e926-4043-bc4f-7e2b6e5e0f38", "comment": "Malware payload", "value": "bc1f1de84a9d5688fc3fb041999caf2f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172102, "uuid": "e3cd804e-5aaf-4603-ae6d-be6a3c2488e4", "comment": "Malware payload", "value": "3d3342af3608399704d5daf9dc061ad1f8b243531fd9ef8497a10c6a9dd59661", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172102, "uuid": "8514caf3-7ea3-4b86-9884-3fb2824e80cc", "comment": "Malware payload", "value": "cbbc4a0f85ccafc1f3d1ee331fd237db5684ac4f", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172102, "uuid": "b4adb455-27e9-4bc8-855d-881b8b910219", "comment": "Malware payload", "value": "681e9034b87fb5e35026d4ce6430f127e85bb7df65e393f5d826f5a441d6d1e7d45af2bdc3f449f195ec55586ddc5b3c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172102, "uuid": "41f8071f-a8bf-4a65-abf6-31d9b59a36f7", "value": "T1E334CF2D31E35EBE4575884EFCD1C603BF7AC8C20A2565DE97CF81A63B9F09646B8811", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172102, "uuid": "faf56b8c-c0bb-456c-9ae4-167b823da4f7", "value": "6144:lL9E9TXFNYczfB3XylQ9RBT6nWpHtphtKg+p/kSFMHoXoxsz:RW9RWcwlaRB3MgGk6EoZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782172102, "uuid": "b26958bd-9faf-402f-ab21-cd458bf172c0", "value": 243848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782172102, "uuid": "a23e0fc8-f0a6-4e95-99bd-a1bef12b2947", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172102, "uuid": "08c33e10-14f8-4734-b92a-fdc465ab122e", "value": "54vqGM272JxQmtlr.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92ac110b-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782115288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115288, "uuid": "ac6cb418-9650-4765-82a2-9a49e8c8b2ae", "comment": "Malware payload", "value": "65a7938b2286f32dc941f6a6f5d3465d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115288, "uuid": "00453c87-23af-4d4c-8e5e-23d1abbdac07", "comment": "Malware payload", "value": "3d8a017c73cc2eda5238f0910005708dc114dd4a16a511339c8d12071ab9d23d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115288, "uuid": "95854995-1921-4e81-8756-bc43a067c358", "comment": "Malware payload", "value": "f3bab80cd8ddf3bf17c225b0ab2e2bb46079a25a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115288, "uuid": "1c3ed4c8-919f-42d9-b4ac-7dd5fdcdb9ee", "comment": "Malware payload", "value": "df182d0380a9bb537ac37885a3e1425c48cb77e48c948cbb82fde835b7ba4859d9c2aa2056a0dd649e2d0c7a0be25129", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115288, "uuid": "4f35955b-8b46-43ba-9f0d-083130487890", "value": "T11717335067E018BBDAF65A7AC036E16891A2B4124B81C1EF5BFCD31A5F6B7E03D38D05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115288, "uuid": "bcf3c8f1-f178-4617-859b-0033fb27c56c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115288, "uuid": "546bcd7b-87ea-4da5-94b0-c16d569639c1", "value": "393216:785vzasFl7dCR1C99OXr8Lg5lQbZklOIl2lInEroX314S2kIn8vaxbc50BcPmT1S:I5vzJFlUR1OOb8aQQLErUqkWMaxA50Bu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115288, "uuid": "42066384-4d3f-4f5d-a712-515dd63192ba", "value": 19291319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115288, "uuid": "fad24482-e504-43b6-b682-db3736dfe083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115288, "uuid": "0b1f5353-b601-4c0d-bd46-f927c72d9470", "value": "65a7938b2286f32dc941f6a6f5d3465d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b2464e-6dff-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782107780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782107780, "uuid": "69e8c2b8-2b20-4841-b7b5-9f1b6444c262", "comment": "Malware payload (AgentTesla)", "value": "b8f1126c730462f455993dde2d787c35", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782107780, "uuid": "ae8a4423-eaa3-45ac-96e1-20625d5a9aee", "comment": "Malware payload (AgentTesla)", "value": "3dd7e1077e79e24df730c864f727b0e2f7668f078ce084e3ab021b8c9dc645f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782107780, "uuid": "1381cd62-79e8-4718-8816-1f53ecc5f710", "comment": "Malware payload (AgentTesla)", "value": "e666de126ddc30860341e761afbe1a15393d3df7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782107780, "uuid": "e5683c77-6943-442c-871f-521e217d4b36", "comment": "Malware payload (AgentTesla)", "value": "1265ef105a1864957c6779a26b97daa1ffdb9c1088286c7a318d0c94a9d75a294c78b733dec1fd7554c59f56b7fa89a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782107780, "uuid": "2f099ff4-5622-411d-ab3b-f6e3a39a1ef4", "value": "T1B384129550E0D036C9F85632C87357F96992DE14DC714A0B3BE6BE7638B22C1AD1EB31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782107780, "uuid": "3088b2f5-504b-4de2-8722-2bc97ffe890a", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782107780, "uuid": "fb6ee2f9-4e45-4246-b3da-c428364fdd6e", "value": "6144:5Mm4CCEv3liZFEDwxQRy4Cm4k2WQ5s9Px75X0YufIcYrYn0TlvQFvP40RqC4kY3I:5Mw3v3lisDpRfr4c6iPx1HBV0nEU3RKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782107780, "uuid": "6c3ef8e1-4bba-4b36-804e-391414f24722", "value": 375712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782107780, "uuid": "ef6e0fc6-739f-441b-9a0b-939642abaaa5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782107780, "uuid": "11f30955-074a-48b0-a963-393bbc7291d7", "value": "Directrices de pol\u00edticas para empleados 2026.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b65d72c1-6e85-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782165599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165599, "uuid": "dafa10d5-59bd-4857-bfbe-81dc80bbca45", "comment": "Malware payload", "value": "40b80637dfbd89cb5f4e90f74ec12341", "object_relation": "md5", "Tag": [ { "name": "213-176-73-130", "colour": "#A67B84", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "github-com-Nightizi", "colour": "#3E214F", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165599, "uuid": "efdf6687-f96c-454c-a07b-3578a7dd56de", "comment": "Malware payload", "value": "3df42b6f82cb5ae54a014acf2ad5a137bd0821310cbd23c06009b5419ecb3693", "object_relation": "sha256", "Tag": [ { "name": "213-176-73-130", "colour": "#A67B84", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "github-com-Nightizi", "colour": "#3E214F", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165599, "uuid": "b49b7ba2-374e-4af7-b087-1ae57c197976", "comment": "Malware payload", "value": "02640babba6a592c83dc745d3e8f462a89e45a7f", "object_relation": "sha1", "Tag": [ { "name": "213-176-73-130", "colour": "#A67B84", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "github-com-Nightizi", "colour": "#3E214F", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165599, "uuid": "24093f4b-0f69-41a6-8b0b-4fc1f3a364cd", "comment": "Malware payload", "value": "2443ba7b88bd83e438d24a07bbabed096a65d70cd7e95bb5d1c1190043a4634bac3b9fd6caf27cbba1c1e772f8a04754", "object_relation": "sha3-384", "Tag": [ { "name": "213-176-73-130", "colour": "#A67B84", "exportable": true, "hide_tag": false }, { "name": "EtherHiding", "colour": "#0F1259", "exportable": true, "hide_tag": false }, { "name": "github-com-Nightizi", "colour": "#3E214F", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782165599, "uuid": "577cecf3-294e-47b4-9002-686381d4d40c", "value": "T14FB4237B0A7F70D00C6A43BA8B468611A43D9D621628AFBD47DCE6CC8D0E51EBF14E5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782165599, "uuid": "a3cb07de-73d1-4821-8525-615a49971210", "value": "12288:p4lhhLoVDI2FLmMJKreqO3g/ALyYG0ZaDajTCXMO8xzDOeDBV:2xopIAmMJjA/f0Za6TCXKBxFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782165599, "uuid": "579a3438-f314-4c1f-a2b7-e84b15248958", "value": 541353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782165599, "uuid": "c902160f-cd74-4254-adca-3b7e79070b0d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782165599, "uuid": "03b4ca2b-f2f5-404a-82b3-59767e67f973", "value": "3df42b6f82cb5ae54a014acf2ad5a137bd0821310cbd23c06009b5419ecb3693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1a450ba-6e5b-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782147660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782147660, "uuid": "f933191a-e29a-4835-96d3-9b35c07d0201", "comment": "Malware payload", "value": "4d0cf3d4439760131bcc9c86c3263e61", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782147660, "uuid": "68376f65-ca95-4a90-8224-0ac20a441b5e", "comment": "Malware payload", "value": "3e6661d8c7c86d181f5f5176b56e241d2de813e8bb53bc66e37479cbe2959327", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782147660, "uuid": "689b321b-4681-450b-8b32-978b2ee1ff53", "comment": "Malware payload", "value": "717f95df3229a78611aa54be1949ba609fa0a36d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782147660, "uuid": "cb758358-e54c-4a9b-ba2d-23e3339f7bfe", "comment": "Malware payload", "value": "6b9bf08162508c7b222373bed4b56746e1e27485223730273cb72a59962adbd4560f7d48a4eb8eccbf359ef53a715b07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782147660, "uuid": "1c6a0993-a4ff-4b4b-b8ed-82c4970c451c", "value": "T1F1765B73905624D8D1ADC974D5152213BEA8384B673863DBBBC076F11BBABE49E78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782147660, "uuid": "581d1e6c-b052-4ec6-b9e3-dd10431eb5d8", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ/:cqYUQuVDt0TZEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782147660, "uuid": "b29ab077-66c5-4cdb-a11a-d2f786dcfec0", "value": 7143424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782147660, "uuid": "d84a8643-b916-4e5a-895a-022e788bf1c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782147660, "uuid": "f1781923-c744-43c5-963a-a219118a5f28", "value": "3e6661d8c7c86d181f5f5176b56e241d2de813e8bb53bc66e37479cbe2959327", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b70f473-6e48-11f1-ae13-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1782139140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139140, "uuid": "b1d52df8-cd48-4aef-8906-0c35dd98c9c0", "comment": "Malware payload (PureLogsStealer)", "value": "098a3905a8bde664d46f9967e9c34770", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139140, "uuid": "31f1a57a-dcae-40b6-bea8-bdd27866f39d", "comment": "Malware payload (PureLogsStealer)", "value": "3e982ec9ece55bc3e565186182caea369338d277c078f4380fe2258342ca4893", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139140, "uuid": "207c258c-7264-407a-a15c-969f5b84cedf", "comment": "Malware payload (PureLogsStealer)", "value": "8e13a19050a2db7525813f4a6de1654af4ed2dfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139140, "uuid": "3e5c32d6-e62e-4b4c-8ec3-1c1610ae21e5", "comment": "Malware payload (PureLogsStealer)", "value": "e8d99ef1a18e2b07355458386de5e21976126f1042483667486ea5db58807b8577d500947e67e04d7242d65b991b62f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139140, "uuid": "94a89bf5-9da9-44c9-bac3-5b6e47a98b42", "value": "T1B5452302B597E5B9C45B01B16879F7399D3DAD000B63CDEB97484C7C8E25BD1A732B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139140, "uuid": "40440dea-93d3-4739-bf7e-d57eae73dd02", "value": "7ef52e95f2f37746b3b940cb94142a97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139140, "uuid": "fc15c126-133f-48be-a6de-0a78618a6061", "value": "24576:wd6IdMat3D3yjlI/nJg4PNtmLoOinrwCibja3NSf+2qN:w8IdTtTijGJg4LmLTkrwCibtf+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782139140, "uuid": "89f0ae3e-b3af-4411-ad3b-cb4d1142ddc1", "value": 1197568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782139140, "uuid": "95d7c713-8f99-4a74-b282-6672a0adaf15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139140, "uuid": "654f3047-a66d-4dd6-acc9-ae52f2b88c74", "value": "098a3905a8bde664d46f9967e9c34770.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0dae36-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141285, "uuid": "3e4d9245-bb16-4b8e-a8b4-f2451841f7ec", "comment": "Malware payload (AgentTesla)", "value": "0def1fb3e678eb8dea84552aba520636", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141285, "uuid": "13ffc4d7-9ace-42b4-a3f7-55050a3fc608", "comment": "Malware payload (AgentTesla)", "value": "3ef93bcdc790775d557f71f33af889c66a624a86e17507479abaad38c132c793", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141285, "uuid": "cee1fd4d-1aa4-431f-9278-b20eaa8c2327", "comment": "Malware payload (AgentTesla)", "value": "88b52786972668c681bcf86de357eaac71ffbb52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141285, "uuid": "39151f9c-a901-43eb-942c-12938dd87db6", "comment": "Malware payload (AgentTesla)", "value": "636824fcc312175ed1a2e19d317837388377f987ca13bf122d5ccaf055971cf1de11d7b8eca81b81d3a6e13b0c2a156d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141285, "uuid": "f8b84fcc-d76a-45a9-9da3-df65b52c04a4", "value": "T14482D637E909EEF4086D329229CB1C179B110741A675781EB89EE89C3B7E311CBD59F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141285, "uuid": "7f4abd88-073c-4315-abdf-cd16640c9bca", "value": "384:KB5AYg7HsMBR4duRk1DeA++ZiYjWZKxg7AP:K3AcMBRo1Djr5KZKxHP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141285, "uuid": "314cdbcd-59cd-41ca-9bb3-5ca2eaa708c1", "value": 19186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141285, "uuid": "40989942-179f-42a6-817f-1eafdc6448a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141285, "uuid": "6bf2a5ec-b735-4e5d-9f78-f0eb8ef97993", "value": "Letter_of_Intent_LOI_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84532915-6e07-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782111398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111398, "uuid": "43395366-eea7-4f93-8e43-b6eae57c32ea", "comment": "Malware payload (Mirai)", "value": "a315f26a9f80bb40790cbd945f9b83b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111398, "uuid": "09ab8210-1ae7-46b4-8e9f-b30f389d6c39", "comment": "Malware payload (Mirai)", "value": "3f274eee74858a60b0e3944df71653449459f78c6bc4b725aef4557fb1e57cc1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111398, "uuid": "fc960aec-c4a8-4f76-aded-8bd1726c0f93", "comment": "Malware payload (Mirai)", "value": "086b413deac46f46962973a788ff0ba4b13576a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111398, "uuid": "3bdd5583-89eb-4284-92a0-f755fabd4058", "comment": "Malware payload (Mirai)", "value": "92806b3ebd5d50dff82ab6ecdcba13793199dd46bac00d6c31608aaaa47582b871223402788a29d7fae3971cbdc44b4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111398, "uuid": "a2a8e674-4217-453d-a204-b758661d5e79", "value": "T16A84643399254DA7E4158CB3126732415C4E97BB84EA27E3FA668954FF2680F41FBEC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111398, "uuid": "13a2183c-064b-4ebd-be36-47a499f4534d", "value": "3072:muL48mu5vVaVMrUtmVKwjoCVLAYQUmr0h+afjUHJMNb:muLuM4YgwjoiLANUmr0h+afjUHJMNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782111398, "uuid": "d8852ce5-5c6f-4289-9a51-f84f06f93cc7", "value": 386961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782111398, "uuid": "c6b84741-6ffc-411c-bce1-7113513cd6f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111398, "uuid": "d7b4c322-eadf-48fa-a679-089a8d780a55", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033cade6-6e4a-11f1-ae13-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1782139958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139958, "uuid": "69763a64-0f78-417d-bee4-ed5f1bd6709f", "comment": "Malware payload (AsyncRAT)", "value": "9f21fda4eace55e9f759bbfb4d5799b0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139958, "uuid": "c42df16b-fff2-45dd-8651-e8e950969de5", "comment": "Malware payload (AsyncRAT)", "value": "3f55e9b6542684cbe6ad853fc7a0c1df1b0e8de0a7c69fef131e93c82f3712ac", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139958, "uuid": "ab176811-dcdb-4a87-84f6-4887f4be3e6d", "comment": "Malware payload (AsyncRAT)", "value": "401901a30cbe4578341ade9e3f4f992bc8c6a7f1", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139958, "uuid": "5f9ea909-e5d0-444d-a4b6-654a8f1d7b20", "comment": "Malware payload (AsyncRAT)", "value": "1de247431b517acc8c0860fb5db15d0014303155fc908529ed3286087f3bef491e76fa64b6c355a98481edb27549e501", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "email", "colour": "#07DD98", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "spam", "colour": "#60550E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139958, "uuid": "d4301547-aea8-42a2-8cf6-9af79c4854e3", "value": "T111535C003BF9C129F2FE4F7498F1225586BAF2676913E64D1DD810D60A23BC5DA426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139958, "uuid": "0262acb2-948a-48a2-93ef-aecdc604a71b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139958, "uuid": "8a7efe94-6a22-43a6-a6ac-91bc0f714124", "value": "1536:v8tTyZUF9iVOWfFqOHGd9bob3RvZ7IZljjiz+:WTqQaOj6GdVob3RxUSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782139958, "uuid": "0d309a9c-2593-47bd-b8e9-b41890b54470", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782139958, "uuid": "9b6a0003-9588-44e7-8132-7a7a0540c219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139958, "uuid": "6b7f4742-d1fb-43d0-95f6-33234d121664", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e388999e-6dd3-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782089224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782089224, "uuid": "5f8faa06-cd22-4b91-8377-779d51b7f7b2", "comment": "Malware payload (Vidar)", "value": "e46aca74f19eb406c442e5d28edbdaea", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782089224, "uuid": "53c111a0-cb54-4fc7-9e3c-a70cd62dc14a", "comment": "Malware payload (Vidar)", "value": "401fa3c82b2b7705753063bc7ea3e752b4bf4939736ea6d5949456a0e0407f64", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782089224, "uuid": "eac313be-1b9b-4c4e-895e-e805bb53ad1c", "comment": "Malware payload (Vidar)", "value": "ab69678a9c1ab8f7e0994fa1a8ca5213f08bb5e4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782089224, "uuid": "976d2442-e446-48bf-9365-ca49b4801e8e", "comment": "Malware payload (Vidar)", "value": "11124c44f89e48af8fd4decb012a7700f54784bbcd2d9eb519b192b135222e399470ebb5a7728b078937cb971526df9b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782089224, "uuid": "94b2be96-7131-4593-ba44-7839c751d6df", "value": "T11006AE07EFA148B9C497A23188A256817B3CBC491B263BD72F9077762F763C06D36764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782089224, "uuid": "988f5127-d0ad-47c3-999d-9462c4e242e9", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782089224, "uuid": "ca7d5d58-86df-4d6c-9e55-4bf4ea8c593c", "value": "49152:RxM9PTMKJyspg1uwxLBYaEqxQbX++yaQTqDTbCC:RWQlxAyQbOY623CC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782089224, "uuid": "eff0bba1-2fc5-4793-8e06-056a2c7f09b8", "value": 3989920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782089224, "uuid": "9f817138-c11a-4cb6-8d8c-6294a4b8f19c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782089224, "uuid": "65b472cc-3920-4702-9792-a15382ba1779", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ccf2cb4-6e09-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782112164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782112164, "uuid": "7be98af7-3709-44a8-80a0-a8b6bcbbdfe8", "comment": "Malware payload (Mirai)", "value": "977fb184748f7eb3e3ea8ac009aca8a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782112164, "uuid": "dc1dc546-8f12-4b24-9433-8ef182f67341", "comment": "Malware payload (Mirai)", "value": "40278e3ae6d6a2b97b3340f83693e19058cbdc7e75757dfbacd5fd6c6e450a14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782112164, "uuid": "28920ac4-65ab-401f-ad0d-47b1cd4e5215", "comment": "Malware payload (Mirai)", "value": "1baa763203e97447074a1a41120f72f4f6d2d993", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782112164, "uuid": "c96a64cf-b10f-42ad-91de-174158bb23dd", "comment": "Malware payload (Mirai)", "value": "be4c8334f4f0eae5425e9c50e559662a5b68cdbcab288120c7d71cc72690c44ae97acb8ddf6abfc6d11403a356ea8df0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782112164, "uuid": "fb1f5e5f-8c20-4752-b47f-e8df6bbbd389", "value": "T11D74973399194595E0158CF2227733D19D4B87BB88E722D3EE1A5D90FF3142B52BAEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782112164, "uuid": "85299729-e979-4b7b-9227-ff09bb03ae58", "value": "6144:Y3UbMfLSMcvZf7wjoO3wmX/VcseRia0ANb:imvZf7wjt3wmX/VcseRia0ANb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782112164, "uuid": "b53de146-f103-418b-bf1e-3ab5bf53e277", "value": 343407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782112164, "uuid": "e855c6d5-d9b4-452b-9912-7a0edf458b57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782112164, "uuid": "859f0f68-262d-4172-af18-42f057fecd4d", "value": "powerpc-440fp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05d1829-6e46-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782138611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138611, "uuid": "68c12f34-afa4-4224-ac6f-1a3f27ed9910", "comment": "Malware payload (RemusStealer)", "value": "be2bc476dc6a18164b63ecc75e85cde8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138611, "uuid": "ee5ecbbe-bb3c-4cb3-a3ab-8f352846d749", "comment": "Malware payload (RemusStealer)", "value": "409ad0799fe0b1ca3265d58f95eb13b7d56d6bad1f7346459fb02f772a3bf751", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138611, "uuid": "be2279b6-7be7-4b57-bd6c-1518b5d73b64", "comment": "Malware payload (RemusStealer)", "value": "a37e1c91a8f00ddd5b86ae6848b8e2163843b3f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138611, "uuid": "a1561ef0-75f2-461d-b7bf-d6430511ce78", "comment": "Malware payload (RemusStealer)", "value": "d1371f8cde94a48801809aad01d1fdb8dbd46a4c6c6d0a156eeeaace66ec2f841e8bf73cb7e1e6ba7599833414279829", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138611, "uuid": "df343d6e-8bd4-4c31-9aeb-22d2c12ebf2f", "value": "T15AC54A07FD9109E9C4A9A33189B792927B35BC091B3227D72E90B7782F727D06D39724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138611, "uuid": "4a9c31f6-0caa-4ded-b3c4-c60906b756a4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138611, "uuid": "fa74c0c2-308c-41bc-832c-e8373e0f5c45", "value": "24576:iCu552HPAmEX63rb7brfk5dz8u9QvUBeEvvxdLYcq/L2/ujo4vA2Bele5IK2i8YD:iCuj2HYmEUbDinGzlC/RlsAPOiU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782138611, "uuid": "2db57278-26a8-4cf2-ac05-96dfd38b59f5", "value": 2641744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782138611, "uuid": "bc21ff6a-0c61-40e5-8389-549b8bbc6f26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138611, "uuid": "0512d68f-7f99-4215-bc48-0bc7fbc5666f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa406444-6de5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782096993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096993, "uuid": "41e32362-9b59-4f6f-a23f-0ee20a9deb5c", "comment": "Malware payload (Mirai)", "value": "807c73039d6f413d6f496bac16cb4f2a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096993, "uuid": "1a951ef5-5472-4e1f-9e2e-6fa217f0216d", "comment": "Malware payload (Mirai)", "value": "4121a0bfb7059830e5ec9cc01126e37a5840987833ed524707356ae493d29b33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096993, "uuid": "2a4af5a1-5abf-4662-9414-675763c8aaec", "comment": "Malware payload (Mirai)", "value": "0d65ac92f0ab24da9a7493ac973fdfb4d627f112", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096993, "uuid": "90a0d6a8-425c-40c9-b2bf-c4efe898c191", "comment": "Malware payload (Mirai)", "value": "8eca65987a2b292944b23925d729de75cc7c2c50037de1d73754d151f94b8b8ce467d07cc89068e6c91ddda15cd2c0f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096993, "uuid": "226511bf-1f76-423f-b8b0-d807a30d649f", "value": "T18FE32B46F6418B13C5D61777FAAF414A3322D794A3DB330699285BF43F86A9F0E13A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096993, "uuid": "6a530316-39a5-4a0b-8a6e-2dae2be35257", "value": "3072:5IvM9qqxuvV8yAzltJXu9CttQJ2Ed83zGCzTX0clM/9REw/kP:mvM9qqxuvV8yAzYaQJ2EduGQX0aM/9pO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782096993, "uuid": "6178d7f2-cc41-4747-b417-e3da5d4a3b95", "value": 143845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782096993, "uuid": "838527c2-88e9-43c6-bad7-d3095d6f2627", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096993, "uuid": "985a8b70-2d41-4b20-8a51-2ec0432761f3", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28df120a-6e57-11f1-ae13-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1782145605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145605, "uuid": "87ae904d-6bb2-468d-a60d-041af8e0cede", "comment": "Malware payload (AsyncRAT)", "value": "fee046421c496e515a94002be7dce29e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145605, "uuid": "a84f0616-3659-4b45-905d-c557227fd753", "comment": "Malware payload (AsyncRAT)", "value": "414ca0982ed35b84dd95d205c4b8bafb68e877f0ddad22cad9dcec513947fb2e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145605, "uuid": "5110a71a-ddb0-44f9-a9d8-e57a50de8778", "comment": "Malware payload (AsyncRAT)", "value": "fd3c7ee73e945a399c90006a7b6611714586572c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145605, "uuid": "8679b2c0-9d92-4a5a-9a76-d74244a75ca2", "comment": "Malware payload (AsyncRAT)", "value": "e4190585e2c153cf030a499fca2b1dbd39d30a4d3d428084e8f518e83a66a5f8d63e6611a677250d8ccc41f62201243e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145605, "uuid": "df2ab592-a5a0-405a-8e17-c1a89290b96d", "value": "T17D93AE212A0E0133D1F746224EE5B7CAD1A174371FF62D647D7CE9C12F37016AAA1A9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145605, "uuid": "b5933d3d-b92c-4591-bfb9-69932e951ffe", "value": "1536:Mzrjpo2/ylBFqnLVUOYhPApYS/WTjpy1ZBg1J24eLzpIyhbfEsPe9gifNt31u6Yx:+jpo2/ylBcn1YhPAv/WTjpy1LdpIyhge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782145605, "uuid": "8eb75794-05e7-48dd-b87b-7e464ce6588e", "value": 93417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782145605, "uuid": "8609ec6c-4ede-48db-914e-3a2e08e2ada4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145605, "uuid": "51a3685c-4e1d-49b4-af06-7286f15ff75f", "value": "Interface_LIB.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44e886c-6e3b-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782133813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133813, "uuid": "6073a237-594b-41c8-861f-586588b66af4", "comment": "Malware payload (Mirai)", "value": "58e56a150e04eaba4d6c6a7666ccdfef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133813, "uuid": "d950104d-f86a-48c0-a4a8-d9f8f6b5bf2e", "comment": "Malware payload (Mirai)", "value": "439f56d99e3ceb821811a864a756bc5b0ef888016063c5b30b8f62d631beaf3d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133813, "uuid": "6055f5dc-75e3-4b9c-9b5d-bca3dd13644c", "comment": "Malware payload (Mirai)", "value": "a72e04d76e9dfaa5ed31fc87675a59d4052e3459", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133813, "uuid": "8bd00f23-14ff-4dcc-b385-aeee486d7fa8", "comment": "Malware payload (Mirai)", "value": "155aa52d284a9d3dd40488e128ad9fc7886362d92ad733df3951d9c4c8cde7d19f65b402df612d258ae5553d8ebbf3fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133813, "uuid": "b3730055-0a39-47dc-850c-2162cf0adf67", "value": "T167633947AA4890FDC189D07843BB753AC823B47D123EB2D677C4BF1B2A55FA01B2D54A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133813, "uuid": "2344bcb5-3df0-4921-94dc-b22ec78d4ab4", "value": "1536:NSTAyIQnqqOgqouH5mK75OPrxjoiV24aYdGUlxLeHY1IPSkrkmVr:NhQqqOgqtH5mK75Ojxjoy2lkGY1IPSlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782133813, "uuid": "64f69321-19de-4c79-a5ca-51cf068aeb30", "value": 70912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782133813, "uuid": "e75527bd-d011-4019-bff5-f5c71499f986", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133813, "uuid": "7bbfd08b-ebfb-43d5-ba7e-64ae2fda5b81", "value": "ae35395697d6777aa82e7dfde627f16f4417215c83a14e183f85b717e1daf0e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17b39594-6e95-11f1-ae13-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782172205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172205, "uuid": "4fb0bc11-0944-4736-9aa9-6402c5d1967c", "comment": "Malware payload (NanoCore)", "value": "e1ed660009b12e95a08afecbba1c57c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172205, "uuid": "990cb4c2-24c3-4b24-b3a2-052738542fc8", "comment": "Malware payload (NanoCore)", "value": "43ce1771aedc955acea83777eef43569cf8ccd7bc9fdc03abcd223fbddab3769", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172205, "uuid": "f22000f1-0846-43bf-a218-d0781d3e6656", "comment": "Malware payload (NanoCore)", "value": "e5aee53a5870e46f240473d9eb2153bf915936b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172205, "uuid": "952ca99d-bbbd-4223-8716-3017bae67854", "comment": "Malware payload (NanoCore)", "value": "f767481ff01743272a3e0c3fc9ed7f0c8155b52f4b2158cb945ace28c8fd1c50c7e0d73cb0d6d828642f9784af6b9e1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172205, "uuid": "ac9c0e01-5a45-4de7-bf78-8e13845dbf5e", "value": "T1DAC4121A3BA9412EE2EE46BD612212934778C2D3A8D3F3DB5CC415B79F1A7E40A131D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172205, "uuid": "27a5f3e0-188a-440d-89f3-d04cb2274838", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172205, "uuid": "bd6370eb-a1be-4320-bc8d-8962f0410ff7", "value": "12288:pLV6Btpmklz/LWfBVccPZy21ZDsv7I0NReiXzxfvl6a+oGoYc:RApflzZuBns3Ns4zxfLio7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782172205, "uuid": "c7753a12-77a3-4dbb-99e7-0da10b8b8109", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782172205, "uuid": "bcb2509a-59eb-46f1-a6e7-fc78b533a6c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172205, "uuid": "b1f79f4d-ba32-48c9-8547-5e1015f0764a", "value": "NanocoreRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719cbff2-6e32-11f1-ae13-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1782129835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782129835, "uuid": "ff84eb06-d732-4a68-bbca-703104de2cb1", "comment": "Malware payload (AsyncRAT)", "value": "00a25c881533896a7fb5646f1411596a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782129835, "uuid": "7597e504-19d9-43b3-a456-d398b48562b8", "comment": "Malware payload (AsyncRAT)", "value": "44760ec58f066892b58f50330093213d3bfb0358d74f735010aaf54585712b34", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782129835, "uuid": "3abcb8dd-3c7f-4064-9217-8c0dc0111c92", "comment": "Malware payload (AsyncRAT)", "value": "28c13d17160b8dd52de8cd5d3e3cca77117be2f7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782129835, "uuid": "0d28beca-e9a4-4889-a999-c330e15b9fd5", "comment": "Malware payload (AsyncRAT)", "value": "e9c2d7a623dfa1f90d287830e56bce40a1e4f283e89b1f4824378ab7412df97cc0e0d612f4435e6327c4a30db3739520", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782129835, "uuid": "7d04a220-dcf6-4ff9-8790-1c3cab7150a1", "value": "T1DF15E1221E472B8DD6AE0BB8C0660C583BF4C8166396E71B6FED40F56DB3F85C927416", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782129835, "uuid": "72580245-9e5e-4015-b5ee-aee275e0721e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782129835, "uuid": "c97d4a3b-2f64-478e-8661-bb952c5def4c", "value": "12288:bItAYewyO0EZxy9E1YQMEBlqHcvVnaXujgZ/CbmapHIuj0dK1lfwPHa05LxZlvxW:EWALaZ/CK+HRj0dKLfhMNv7PhOui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782129835, "uuid": "1a8989e1-aa6e-4f0f-951d-d0e4402c3bad", "value": 954368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782129835, "uuid": "29e7bc41-ceb2-4e84-a183-d7fe41a03d5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782129835, "uuid": "372746ce-3345-4339-85b2-584431e20fc0", "value": "COTIZACION DCM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9330efa5-6e4c-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141059, "uuid": "295c0803-0d71-4434-9e3d-41b75d5d0667", "comment": "Malware payload", "value": "905d448a2c42320cd71429634f7c599f", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141059, "uuid": "f3b767cb-b9d4-4ac6-9048-f9b5879f0bec", "comment": "Malware payload", "value": "4488de9b8c97006d9784b08dd4d8d41de2473253dd4d58e93e8b2a68eb6a97db", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141059, "uuid": "92b7141e-f16b-48d2-afaf-1a43a7d9ac51", "comment": "Malware payload", "value": "269cae4a3a7031ffa89a96569ef95656395305f1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141059, "uuid": "7f825a4c-335d-42ae-9342-4955c6bbdb2e", "comment": "Malware payload", "value": "0f72a1643cde73df92c3b33c955c3975f877d6ac10ebdaf7cacc0cca5595cfb38b042957d87d6aa7c8fb2e45da2b0873", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141059, "uuid": "e48bce09-ddcb-4573-950f-ddd6ca77b97e", "value": "T1E4C378A8E79E01A4CF50623B432B980896FCB73EF711553670AC936433EDD2D89A597C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141059, "uuid": "b93f4e88-cd06-47f5-bb8a-9e5f6760bbe6", "value": "384:mm8pSSeFvEk/OXT0+b/SKM9K0wFeDdKSRpbnIJxzMTHmMOhlQOAUQc2YLVz3Fvg:mLSSemL9/NoK0Jdi18mMOLvld2EVzV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141059, "uuid": "06963a7d-736d-48b9-a83e-1a6de346c29e", "value": 123376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141059, "uuid": "dfdd022a-8dd2-4589-ade2-ff84cf5b2292", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141059, "uuid": "3c0d646b-46f7-4de2-b5da-d03d7b92292c", "value": "ProjectXNo.88719_ECOFIX.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7215ac-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (STRRAT)", "timestamp": 1782141589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141589, "uuid": "ae169e8c-b69c-401c-990d-59839d6bc5f3", "comment": "Malware payload (STRRAT)", "value": "85ebb09a5d39c49030e788ec4fe8321e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141589, "uuid": "6b67d702-a028-4b59-b7d3-f5115da2fda5", "comment": "Malware payload (STRRAT)", "value": "44a3477764d14c4fb57b11de1382f282b2f7593bd2185194d85a2c6bd266a65b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141589, "uuid": "3c6d3885-55b4-4c15-804b-3f1fedc8279b", "comment": "Malware payload (STRRAT)", "value": "661bffcd9e44c14136b5e6ed0fc6f2590dcf6ed8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141589, "uuid": "b5c571bb-f5b5-48bb-91e0-a124d9afff0c", "comment": "Malware payload (STRRAT)", "value": "53961fa8452f7a11fd0f0397accbe496da5d9be1f352d141bf075c989f28666e19fc80287ef12cb39269f3941b8dcd1a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141589, "uuid": "c81f00ca-ac45-4616-8f37-95aee25a5004", "value": "T165051055B36A098B1B0BAE34341A1D6377B80B60EFCC49C49657EE998C5EFC70359E0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141589, "uuid": "c8f6b030-b8c3-49d9-a1e1-e3c0c050668e", "value": "3072:OJE/CtS+PucYJ9m9iGLZfGdook6sskQYWAuVSnKdJ0Zun1ve+G8LGD4NYXsBWgRb:1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141589, "uuid": "26072e5c-8270-4226-a833-a42a1c851344", "value": 849496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141589, "uuid": "e8749a81-aac6-448f-be67-0648e0c3973d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141589, "uuid": "5eaf79dd-d559-4cb0-befd-a49b9ac33853", "value": "Request For Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c595788-6e86-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782165824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165824, "uuid": "9e404f47-9c62-41be-94ee-955f935e34a6", "comment": "Malware payload (Mirai)", "value": "c1d3aa8fa59bebaec6810919b3835d99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165824, "uuid": "ce3b3ad2-f554-422d-858b-e49aad736b93", "comment": "Malware payload (Mirai)", "value": "45a6375a18d12e721a35529dcfd5a5d426be16c4ee06dc6672aadb8a7ba1cf6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165824, "uuid": "adb62952-db79-4888-95c2-a683690c19d7", "comment": "Malware payload (Mirai)", "value": "2f51c16ba25e07e351b7f7405ff7da9386edc5db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165824, "uuid": "3202fcd5-344d-43f0-a5d2-537f5e846234", "comment": "Malware payload (Mirai)", "value": "ec382fd47c2e0d5a083c5197cde50654a21513401b391a207a9719630c7ddc485f488ff9924066fac372d5a9881567b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782165824, "uuid": "64834753-6484-4456-930d-ff8185284fab", "value": "T1D5A30885F8509B13C6C652BBFF4E428D772A1758D3EE320399256F70379B96A0E3A142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782165824, "uuid": "efebd05b-d4d3-4c30-b38b-fb33f5f09f6c", "value": "1536:fpzlqXIHJywy4VNOo67qn0TRYpjuZQlalWAwyw50kCXheGpactnvOU6VvXb:fp5EIHO4mI0Tq6SqauutXb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782165824, "uuid": "5389dc70-b0b4-46c1-910d-81988451bf2a", "value": 104812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782165824, "uuid": "ae3ffbda-9e99-407f-8a49-149aa4981602", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782165824, "uuid": "44243f4e-091a-4b36-86c2-973af2141168", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e623c9a-6e72-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782157264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782157264, "uuid": "7f484844-c046-4425-a232-544525367756", "comment": "Malware payload", "value": "d1c07710543c8447e31bf46f345058ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782157264, "uuid": "6cdc0cc0-d3c4-4e9c-a3d5-df1e68618f17", "comment": "Malware payload", "value": "45a7b39b3d8be2f538a4de8ed699aa07e72343c813d78d12c1d929303cbf01ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782157264, "uuid": "b912fbe6-81b9-4684-88af-0ee8d0ebf833", "comment": "Malware payload", "value": "ab2f9f999ce8eeeec65a34a1f65d8950c1c40e3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782157264, "uuid": "14145ab7-bd15-4c56-a05d-d7f55528f171", "comment": "Malware payload", "value": "3bb672e4d5f3f1501390cf57ef43cb05dda7c990df42c159965d272357519052dde86cd5d7ed91911947ff9d83610796", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782157264, "uuid": "a78b8842-73d4-4eca-b147-16e30180026e", "value": "T1E8C412C33AE745B6D1B12770A9443B7285E9FF210B148BC7A72039176E761CA8FBD684", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782157264, "uuid": "e1e90a52-351a-48dd-99c8-40a684597919", "value": "a1a66d588dcf1394354ebf6ec400c223", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782157264, "uuid": "e28ca29a-f00f-4be5-a74c-9f07892c194a", "value": "12288:j1hbYUuejTCAi8nm0pnn56K/yd5LQWlDJXccLEitvy64D:j1qUu/AioR523Vz1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782157264, "uuid": "822cab4e-14d5-4f80-b71d-3cbb556bc24a", "value": 560411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782157264, "uuid": "6a05eec8-5547-47bb-bf60-a71d6cab61b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782157264, "uuid": "1dd61fa7-0d42-43db-83f3-4a72efbc6e3d", "value": "SecurityCheck.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463e0fb2-6e7d-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782161975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782161975, "uuid": "34968dff-1d71-4b2e-8b08-9be2242314ad", "comment": "Malware payload", "value": "29b58c73c3f4f0e3b24729297a428d0a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782161975, "uuid": "bc4b1403-e9d3-43cc-a148-156673b6b8c2", "comment": "Malware payload", "value": "4652dd831e7ecfe97e03c144c47bc9f7772fb0be6aaf17e278bc53590c0dd90d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782161975, "uuid": "1fe51f80-57b2-41ca-bb48-d444d419718b", "comment": "Malware payload", "value": "29d41644f6c47d55441b063406ba279ad7498ad3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782161975, "uuid": "cded2af5-351e-4855-9218-2b0c55b6db32", "comment": "Malware payload", "value": "d54df051489f208846b30f5ed3daf48ee1b04047be7c4f89ff74c945c2997ceecd5c34e5e62860e8e2f6287f1058b67e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782161975, "uuid": "3cb9f777-29d5-4d0a-9b04-4b97c7ba7a8c", "value": "T1CAA63399B7B604E9E8DE923E92E54297B7D170B6077897CB27E00C410E276E4EF35B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782161975, "uuid": "c4a2d8f4-19ef-4fc4-a526-d7e0d3287bde", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782161975, "uuid": "9776441f-65f9-4a9c-8fea-6a1fb5a06979", "value": "196608:B60W8/LaduA1HeT39IigbauDXURuA3dSYEQVdlcEH+:BNW8QX1+TtIihuARuA3dS9QVrcEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782161975, "uuid": "32085076-1b5d-42ba-b94b-20d13437b9aa", "value": 10330526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782161975, "uuid": "bc9b6f11-873c-4a76-a6ff-5012790e7d2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782161975, "uuid": "a5ebc41d-4d40-4db7-a4cf-d6590081b858", "value": "Xeno-v1.3.55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0070a95-6e4c-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141134, "uuid": "88a96778-9cd8-40a2-94ac-1833fe390338", "comment": "Malware payload", "value": "2be88440e0489f51256430816347f9ca", "object_relation": "md5", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "66-63-170-33", "colour": "#F283ED", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141134, "uuid": "27f6ba19-478d-43c2-a958-89533871158f", "comment": "Malware payload", "value": "4727661df583f00e2d66214278c24e3b7e15c68fc1094b64c7527c02589e1dca", "object_relation": "sha256", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "66-63-170-33", "colour": "#F283ED", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141134, "uuid": "67c73c92-fb7c-4b67-8432-322364132cdb", "comment": "Malware payload", "value": "f4d415de7ab16e5d21c1a0ba21a5a686ebe02db7", "object_relation": "sha1", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "66-63-170-33", "colour": "#F283ED", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141134, "uuid": "cd2a4047-6568-4ab2-926e-4736b678e7fb", "comment": "Malware payload", "value": "8afa44ed2d9b575354fe90bb4c04c4565c73b6c70da3c76a78339e10e8401fce22651aebe74a5ebbd19aa307660eaf08", "object_relation": "sha3-384", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "66-63-170-33", "colour": "#F283ED", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141134, "uuid": "554c30e2-0825-4ea6-93b7-32cf40965033", "value": "T13382F723C944AEF4496E32D7258B4CA79A110791B674340DFE8EE89C3F7A721CBD58E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141134, "uuid": "b2c8d3e8-8714-48d7-b618-24059183bf4e", "value": "384:KX5RkGuV3CmS7vhtavMXha/AeSG5t0CRWEA7P7AQ:KJRkER3RXGjRWEA7kQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141134, "uuid": "cdb807c2-1d88-43de-9bf4-e467a286c3a1", "value": 19217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141134, "uuid": "4562508d-cb3b-4a01-aabf-9a831bab3217", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141134, "uuid": "d6c45044-b275-436c-b918-034347ec39bb", "value": "New_Booking__Group_0031.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b02852a-6e7d-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782161875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782161875, "uuid": "5d4373c7-59e2-4d00-b1f1-9a2b203e7791", "comment": "Malware payload", "value": "300f63c107f67a880fea9c9dd70aa24d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782161875, "uuid": "6f058e20-a4b8-4fac-ab55-5dd9a45b5ed4", "comment": "Malware payload", "value": "498e6f39a30ba7693903cc89b113f81acde73f2ce16e9ab9147018882d5ec9fc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782161875, "uuid": "c604d318-e3dc-447b-8219-bada22c9077a", "comment": "Malware payload", "value": "d1f7c3f89bdbe60455c730a3d025e28b78ee69d5", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782161875, "uuid": "b383fbfa-b7d4-4ae5-950b-115cedb66b50", "comment": "Malware payload", "value": "05a014d5af3e26c70326768922462def3ec9f24edcd42144d08cd12e2dac12cd18b2739c5c53ac1aac238cff6686ab00", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782161875, "uuid": "72be0809-985b-439e-9808-1eb33c3bd2dc", "value": "T18D01ABD68610A920441ADA1D22DB5290F450C3CF5A4B0F687FDC6E3EFBA8E14B127F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782161875, "uuid": "484b7732-7933-4a93-9db7-9ed9a0842e01", "value": "24:kXCKysE2hi0ziQvZohaLFOLDtbXzARF8+389PY7:e9Qp+MsxEtbXz0Fd381Y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782161875, "uuid": "5ee6b7a6-e87c-4372-9fc9-c019ce0bc1a3", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782161875, "uuid": "4912668a-cd81-4bb8-bc87-3aa6273a7107", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782161875, "uuid": "977d42a4-a421-42fe-a3f1-49b7d8874f79", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5675374-6e83-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782164819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782164819, "uuid": "fd489e9d-e2d5-4631-b948-cfac6d68a05a", "comment": "Malware payload", "value": "82510517f98692d7cb28429e602109a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782164819, "uuid": "e0b40992-48fa-46b7-b738-0c1221fc838c", "comment": "Malware payload", "value": "4a7189639c9caaf4b85c509844db761a9f72b686df7c941412bba7ba88aa9748", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782164819, "uuid": "251af0ea-f1f8-44cb-ad4c-4cdea158d701", "comment": "Malware payload", "value": "1c1f98a927535033cc57fa60c4b4d55142db4ca2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782164819, "uuid": "33d35c51-13c3-448d-abd2-143ed8c3ffb4", "comment": "Malware payload", "value": "66c7903460c3289fe46615a033372934970ea694dd0d51b1479a31c12720af9df3a443744303929bdfbd1a028244ed49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782164819, "uuid": "8a0fe30d-a64e-4371-ac93-5418d592925c", "value": "T10F24B81A6E328F7DF368873447B78E30A75833D626E1D644D1ACD5145E2039E682FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782164819, "uuid": "d871294b-8223-4e39-85b5-293e93e490dc", "value": "3072:X0+IMF5/ZxYU4X1VXUDdmMS68CbscG0LmWR:X0+HF5Hnm8DAs8lcGums", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782164819, "uuid": "7bdfa94e-6ccc-45b0-8a7c-031c650967a2", "value": 214528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782164819, "uuid": "622039ae-04ef-4618-9fc4-75e4677c1056", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782164819, "uuid": "4775534b-678d-4584-86b3-5c4a2bcb23d1", "value": "lmips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c557ed0-6e57-11f1-ae13-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1782145611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145611, "uuid": "0987362d-df3f-41f5-808e-8307e88d058d", "comment": "Malware payload (AsyncRAT)", "value": "fc593f737df50d3cb29fc88ddfb600b1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145611, "uuid": "bd4bdb9c-bce8-49ab-a08a-769bf89843c2", "comment": "Malware payload (AsyncRAT)", "value": "4ba87b20a9d920cff0284d250f5c5620dea287fbe9a84d0bb5f4683e74d3ec43", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145611, "uuid": "9a2e90ac-5f18-47e1-b353-4a4c4f1e9da7", "comment": "Malware payload (AsyncRAT)", "value": "81ac44822177de847b2a70d32c71d1c9257f4d7b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145611, "uuid": "caca53a8-b7a6-4b3c-9763-4b5c4103cfb3", "comment": "Malware payload (AsyncRAT)", "value": "16bddda66fcb5c605520df794bde6c62fce92409afebb923a9c2009c8b52d177d03e95b268ac27b384796ff339c1384d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145611, "uuid": "dd32757b-f413-42aa-a699-7f801b8de3be", "value": "T1E92423304E8822F6549C12375227FEA2FB78CB4BC853E64332A30C556A673CF7E59691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145611, "uuid": "423b3b31-d8d8-4d3c-b39b-71a0c2180454", "value": "6144:BNKMBAqp4lVV7IyeNY3nI7O6sVmJmCbZ0:iMfWlIo4y6sVmJmCN0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782145611, "uuid": "bd86d72c-36f8-4509-bc91-c5b26d700f2e", "value": 216341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782145611, "uuid": "0ff317be-d673-45a7-8e57-df111d3aa117", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145611, "uuid": "62538e54-8550-446d-a7d8-1d4b02565ed0", "value": "ps_4HJRQg6GuAFB_1782141986471.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be96569-6e07-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782111384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111384, "uuid": "4ed33dc0-283a-4ca9-ba99-8d1f2d884d18", "comment": "Malware payload (RemcosRAT)", "value": "cbcc0f74f9e4f4bb3bd52a29cd1a6e65", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111384, "uuid": "29c53768-0d96-4611-8c34-6455f84df786", "comment": "Malware payload (RemcosRAT)", "value": "4bb8d84994c3c458b01cf7bb2158420e92bdf22ab5c85125df54535c42b45f51", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111384, "uuid": "2ee70501-e3df-41b3-a042-54193c36d1cf", "comment": "Malware payload (RemcosRAT)", "value": "52f3055994ac3f1bed61fa44e848847d4f9874bf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111384, "uuid": "96ceb624-2336-4f38-81b2-cf7ecda62168", "comment": "Malware payload (RemcosRAT)", "value": "a135349c35408dd06f9c2054b4d91d51e3d83243ce6329c2854f26b7348a637901fd1a5f5d60f570fe4337a8aa5ec060", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111384, "uuid": "5a73c96d-a3a5-45ac-829e-f0302b6dfbd0", "value": "T101B5285303851BBDF69D0EC9C94B215B20F2D46B7D251298EBB36EEBBC3B9845430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111384, "uuid": "cde198d2-875c-40e0-b56d-34563bee9da1", "value": "1536:Wu+F0Cx5rua/fg758yLmPS8C223nsnyQp+qcOtsFXbzgtsIyd5yE7iTFO2Z+0Nvw:EAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782111384, "uuid": "e091e2e0-56f7-4100-8068-ac785df55a45", "value": 2434509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782111384, "uuid": "e10742df-c645-4113-b09a-e8ba70bab578", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111384, "uuid": "0947fe26-5ecc-44d3-bfc9-9278db1b65d8", "value": "PO_4653830305864846564746554847456484564848454465.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c3f342-6e04-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782109956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109956, "uuid": "6afcb3eb-a46a-461e-8641-eea3b7e80667", "comment": "Malware payload (Mirai)", "value": "4de6f9698ff993e62ede30059b5d127a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109956, "uuid": "6aa96a70-903f-4d34-bf84-f6f8b1b26da4", "comment": "Malware payload (Mirai)", "value": "4c8452970effcbbe5965631dadb16e570b37d718fd578051b4a3aa0c733e5f4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109956, "uuid": "3c3c407b-f9e9-41bc-a8ae-bdf5a24c9393", "comment": "Malware payload (Mirai)", "value": "c8e8eb33ff3970e7368692acad04ba8b7c516b3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109956, "uuid": "029be946-5168-4a86-ac7a-635400deb513", "comment": "Malware payload (Mirai)", "value": "ffc3cb36a4f019033d584e3c089009ac33f097b536bad518e8af8b1f12b651fc3683b31e4b138c5dfad33d97d2c6fcc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109956, "uuid": "700a609c-ea2b-4ea8-9715-2d86f12aa151", "value": "T1FE749633A9158495D0108CF312A773559C079BBF88B622D3EE5A6EA4FF3441B52BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109956, "uuid": "8106d3a3-1962-49f3-917d-c619c1af14c0", "value": "6144:0A62zYw+YymgD4BepO62dmEFkVMW2GkaQNU:3b+YgDUFmEFkVMW2GkaQNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782109956, "uuid": "37f67986-295f-48ae-9da1-437f5dccf5c7", "value": 350715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782109956, "uuid": "27d19fc1-7d09-4e90-aab6-d806910016cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109956, "uuid": "8142893c-6958-42aa-b131-62deb8e9a8dc", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fb34bdc-6e57-11f1-ae13-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1782145616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145616, "uuid": "6c97f66f-879c-4897-a4cf-97f433644158", "comment": "Malware payload (AsyncRAT)", "value": "1595ed023601d93c3bb04fe4bdbfc22b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145616, "uuid": "cff49169-12cb-45c7-a007-14a593976759", "comment": "Malware payload (AsyncRAT)", "value": "4ce8f21ca41b0eceeea9726b47134854f5fe400e2c098b3cceb7dbf0043a71f8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145616, "uuid": "9b5f717e-2d50-4c4a-a904-8ed1433efcc8", "comment": "Malware payload (AsyncRAT)", "value": "197c48e53f4f24cf61ab8c1c61e8e3dea76f3d44", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145616, "uuid": "5a39ae23-232f-486a-b5ad-242c5e3c2001", "comment": "Malware payload (AsyncRAT)", "value": "bc23fbbb96ff283355d2caf4d6dc792d16d40e9f868789528e484dcd18d641901f3440a65f93edd34d4031332c619d16", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145616, "uuid": "cf834412-2e71-44c3-9373-82aef60fd301", "value": "T1DC3423088EF22AAE4FFC477034676D6C6D75A5171BC2CAE6B6F4B0D46D717082242F26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145616, "uuid": "41419131-6ff8-4383-9370-61c2f18efae1", "value": "6144:+NdYGQCKFEqDGxGMyTJ4yxTKClQN0YLuQQAx:+Nd7QCKj44J7TKCt8uQQAx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782145616, "uuid": "ac4adbc3-639a-43cb-a6d1-373ddb619849", "value": 237330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782145616, "uuid": "e14892df-8862-4263-84c6-b1a77e919ec0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145616, "uuid": "cb5cf9d3-9d2e-4bb1-a4af-f4833c3b4e8b", "value": "ps_BxAQASmRVijX_1782111402408.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bae70ca-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782115276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115276, "uuid": "6ff5d017-6253-4119-8917-db7a6c7185f2", "comment": "Malware payload (Vidar)", "value": "553edf1f5bc2f3c36b5d49070e07a3df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115276, "uuid": "3af72ca0-9423-4480-900f-fffde101d69f", "comment": "Malware payload (Vidar)", "value": "4d802f691eb285fd3ff09083250000c9237ef62c008d7123a6d91486d8f4ac41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115276, "uuid": "0d00fb4e-a0bc-4dc5-9e32-b1aae397d313", "comment": "Malware payload (Vidar)", "value": "26feb2313cc06ebe32acbf6774aa5b3ea0621664", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115276, "uuid": "5fae4e15-1c61-4fc7-9a7b-0968b6105e32", "comment": "Malware payload (Vidar)", "value": "2bdf32c2d893eeb17cfa6b5ba6cef09d1846998014fb510fcc9eaf7cb743647157fb212a93d09f5883404d61364ec00a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115276, "uuid": "2ac93258-2cc3-4023-8fab-4c3bf95cf12d", "value": "T19552F7C771A370FDC468C379D64A13F6CA76308A061E1FFF92DC829836E1260796DA94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115276, "uuid": "376b52b6-154b-493f-a994-baf1a8795367", "value": "309ffb298c8a47c3e92f759e8f202429", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115276, "uuid": "ab5234b4-ff8f-4651-b949-442ad850713c", "value": "192:OhoHscdQu7xyJ3zLu6CkRPevRVH+a9eiS+jcXXfT4BiEezWN23VY0:OOMpu7xyVLbCnjr0+jcGeE2lZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115276, "uuid": "f7b266d3-5c7a-4949-a09d-b112d26a6fa2", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115276, "uuid": "ef6679f3-3b31-4e5f-93b6-25eeb70d8db6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115276, "uuid": "b0bbd481-0511-4b13-bf4d-27b77bd9ca80", "value": "553edf1f5bc2f3c36b5d49070e07a3df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0254a13-6e22-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782123149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782123149, "uuid": "383b9158-59b0-4dac-8741-6c676b36993a", "comment": "Malware payload (Mirai)", "value": "c7be799f3a617d2b9332b1043d833657", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782123149, "uuid": "bbdccc38-aeee-401c-b19d-9d554e90c3f7", "comment": "Malware payload (Mirai)", "value": "4e4ab887322601e3c27b339a2eb13f8dde636e8422e6ec4440174e1c90c7ba4d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782123149, "uuid": "1533b4d1-1bd3-4c24-a80a-90abf011c2d1", "comment": "Malware payload (Mirai)", "value": "70679377c67cccab42727f9f9417dc951357dce5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782123149, "uuid": "dcbda004-d8cd-4afe-960c-014e83a35842", "comment": "Malware payload (Mirai)", "value": "fc086e2ceffa691459c60194b232b9006329b577b7cfb0c8fe0cfbcaa46f02f7140d41d0f85283f9e117932baa0b9897", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782123149, "uuid": "1649ea83-c9fe-4edb-b0eb-4959a88668f4", "value": "T1F51308D7F800E9BAF81EE73B8453000AB270F79501921B362767756BED761A80877F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782123149, "uuid": "93384e48-f7b7-4d04-a3f6-c4e77cd464b2", "value": "768:LGjrzN01f1R9qklTb+waY8O9aLoDwi9NcRVxHTjWXb3HX5inbkNLDfIYc:L1l++8hLfi9NcTxzj6b3HX5ibk5Dfm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782123149, "uuid": "b9ffff0e-8966-48ac-8b2f-00c1b15488b2", "value": 45068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782123149, "uuid": "36f1c0ee-37cc-4271-a695-26718cc86c03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782123149, "uuid": "e9e49187-8264-465d-b860-2e5cfc078a7b", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a39537ac-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782115316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115316, "uuid": "e622011f-25a9-4755-8a2c-cbf8cfd85fca", "comment": "Malware payload", "value": "a4833f2b99872807bb030833e577bb8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115316, "uuid": "6e097e05-ef5c-47b0-9b88-e0f12c90be1d", "comment": "Malware payload", "value": "4e79c50d795108911b572684569d926ad56a9cbb3a7bf9111445ea2f21af5206", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115316, "uuid": "55717c2f-c573-4537-b1e1-ef1b612677b4", "comment": "Malware payload", "value": "727dedf87064625199fa284e71894a156c490fef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115316, "uuid": "8bd80aca-a557-46ec-8941-798057b81425", "comment": "Malware payload", "value": "903edd54bdcb13dd1b8b51bd2197dda819443e69e0436a40e67421e41be4764c80371694e5d8d439fb9daf6fb13f521e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115316, "uuid": "2a5d6bb5-ffe2-4a8d-a30e-ee0c10138028", "value": "T15EE733E59BC874D6E20DCB378535D518AC72B80E0B4748EF27D809563E6F2E93A7DA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115316, "uuid": "f0b01bc9-ef39-4521-bb41-2b2b35efcdb3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115316, "uuid": "bfe8f952-e36d-41bc-9b69-2fd18a098fec", "value": "1572864:IgQWPVr6LrtO5SrjtAsIgqTcaNH21A/gE1oeOahi81ePNS:jdPJKrtOsHtAsg7lxrmeVlQFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115316, "uuid": "40f58700-c3f2-48d0-b6f0-eafd1d912d12", "value": 69290734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115316, "uuid": "fafe7977-d6a4-48fe-9a78-55e4730aa428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115316, "uuid": "534cd8f2-3d9b-4ccd-ab8f-bf7b3f93d37d", "value": "a4833f2b99872807bb030833e577bb8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3792312b-6e34-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782130597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782130597, "uuid": "686353ba-93c0-43ba-996c-928d553a63ff", "comment": "Malware payload", "value": "4ea89ebda8b20dfef76b46c2f832a270", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782130597, "uuid": "478fb151-4cb3-4abc-90b2-7befa05eb40e", "comment": "Malware payload", "value": "4eca92b172d03e5fd98f155577f1a4bb592c2f91a7e3947f2d7677e660ddaa99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782130597, "uuid": "3b360bdb-5d98-4c11-91f4-2bd507b47901", "comment": "Malware payload", "value": "fe9777568025b01cb9a2974ac82ed47e8bfc4f65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782130597, "uuid": "d5f35723-3ee7-48cd-bf63-33f49e9b2bd1", "comment": "Malware payload", "value": "2b55d566bc493fa1facf477ff2ce8c3ffff1dc6bdb2baeeba3312a82cedf4fa38d73d3394065fcbb9d571fa6ea65b4e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782130597, "uuid": "4ca2383b-ec7f-4bed-a0d5-9370afd69b39", "value": "T1C908333C8AF5A2AFEC2D5CFC1270A677FE2954252E28389797E8357171310094A7E64F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782130597, "uuid": "151ae1c7-a4d8-4f29-a26e-1d6fe6527bc5", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782130597, "uuid": "61065640-6db2-4315-9489-0203427ce882", "value": "1572864:Et9IKPojYdeTqowzKYypCPRfYLgRLlPBnU6InslADj2AB7:EUKQjYHoyKYyuB/5PU6Ins42AB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782130597, "uuid": "c563e8bc-88c8-43e1-8dc0-f47c301770a6", "value": 77284498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782130597, "uuid": "26f42a4b-4945-49d3-9354-150d252b5f5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782130597, "uuid": "1a0eab39-c5c3-43a1-b179-0e943727ceb5", "value": "Ricoche_Game_win1.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1002045-6e3b-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782133834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133834, "uuid": "038ec901-236b-4fed-9bf9-711c6d5bb582", "comment": "Malware payload (Mirai)", "value": "41941c36becc38c08f25354b002dad55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133834, "uuid": "d4014136-74b2-4a04-8538-3e9540aaf37e", "comment": "Malware payload (Mirai)", "value": "4f1035417e18e298210a5c08f3f6efc9d98c224dd02d1d15e4d4674abd522570", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133834, "uuid": "216b14f2-f047-488c-a5a0-072e4daa2493", "comment": "Malware payload (Mirai)", "value": "b2b47f5201a264b23fc83ae9d4f035f9812302a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133834, "uuid": "94e04890-b5ac-4d2c-9ddf-bd06567d3cf0", "comment": "Malware payload (Mirai)", "value": "bc75b2f77431409230a239bfc547647751ffad3fae1b1faec4183916ca3ab42ba559c985e06b09803934a457daa1c23b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133834, "uuid": "5b32b285-acf3-47d2-9efc-f34414b5c666", "value": "T119535B0273984E0BF9961AF4283F1BE583BFED5025E5F585690FD74A4235F33498AE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133834, "uuid": "67765dae-546b-4f67-a871-5d7dac232d92", "value": "768:esBl+R0SLnL/fx3MtO+KHCqqQn9evMOhchqin87IzsLnXzcaMmb8vqKWQcIOVAhk:eAl+TfxdKvg8in80CDkmbTQcMgEi9IRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782133834, "uuid": "ccfaa1a7-4781-422c-8863-64efdc0c26ef", "value": 65312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782133834, "uuid": "2c8ee9bd-d6c9-4ac1-b6b8-1cfc313c8acd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133834, "uuid": "a0a968ad-76be-438b-83c1-33d060e17a1b", "value": "780fd4fa429659fde212bdd7048f205b966ef2ffc7fb253b2342ed22537bef28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607dc98e-6e4a-11f1-ae13-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782140115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140115, "uuid": "2b0bc542-5dbb-4218-84de-4f59504b7163", "comment": "Malware payload (ConnectWise)", "value": "58a8095bf4ef6402cd551425f63f51a7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140115, "uuid": "6a52937d-3b70-4b14-aafd-932bf230127c", "comment": "Malware payload (ConnectWise)", "value": "5061c681e8b516f877c426dd593f570cc8520d2411e842f9c236b6f555046bac", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140115, "uuid": "64ee447c-bbf6-42e5-905c-7894158b4230", "comment": "Malware payload (ConnectWise)", "value": "ef6c5eb5fd7029d03b1906821d91e50ee5afb958", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140115, "uuid": "af21e230-f8c8-46aa-ad01-3a0d6942e673", "comment": "Malware payload (ConnectWise)", "value": "c1fddb9d341863fbc442c6596aa233c8c12e5cc79bd6c0f1f8c064e5e472c391b594cafc82f002ae93ed984cc340254d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140115, "uuid": "a3b29ca7-ae24-4195-a21c-09d7b8d99d98", "value": "T1DE46E111B3DA95B9D4BF063CD87A92699A74BC044712C7EF53D4BD2D2D32BC04A323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140115, "uuid": "f259cfaa-9584-4383-b5af-6dab5f3f4cc0", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140115, "uuid": "a75159ab-1cb5-461a-b528-8d2311d12dee", "value": "49152:7EEL5cx5xTkYJkGYYpT0+TFiH7efP8Q1yJJ4ZD1F5z97oL1YbGQ+okRPGHpRPqM+:UEs6efPNwJ4t1h0cG5FGJRPxow8OgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782140115, "uuid": "02374385-44db-46f1-9941-cf3986da743a", "value": 5673264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782140115, "uuid": "0e6f5bfa-18a0-412f-81bf-68ec45528db4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140115, "uuid": "9a6755eb-dad2-44c8-b0fb-b0d851d4c6da", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879be3c1-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141898, "uuid": "3af109f5-9989-41c0-a9c6-56fb7ddcfe68", "comment": "Malware payload (AgentTesla)", "value": "f3e38325c63b650ce064a36519a3f0e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141898, "uuid": "519bbf5e-16de-41e4-b2fd-580a1ed2343c", "comment": "Malware payload (AgentTesla)", "value": "507224977a9112b74ca87ea08828259c15d39bd9744d6a71416d5e3500939b01", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141898, "uuid": "e6afe852-b389-464d-af23-98811b2d8a79", "comment": "Malware payload (AgentTesla)", "value": "74a1caf6d63d508ee0e6faf97bb43347d3b2b511", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141898, "uuid": "e7392580-4c56-418e-9431-7081e11d9f3b", "comment": "Malware payload (AgentTesla)", "value": "f689867ce2672d8d0fbb837da7c35f6cf8fbfcd5c8638185bf1e81e8b39b07f59d581e0b025749c1e4a356728ae0163b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141898, "uuid": "ac74a52f-2129-4a57-9388-894961700ccb", "value": "T154F5295517A4A1323B21E7AEA537EFB0A40F901318D9CF14362EE318791CD4FA758AE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141898, "uuid": "380072de-8120-44f3-9c35-16204caa6373", "value": "98304:eGwLmx/kdoYGl28zrBZo6UOeU5ATRi1wxb+E4dStRUoP:nwLmTYh8zrBZopmAViob+E+NoP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141898, "uuid": "62df1e31-ea54-4eef-8a07-ed77bb58427c", "value": 3321761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141898, "uuid": "dd9750ca-e2b1-47b2-a854-8502ea4e45af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141898, "uuid": "9975ac14-f8bb-45bc-8236-c1860a833590", "value": "Request for Quotation FPG SDN RFQ260619_Pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62976a35-6e4b-11f1-ae13-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782140548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140548, "uuid": "fff59e21-8dea-4650-b858-8aaf138d6b82", "comment": "Malware payload (ConnectWise)", "value": "cee53ef94384940fbf12ca59041a55e2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140548, "uuid": "fee25369-6a27-4993-bd7e-7bf9d2193fea", "comment": "Malware payload (ConnectWise)", "value": "51117a84e36c6fb759d0478e09d94f7f919f244b7da9a068083f62fb1359827b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140548, "uuid": "d2f9c3aa-8bea-4530-84a4-b24b7644324e", "comment": "Malware payload (ConnectWise)", "value": "6445c9df6a7e5faf484e3d2f32e94cd0eb45fedd", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140548, "uuid": "276e8e62-4be3-4e48-91f5-b5e128227140", "comment": "Malware payload (ConnectWise)", "value": "1c404e3ee81734fe664090d37f691ecd8c8e295bc6b03bd579e58b8fa834ebd75a388bc112fb39f0edb60dbf36365d4d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140548, "uuid": "47743303-cf94-491a-82de-4df60f9628fe", "value": "T12D835B53B5E18476E9720E3118B1D9B4593FBE110E648EAB3398423E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140548, "uuid": "62eea93f-af18-40fa-a180-d4a7c53676c3", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140548, "uuid": "54bd9831-c07a-40f3-a748-5a9955807801", "value": "1536:6boFsMHqzISrGqx0WiwbqKHxfd6dldV0OCJRpsWr6cdYV7hsYYYW70:n9q8tC0C+axfdalBqRfbYRGYYYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782140548, "uuid": "2e702e9e-63da-4315-b2c6-1b97c86903f4", "value": 84216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782140548, "uuid": "05fd395f-2f4b-4bcc-a531-45224e4c39e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140548, "uuid": "ca0ca00a-e285-455e-8786-bcb6ce179c95", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fc6e51f-6e84-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782164997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782164997, "uuid": "2aabedc8-87d1-4822-a6d0-20365f7efa45", "comment": "Malware payload", "value": "c61d35daf42880bfac6145349a2708fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782164997, "uuid": "1aeac3f3-aa2d-47c5-9eae-1979ff8af568", "comment": "Malware payload", "value": "539180762054857204a5a73e81bf67dbcf28865f5b89f5102a4aac4054dc83db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782164997, "uuid": "6897d98c-d693-43c3-be1b-6cc3e3a2d245", "comment": "Malware payload", "value": "b82ef8ca643cb6d92a4849b575ea0f49a8f96f49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782164997, "uuid": "26e7378a-3c47-4724-81cc-1a383388a6be", "comment": "Malware payload", "value": "75631656cc66f33d134d7baad129b9e85b2ccfa73d70db8f609c5b37ea9b887834ce8a36876ec13bd483ae92ad7f442b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782164997, "uuid": "b6c0869f-7a7c-43bb-b04c-419cd1258d35", "value": "T117D3995E2E228FAEF66CC73047B74925975923DA27E1D6C4D2ACC1102F2028E545FBEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782164997, "uuid": "795eb05e-615a-4512-9889-f9d047297dd0", "value": "1536:cfzE/vQ6wQ6u+6L+1E85Zdpcnv7HyRx/eC39cxUD5TQ9GLYTr45Y:mR/cjHyRxF39xAIYTU5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782164997, "uuid": "4a4c7171-155d-4eaa-8a99-3eec8cc6a70d", "value": 140412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782164997, "uuid": "b224ecfe-dac0-4711-accb-8a321f2a39e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782164997, "uuid": "ef8e7353-28b5-4395-86f6-da6b98f2366a", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4967da41-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141794, "uuid": "d11ee82f-e5db-49b7-93f1-1c8c6edf4a00", "comment": "Malware payload", "value": "02b5f29f16f8e604cb4403bb9731751f", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141794, "uuid": "68969be5-9d08-4535-9d65-b9e171c6b4d7", "comment": "Malware payload", "value": "53ab9fedbb0c92555040e3b23f9643a56c02472a02fdfc3d8e53a4995b6b4655", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141794, "uuid": "dc5fd060-0263-4a03-aa78-397437f9192d", "comment": "Malware payload", "value": "27e4075024b9cbf35c8e2a70dece7c75090eba0d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141794, "uuid": "c7b66cad-d845-4561-8393-da8fcf33d2ba", "comment": "Malware payload", "value": "dde9286b562c409974517850367b92f4a79ebb333558265a4ef5e25e41bb3c09aca40d4d834df35995a63c24ce67380c", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141794, "uuid": "8cc3c050-007a-477e-b19d-808ad0e0ce21", "value": "T131D256CEA34F39400032B4FB9104F465A5D6B12E77654E83B94A6F23A6B333E03D496D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141794, "uuid": "9f08a93b-4cf9-478e-a330-375199a60f3b", "value": "768:Fg3xGJcoSJ5G06BqNJwEHBPA/R6r5P3ts5h2yOq5SDYkd6kwaY3SkgO:Fg3xGJcoSJ5G06BqNJwEHBPA/R6r5P3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141794, "uuid": "83910775-5295-45eb-9ba4-d911cd8586c6", "value": 30019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141794, "uuid": "62503e3d-7473-457f-9e9e-714adb714d56", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141794, "uuid": "e183804e-9287-411c-913e-8a768bb85633", "value": "rrrck87743.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b900ecd1-6e4a-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782140263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140263, "uuid": "6a42fe80-a2e2-4c9f-b9c5-942afc951c38", "comment": "Malware payload", "value": "f500581a9e3ba199783e7951daf6f5b3", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140263, "uuid": "a16e27d6-390e-433e-a320-9f9d3e38f309", "comment": "Malware payload", "value": "5485368e29878f8170406583d36a8ef1d90099db4463852dacfe6aa75dfa2669", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140263, "uuid": "4c6bdd37-8230-4400-a2bb-dced5ef22955", "comment": "Malware payload", "value": "db9651e6c4c07eeebda4b3ac8faac3de534ba9db", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140263, "uuid": "ecc27ac4-a390-45bd-9b88-f8cd97c044b2", "comment": "Malware payload", "value": "42b3b6bf7e904478637ba81af33652f63148b5dddc1f5298ecb0a5d92350e498b9e24f4e74b44464fbe6600fee24c8c2", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140263, "uuid": "15d03867-b557-42bb-839a-27a238f6f541", "value": "T1F2556B42E285CE96CE0CD37C1E928EA8B3BADD918ED977B7351C735C2EB63B05905085", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140263, "uuid": "9f2faa8e-79ba-4890-8662-321747845f6c", "value": "24576:W1LXVEYW4daWuIAhS/M5lftnF8fp1oCCp8:wLXVE/KluxI/M5lfP8fp1oX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782140263, "uuid": "18b59598-035d-42cf-84f4-96235876ef8f", "value": 1397248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782140263, "uuid": "f569a7ec-6a01-456a-a9d3-dc2b465737fb", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140263, "uuid": "6b912218-dbb7-4d53-b2c9-c7e5668f6284", "value": "INTERMEDIATE BKR SURVEY. Formato BASE_083658.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca583f2e-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782141581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141581, "uuid": "0c1b5558-bf95-4729-96af-5fa2be97e894", "comment": "Malware payload (Formbook)", "value": "b6e356e9683c09f82c324ebc93effc36", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141581, "uuid": "8a1b1477-4465-4f94-90aa-02e4b1ed82bb", "comment": "Malware payload (Formbook)", "value": "55d983dd42592c18f28e3d70069cc5155efa394a8234bdc2e17b62edeb6208dc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141581, "uuid": "361785a0-f3dc-4dbf-a56d-255b0675ac5a", "comment": "Malware payload (Formbook)", "value": "8b4c16a7a28723e6ba467076de193399164d1583", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141581, "uuid": "f9d63b54-8ac6-45e7-a7f9-03204e90ad00", "comment": "Malware payload (Formbook)", "value": "91fd456df2b67c9787e2ba9efe515891ee0a3d9326e25ab09413817ff7ffe95b1f007e00c2df30763dd1bcc1caf5028f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141581, "uuid": "1e17934b-ed8c-4455-9616-481dad6fe891", "value": "T1B463754562E0FC8D43F75BFB362F71D5F4DA08DA6984880BE601F8A4F5A5A09EED1630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141581, "uuid": "99c51fb8-89ca-4b8e-8aba-6937eaaa42a8", "value": "1536:4qmw1DE+lleSNIpx/kalFHDJt77ndL/CT9:4qmw1DE+lcnthNO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141581, "uuid": "3bfc8a9f-b2b4-4f86-b0ed-cd724dcf3f21", "value": 73004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141581, "uuid": "12426545-c3a4-4991-b579-b4bd590e6d5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141581, "uuid": "3539202a-4c36-4c97-9aac-d51bd684cf80", "value": "IMG_8920.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e861437f-6e0c-11f1-ae13-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782113714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113714, "uuid": "9cbf9113-7d5a-4e42-adb5-e35f3c5459f2", "comment": "Malware payload (NanoCore)", "value": "0c8d700f7a519da0160feeeb10ba3f67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113714, "uuid": "c024542a-82a8-46f8-a916-1bbd5f851ba9", "comment": "Malware payload (NanoCore)", "value": "57221740ae61a5958921f73b0f14e2ee2d4af79629139f935ac828f325ce5786", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113714, "uuid": "6ea68908-d571-4dec-934a-356b2299f866", "comment": "Malware payload (NanoCore)", "value": "403eacb0b1dd75e31f778fa51799623706742e76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113714, "uuid": "e08f0701-7925-4687-80f6-b0c5cdd23ecd", "comment": "Malware payload (NanoCore)", "value": "c27e5791d0633c99da5d8d177a74de6367b9588dc242ce2ad66970abc8edc7573712a36dd10bd6ec94d307f7b9eba6f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113714, "uuid": "738fe1c5-ed9a-49f5-a37c-1624f1303b64", "value": "T1BC14BF163BA84A2FE2DF8579611242128379C2E7D9D3F3EE28D455B79F267E40A070D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113714, "uuid": "2784fde7-6e54-4f4e-8568-6e016932f0ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113714, "uuid": "2f4b2538-9f29-4d2e-8fea-5aed8388adfb", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIapDcdg0nZfileCvGZ49hpUOwp:MLV6Bta6dtJmakIM5ZV0wQr8aOwp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782113714, "uuid": "e9fe0308-477b-4ffb-ab96-fff148ea7d7a", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782113714, "uuid": "a65cd241-2934-472a-ae08-18ddf33e97d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113714, "uuid": "f41ce5b6-f079-4af0-9bf0-80d8a315b1ac", "value": "0c8d700f7a519da0160feeeb10ba3f67.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9724c763-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782115295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115295, "uuid": "e9adb499-aebd-4aed-91a4-bc6eb4b12bee", "comment": "Malware payload (Vidar)", "value": "6bdcd7a0d5c1bb109552844edebdf4b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115295, "uuid": "308fe3a4-395c-484a-89cf-4fc1a82047ce", "comment": "Malware payload (Vidar)", "value": "574cebd5ea2acb459274679dc5411d805e1a20c4c79c111450befd038819c4c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115295, "uuid": "2af50be0-2d6d-4182-8ef1-e4baca672048", "comment": "Malware payload (Vidar)", "value": "56040d65720a2eee67b0cff3160e3504d113ec65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115295, "uuid": "57eb7afe-8a16-4a98-9654-4e1907c74809", "comment": "Malware payload (Vidar)", "value": "7c3a47aa67ffa7c3a0d3c3e2f6c415ce6c5319940214164b0670159561400c0df74d5a7986f1e24d41900b00f5830a93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115295, "uuid": "b21a571c-b568-40be-994d-0fdf0ee852d9", "value": "T18CE633413B9405B6DBC1C0368FAACF2D3477EA65A3044BA347D52D82DF921B87A1B8DD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115295, "uuid": "4670a00e-1a8d-42eb-8a38-3736b81cba54", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115295, "uuid": "8c31aed9-8608-42b8-a17d-627d81466b7b", "value": "393216:+pyylzKO4ouPZZ03V7f3jBFPVXD6KWW8n5RqEdZ:eylO4ouPn0hfXEHWGRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115295, "uuid": "3a356d92-a6a2-44fe-b69f-928e42ac6040", "value": 14267915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115295, "uuid": "bdb78b84-92f4-4250-b350-4e8d8db57728", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115295, "uuid": "fb14f5dd-593d-4d39-bfcf-25b602a759ce", "value": "6bdcd7a0d5c1bb109552844edebdf4b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7e3bee-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1782115336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115336, "uuid": "bc9dd528-b0e4-4476-917a-a447a2c5ab91", "comment": "Malware payload (SalatStealer)", "value": "dd9e5a8ef764babeb49e5a4154bea186", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115336, "uuid": "4fcf3efd-6444-4467-a4a9-6583a079709f", "comment": "Malware payload (SalatStealer)", "value": "57ee90250da5f51dc59d2e189bbedd0e2c1dba097a766e5bab903288686322dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115336, "uuid": "72023580-f399-400c-a735-650d53d43fd3", "comment": "Malware payload (SalatStealer)", "value": "9c6114c5ba66466b3bbb7c25870a33ba9848e64f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115336, "uuid": "8abad85a-ec55-43f8-930e-3bd40b196a16", "comment": "Malware payload (SalatStealer)", "value": "afa3b1ee5725be02b34aa2b0b50562da05a84bbb5020dedb46caac014cc6855c4cf9659942aa7673c060511af79e97c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115336, "uuid": "5d4297dc-6751-4c63-b63d-b94f82a10456", "value": "T1C4F533279A3E677ED973FD77219E36D1C3E0C32F2A964C3B088D7CE242526A411961E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115336, "uuid": "0e087151-8e73-463d-92b3-19800f4218dd", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115336, "uuid": "7c02caee-2291-4b77-a63e-af2f210e91ff", "value": "49152:ZcZ5H6ZeiEIKRIHg1XwrLAk/EgN6W5iEzsma+J/DOxc5lX3lchsx7Gn6BBoPdgVZ:ZcZBKevFX6L98yvflJ/DscpmKGnjPd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115336, "uuid": "f6ebf5f2-3e52-4043-8d61-9288fbad0d32", "value": 3593728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115336, "uuid": "be9634ce-d39b-4826-9ec7-784edc4b71a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115336, "uuid": "d1dcd459-4754-4a00-83b6-71a8301dd773", "value": "dd9e5a8ef764babeb49e5a4154bea186", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75ced6e0-6df5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782103643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103643, "uuid": "3152c8a1-c860-4bb5-b6e3-8d96509b61d3", "comment": "Malware payload (Mirai)", "value": "52b0c909b30a86a79a016161f9212b70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103643, "uuid": "b39a9c2f-c062-436d-a017-46082983e5be", "comment": "Malware payload (Mirai)", "value": "57fa061f794297b1b23aa1bbf4a552d8e403568f6b01a24aa9b64257aecc8553", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103643, "uuid": "f01043d0-527e-4a64-b604-581c62193512", "comment": "Malware payload (Mirai)", "value": "d2c4a16895edf91e22695bc240ff1811661ef0ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103643, "uuid": "257357de-6b5a-4eff-a89c-578ada439fe4", "comment": "Malware payload (Mirai)", "value": "5dce362044b62bb0dd5cd17a33620ded316e47311a2572ee4a12ad9f1d94cd474949823674d80d8705e24d08f8983d91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103643, "uuid": "b29765c8-31e3-4df9-b6b7-ac4a5f2aeba0", "value": "T121B34AD2F401DDBDFC0ED77F4453060AB631A36116935F3B675BBAA3AC310A56922E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103643, "uuid": "35f9f98d-0cdf-4245-a0b3-3bf53c39a076", "value": "1536:iT5dgyt7gtSZrttjUqaxnJAAtK8FhBeAw19j8TfBc/3b+dHMakFuzrE:Y5dZ2YtjDaxJAAtXBY8NKlakFOrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782103643, "uuid": "96209b2d-de9c-41d0-af9e-7f7061cdc0c2", "value": 114952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782103643, "uuid": "079177c4-6cb1-4c52-8b6c-4444a4a4b7f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103643, "uuid": "556e433d-04e0-4e35-b0f2-7915dc91efde", "value": "nerv.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34106338-6df5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782103533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103533, "uuid": "ac255b8c-08f0-4d89-82a4-014b80c0935e", "comment": "Malware payload (Mirai)", "value": "a9738e2d56a47f806eb1f0f4dccf4595", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103533, "uuid": "b50bc21c-c0b2-4248-be27-b3e051638be1", "comment": "Malware payload (Mirai)", "value": "584d6786596e0a2e8ae08a0de55676e10a9e5f12f7efac9e073c7f517cece228", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103533, "uuid": "832beb37-8aff-4815-aa96-62e238e11f7a", "comment": "Malware payload (Mirai)", "value": "4e6e2c09098f8251fcc32dec84d496db0095031a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103533, "uuid": "fab0ea12-8f16-47a4-8ba0-6b2d7ac35be7", "comment": "Malware payload (Mirai)", "value": "1ef5c3cdaf4db9d367bba91c1661b779346597d7161d1ea05e8ab89e85a564427399dd9a004dd0f8b8ac38eb84c3153e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103533, "uuid": "7324b799-f234-4aab-aa4b-d55945870a8f", "value": "T1D1A33903B4C088FDC18AC17817AF763AD972F56E0139F1FB2BD0EA166D4DE215A1EA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103533, "uuid": "f544b359-1bc6-4daa-a587-9b9a58115d49", "value": "3072:EpSf3dIub3tZGahSksTYjSSgYQ2V1E1oRi6LbDMfsVs4/Uu:MSmub3tZrhSYjSS6iax6HDhs4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782103533, "uuid": "4412b272-8985-4481-b42a-6ef90b59ceca", "value": 101232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782103533, "uuid": "e1c5e7c2-00be-4c50-bb0c-c7630e1fdda8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103533, "uuid": "eacad1af-266f-4505-886a-df5e0f069a3c", "value": "nerv.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "623fd6f7-6e44-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782137541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137541, "uuid": "c189b568-c6dc-470a-b663-ebf7e528b97c", "comment": "Malware payload", "value": "11e3254f10f02bc6ed3ece26c5d80560", "object_relation": "md5", "Tag": [ { "name": "base64", "colour": "#4F262E", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137541, "uuid": "8eb42c0c-488e-47b3-806d-3b36f413dd49", "comment": "Malware payload", "value": "58ff722ee7e956e18d938137c41fb7c915caea262c088344aba71729c53e843a", "object_relation": "sha256", "Tag": [ { "name": "base64", "colour": "#4F262E", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137541, "uuid": "712e647f-44ee-494d-bda0-a73eeecb6fed", "comment": "Malware payload", "value": "ed8a95cb343b1a37f21dad158aaf51c3003902e2", "object_relation": "sha1", "Tag": [ { "name": "base64", "colour": "#4F262E", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137541, "uuid": "40f27d7a-a7db-475a-b413-c448f2beebec", "comment": "Malware payload", "value": "603423b0af8495c0706ee550147a44502e2b2a416000b93f19d30c70ea1dbd33e6306b0c28d52358287fdd4f1820ca6b", "object_relation": "sha3-384", "Tag": [ { "name": "base64", "colour": "#4F262E", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "payload", "colour": "#151912", "exportable": true, "hide_tag": false }, { "name": "suspicious", "colour": "#3CDBCD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137541, "uuid": "82eff0dd-3add-4ad2-b70b-b37f291cbf6d", "value": "T11A83D8E1B04C0AF215FA9A9ADC3BAD97D17F9AE1074A6B470F2CF19132A0125C7CDD16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137541, "uuid": "9afb34b3-204b-4fd4-9e07-47fe371acd6f", "value": "1536:PUaPienokQuiKia+bv+7Grt/7DmbK1Xv1odNw9kT8BhFCTdlSK5Evrrb:NskQuDiaoW72D4QodNzT2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782137541, "uuid": "4bb96b94-e320-429d-9ebb-e7d1e7be32a5", "value": 83621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782137541, "uuid": "8d12f34b-a455-41db-b4fb-0116851b786b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137541, "uuid": "6f7ac570-450e-4661-b29b-cc130aafba91", "value": "loadermanager.lua", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8655de0e-6e95-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782172390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172390, "uuid": "16c08bc1-fc8d-44a1-ab55-3396591f6bd1", "comment": "Malware payload", "value": "18c4a58c8233c25e0ffb2cc1575e735c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172390, "uuid": "78287679-a187-4820-9176-84ebbbef23e5", "comment": "Malware payload", "value": "59160a685c30b77db8bbd554f2f1bc6e095944bf4bf3daab7c277bac7fca5fb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172390, "uuid": "e9e3193a-6b88-4c21-ad27-f4e2ccc5982e", "comment": "Malware payload", "value": "356104c67e038cf21148597287b7a5db5646dfc7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172390, "uuid": "92636a99-0a5d-4ff2-b8c4-02c6311d8b71", "comment": "Malware payload", "value": "b57c18d0d0b3f2af0b93e209a5f344615995dc10732feca055ebb50f7fec1b3537daa50096db47c19a8ba04b6bec18c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172390, "uuid": "ef7c33dd-b723-470f-a97b-7616ae07c287", "value": "T1FC931955B8919F96C6C20577FF1E438C331623DCD2EB3263FA14AF6D368B4164E2A066", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172390, "uuid": "54c08eca-17a1-43b5-ac60-dd44527f1e16", "value": "1536:3UD2kI9bKxd1+Z54qh3R0INMcec1gdV8lqOFp1SnrEvFQ9noiA1rRzvbk07cO:3IIx8+gcB9NMZcabqRFp1SnrEvCM1r1/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782172390, "uuid": "92d889bd-571a-46cc-8951-3db96221d412", "value": 93052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782172390, "uuid": "3e2b1ae3-fae4-4bc6-bf30-50a525aa7950", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172390, "uuid": "fc0e20ae-4a84-4fe8-9838-0daa6df954f3", "value": "9DB9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f82bb9e5-6e7d-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782162273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782162273, "uuid": "94a23f5a-cf78-436a-98b3-28201bbe249e", "comment": "Malware payload", "value": "f1c5d9417c3ad53f3277e86a92acec93", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782162273, "uuid": "e54bf4ea-c0b9-4006-ad21-a27c004a64b6", "comment": "Malware payload", "value": "5a26110977d7303b87bea6d3b8c8675bcdaa27813f3404a5d197f87a0d767423", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782162273, "uuid": "b65f68f1-84bc-4689-9fca-82006a5da06d", "comment": "Malware payload", "value": "a67a6e704e27dd928d9892dca48113ac3e5bf081", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782162273, "uuid": "f8a4d699-e5df-4abf-b24b-32b8036b64e1", "comment": "Malware payload", "value": "9b2ca0a7ad3566f857278fe2b5d96a39b2027dce95fe0db4743e17833e29cdff3689d848f241aea513ba4a7eae0b2cf3", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782162273, "uuid": "72b0ec16-f280-41c5-92da-fcda996d79bd", "value": "T17B01869733040876039FE820EAF602168BDE8AE56000FFE7B0D843509E2C7935BE6D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782162273, "uuid": "c1ab6f13-c20e-4a29-84fa-a4bd24e6622c", "value": "24:7xnJkh4O1JYLBxW/mqT58MYYfwDL5VrWyDmZmUR:7xJkh4YazAmqTiMYiwnfbUR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782162273, "uuid": "db804ac5-d600-4665-bc86-5bb93ae56854", "value": 811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782162273, "uuid": "771ffeba-fa6f-4150-97ae-ede94020520d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782162273, "uuid": "7c982383-1e5f-4260-8a64-f048b4ab205e", "value": "Reader_en_install_v2026621.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d4587d4-6e4c-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782140995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140995, "uuid": "a53cf980-2e6f-4dec-8a96-e4ce1842f776", "comment": "Malware payload", "value": "5eb5357731738d9cea6654f3dcbbdc8b", "object_relation": "md5", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140995, "uuid": "c035b28b-a0fd-4c12-893d-d704400b4793", "comment": "Malware payload", "value": "5a2c5ecfaa6a582055f07fc292f602c39c59d5ae6bacf711acacc60f7ed3d8a6", "object_relation": "sha256", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140995, "uuid": "be19f034-9138-45ae-90b5-598c16c10ee9", "comment": "Malware payload", "value": "ba4742418b71dfff1dc7992ef8cf6e449b5170bd", "object_relation": "sha1", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140995, "uuid": "6a155f6c-fc73-4017-bc17-ac73f2b63eb1", "comment": "Malware payload", "value": "5d3ed2f8caea18bb27113d9ecf86e22301288e81fa2f6f57728eeb6b672a23383b445a149a9e59e9b781be47a91ac48b", "object_relation": "sha3-384", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140995, "uuid": "8f10dec9-cce3-4246-b0a0-f621ef4a6fb6", "value": "T11773026558E5762CF709DA4E2E24BB6FA0E6D4C0A7863EB114B062738DCBDA335C5320", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140995, "uuid": "9cf88c27-0000-4002-8c97-f27e34ef085b", "value": "1536:mI9hHsxGDeMy1h9G4OJK5ewV4I1ORpaZDZhenRaZ05k4qNCF0gpeqF:mI9dbFy1zG4Ox2L1MpGDZERagkFo5tF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782140995, "uuid": "3a18f4c0-1340-4339-8960-e9e1312127a5", "value": 80446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782140995, "uuid": "e67b6ec7-4eed-47e1-8349-a078f2995856", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140995, "uuid": "ec07d17b-1ed9-414c-bc3e-0ab9ac10f44c", "value": "Bonifico_.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba71d4e9-6e03-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782109771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109771, "uuid": "9dfe49a7-298f-40ca-b3e4-285f36644a04", "comment": "Malware payload (Mirai)", "value": "8456c9f0033b4861ec6a5d4ba97a7708", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109771, "uuid": "4cde8558-dde6-4d4a-8576-1903b443f216", "comment": "Malware payload (Mirai)", "value": "5a6193b9505ee575470b7d59c41e0561f64db22ef2c54ea66c3b7f16893bd784", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109771, "uuid": "2776aeb4-aad2-4fde-9b33-ea6340e2ae85", "comment": "Malware payload (Mirai)", "value": "b49df2ffbb4fc03c455cd01a0621729b7cf6fe10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109771, "uuid": "8df79ade-de90-46c3-bd60-406c562a718f", "comment": "Malware payload (Mirai)", "value": "827978c5557effa61f0f894eba5e0d8813063c6a45464de1afd5832c7e1dbe98298df995c2c11f73349212c75edc157d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109771, "uuid": "c8bd3386-ac8f-478c-b66c-feb3b61320b5", "value": "T1C8647333991584A1E0204CF2226777469C07D7BF88E726D3EE5A59B0FF3541B92BAEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109771, "uuid": "152ddbee-dd34-4ce0-ae25-46cae66cde44", "value": "6144:mDpB+Qdn52QuswjoWSWQxLcgmXFscMdxDa3aT:SB+25rwjoW4mXFscMdxDa3aT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782109771, "uuid": "90410fe9-8386-476d-a4e4-9932ae3860f0", "value": 323343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782109771, "uuid": "7fe1150f-ad6e-4ad9-b651-ae06f96d36f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109771, "uuid": "95d135f2-5895-488a-96be-2e630f7abe60", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2951a888-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141310, "uuid": "af0c0d14-d136-4eaa-b473-4b1edfcd88de", "comment": "Malware payload (RemcosRAT)", "value": "f64232dee392845da32fb74ef0a82a5b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141310, "uuid": "db3de548-6c27-482d-8bab-9e2d6b6b7c8c", "comment": "Malware payload (RemcosRAT)", "value": "5a8fa23a95dc7dfba540639f24eaab16f3ac93f5b17560f2bf7ef50275b9c384", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141310, "uuid": "670a0ffc-d97a-4e0a-9c3a-e5401d5728f1", "comment": "Malware payload (RemcosRAT)", "value": "0408357b76af9f1854ae17bc4a89daa8550daad4", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141310, "uuid": "565c6af3-e22d-46dd-9e9d-99efc5f8ad5b", "comment": "Malware payload (RemcosRAT)", "value": "eda91f94bd8dfeddb16225256f93c9570d9d8091983d9a16fdde8f7daa8f3f76ab3d8f81682c178221e0f574d9347f94", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141310, "uuid": "e2feb4d8-fd02-4a45-a118-193e63a4cc7d", "value": "T1D9A40B38ACEE4029F173EE598AD47997E95FB663372E949D1092034B4713981EDC233E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141310, "uuid": "ac5504d5-23e4-4941-ab05-229e2ae6274f", "value": "12288:u/iGtMV2fZWDcrZ1RpBrbK15drVudkbagfxBx:uqVuG1HDG6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141310, "uuid": "7a9c7137-762e-407c-85a3-eeb150c39032", "value": 453718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141310, "uuid": "25519c87-0759-469b-bc84-9446d542464d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141310, "uuid": "9a4cfca5-8efa-4acd-89cf-8b2e05d7fcd7", "value": "PO260600527.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0448353c-6e60-11f1-ae13-42010a9c0009", "comment": "Malware payload (PureHVNC)", "timestamp": 1782149409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782149409, "uuid": "153c401a-f4b2-4ab7-b209-2c29e7d70338", "comment": "Malware payload (PureHVNC)", "value": "14872971ed0749808b679bb8460d6b4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782149409, "uuid": "46c2ec52-d6b6-4974-8653-e08a95f97c59", "comment": "Malware payload (PureHVNC)", "value": "5ab8e924ad56b7d5ece3e62d70fcf8aaf83662608a1d9c3231ab26a426b73c3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782149409, "uuid": "5c12eb1e-7c29-47ee-9cbd-052c85250991", "comment": "Malware payload (PureHVNC)", "value": "e40c64dce698492f682bb8b30279f4f063102adb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782149409, "uuid": "3078b70e-3033-4962-85cb-ecac4ae397a7", "comment": "Malware payload (PureHVNC)", "value": "c36cb0b65ea31ce5635ed73572337703edf7d0a31ad336e8a997fd70db8e41260bda1611491e83d5c3d57c5803c522f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782149409, "uuid": "c8060a7f-c604-47dc-87fe-103fae2e0f57", "value": "T188F4BF5B32968F21E2881732C2D7241187E564477677E74E798523CA2A033FBEE4B397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782149409, "uuid": "843654cc-2224-48f1-b8dd-b073629b9ae2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782149409, "uuid": "58e46c16-ec2f-418d-850b-8f4f49359c60", "value": "12288:5tXzLCKvYQEFUQPQtgYeLNj+ygIHDZzDd2g/b6sdV1Ax4XAdyDQAE+aNXy:rbtEaQPQREHZJDdrN7sJUDQaaVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782149409, "uuid": "df4bc211-b86f-4e83-860f-e25f1a5d43a3", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782149409, "uuid": "15511807-7f2d-45bb-bd50-7557f22ed28e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782149409, "uuid": "0468df5a-2503-4a29-86ce-3561f25b8a9c", "value": "SecuriteInfo.com.Trojan.Mardom.ON.10.89455644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd9793c-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141503, "uuid": "aad773a6-f151-4fa4-b883-4de72194ab67", "comment": "Malware payload", "value": "7d727d89f3e0f79e9aa855f45064983e", "object_relation": "md5", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141503, "uuid": "f7b70c4e-2828-422a-a707-38ed22e364df", "comment": "Malware payload", "value": "5b54b5b33d28c293542d1d6fc0b89b818ab68def517af5dbb40f36c2342e4a00", "object_relation": "sha256", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141503, "uuid": "69a2aa20-3519-485f-8e5d-5f5d8d739bb7", "comment": "Malware payload", "value": "a0b8e707fba0d305f9d2c2a5d016f353fa44e488", "object_relation": "sha1", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141503, "uuid": "2280dc3b-34d0-4f8d-a251-bd2586d3f675", "comment": "Malware payload", "value": "a9cb059ad9252ab36dcefd3ce49f3b6938c424e5ce5b8498592777a5a903df3c7344fe618744fb5295a1e560bcd59c14", "object_relation": "sha3-384", "Tag": [ { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141503, "uuid": "27294c89-784f-43c4-a1d0-7350054ca3b7", "value": "T1C1753928C969C066A674CF5780C06EA78D0B3F07BE29D12CE6614B6D8247D43ACF767D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141503, "uuid": "dbc73d30-4b13-4db2-9701-d75e4896738a", "value": "3072:ihqJoASQmvB3EVWcnL+iy9qXB7M/aUzQ6nmNCrzGaw+ZQKjvAeQzRMu2oVtDZhXu:6BvBSL+iyE7azLwdYQ32YhKdpkMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141503, "uuid": "1aa163c7-b0b0-4b04-99b6-ce5112488945", "value": 1615586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141503, "uuid": "21a60ec3-7992-4109-9e24-b25cf38fd270", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141503, "uuid": "c39cf062-9d32-4ce1-857e-7e9f14986012", "value": "Hsbc Payment_Remittance pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76375481-6e34-11f1-ae13-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1782130702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782130702, "uuid": "f18c49ba-b013-4b35-a349-3fe392ee6c54", "comment": "Malware payload (PureLogsStealer)", "value": "caa1b4b4fc6765cc2de4acc48f514337", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782130702, "uuid": "e4b7d64d-c8cb-4742-ba13-29514a890728", "comment": "Malware payload (PureLogsStealer)", "value": "5c2d1d2a8c862b64dac930035cb1f27f4c377bad633f03b7e2539e96d558c9eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782130702, "uuid": "4220c444-8705-4553-b77f-b1eb1307963b", "comment": "Malware payload (PureLogsStealer)", "value": "ab261f4e9dc79f0f27a45a8ffeb4a2ce2c4ab169", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782130702, "uuid": "4117451c-3f9a-4f97-baff-9835566b1484", "comment": "Malware payload (PureLogsStealer)", "value": "8ac9fc0233d91f4529714af2cd2ba990b781a15a402a6ff519153a47690d8816c22b20968ab39b69ee3ad2f43c6b154f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782130702, "uuid": "27c6d92e-abd7-4d74-a238-d23aa460d789", "value": "T18675173ADE74C57C76B8BE454DAFF44E4CB15F024958D5822895060B8EA2CD2AF7233B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782130702, "uuid": "bb4f385a-07f5-49f6-abf1-ea5fcef435bc", "value": "12288:zhLXCE4DNN9RPp5mq9eUpf/teGTNrGhxD/yfjot6sqXPJ/WMiSwGdgmwB9rL6lQ:sG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782130702, "uuid": "b3b181ce-3c69-48d9-8417-d252c7ee7ad3", "value": 1640298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782130702, "uuid": "114bcbd4-e0e5-41a3-9465-24bdb5ad0485", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782130702, "uuid": "17ea9925-2ee0-4050-94e2-663090cea307", "value": "NEW PO#30158420.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42015d8-6e0e-11f1-ae13-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782114512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114512, "uuid": "2c157b0a-f17c-4154-bd5f-f502f4eac635", "comment": "Malware payload (RustyStealer)", "value": "16e842400bbf74db1315b2ec3697cbcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114512, "uuid": "662e688b-326d-4c67-ac17-47b3eb14b4e1", "comment": "Malware payload (RustyStealer)", "value": "5c516974cba2aaaee4da889f153f7ae078caf833b31eb6366bd9f8c20f956e76", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114512, "uuid": "0daaeed7-a03c-4d87-87e3-8a8eb4ffdc60", "comment": "Malware payload (RustyStealer)", "value": "73c60396594458f2731eac23824a4e18ebef5129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114512, "uuid": "5adaa0fa-8716-40af-b944-5211bfe02b00", "comment": "Malware payload (RustyStealer)", "value": "932845472199076f7ac5b8adebe4f8acbf100be9e7bc56c199d2e3ad430e127e6a9b74c45a7f7a627579dd7400bcb222", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114512, "uuid": "9534fb8d-3aaa-4c86-bc36-f038805ca212", "value": "T1E267F158020CE388785F4636E3D4F83FF2EC25997776E8A9BC39D1DBA412285C279587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114512, "uuid": "e84d612f-cba8-40d4-8f9b-cc02da010169", "value": "0bc1b1e557f4a4387777840b7c7925ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114512, "uuid": "3b3aa17c-337c-4812-b71d-8f25b4515887", "value": "393216:a/X7iShs1DpidsM2xCs5iYCOLYgCig8sQeNut5AVnDii6Ss1DT9SfhVEBhz:aDns1piCxCahDLBtVbD1DT9SfhMhz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782114512, "uuid": "9de5b507-9be8-4e1e-9dbc-a2be79a3af19", "value": 32582656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782114512, "uuid": "3c15c714-5577-4cbe-9159-f053e00f9cad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114512, "uuid": "4c5cb9f0-a46d-4504-b1ac-6a0f8e79e362", "value": "Bootstrapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea569e7-6dff-11f1-ae13-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782107980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782107980, "uuid": "f3befe5c-f461-472a-a603-dce61ed921c3", "comment": "Malware payload (Formbook)", "value": "91acb354796b655cff094a7082df6469", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782107980, "uuid": "61217f35-b7ab-43f2-90b5-5f4bfb72d8f3", "comment": "Malware payload (Formbook)", "value": "5c75f8db41424705b4a686a8042c433e85210807b6963148773b7bf29c261b20", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782107980, "uuid": "59e5e927-3cd6-434b-ab32-5df9870d0d7e", "comment": "Malware payload (Formbook)", "value": "abdb7661d4c2313096db3391a37d14be66d558c2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782107980, "uuid": "93ae2956-5370-4288-8fcf-d7f53afcdc18", "comment": "Malware payload (Formbook)", "value": "a683e2e65bc46703898d640ff353eb261b5018d21d0100721b998a813f727fce1007198582970d21eec1ae60f23fbf37", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782107980, "uuid": "088c607f-d4da-4ba6-8f25-3e6e3682b60f", "value": "T18AB3434127D8E44C13E36B7A361FB1D6F4AB1CDD6E54854BE200F8D0E4B824AEEE56B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782107980, "uuid": "0778a3f4-0b6b-4563-9675-b476c7e234d8", "value": "3072:CaJK41uVqGTOuWFvGs+Tq9iK8YappH8cV0UuNL:Cs1uVqCOnFvn85mL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782107980, "uuid": "31098ce4-5336-4dd6-a95e-d69f6c412f1a", "value": 110296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782107980, "uuid": "d0284c2f-3baf-449e-9fff-cc9aa2400cd1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782107980, "uuid": "5bcf7f6e-d962-49f9-acc3-8244db8addb6", "value": "1. GTC Procurement of GOODS_R.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26874dd7-6e0c-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782113389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113389, "uuid": "f2ef8f35-91c1-4dab-990a-97abe6bce93c", "comment": "Malware payload (RemusStealer)", "value": "2da9b1748b6154c69b6dcbbf09ec91d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113389, "uuid": "e6e42d58-6f69-4c19-a671-67f00fce1740", "comment": "Malware payload (RemusStealer)", "value": "5d641dcf1b0dae4f248a3037e4f50a9fe20a9a313210e0bf0f759153eecac9ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113389, "uuid": "a3373d5c-247c-4b35-89ca-0014747cfb52", "comment": "Malware payload (RemusStealer)", "value": "77867af29fdfdd7d42a33a05db3b9b45f4684b1e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113389, "uuid": "f8c3d2c9-5fc5-4503-bc53-2292d88496db", "comment": "Malware payload (RemusStealer)", "value": "dfec4707e2054b46bc9fb1f5b2a31c514cefa17345da086a4db4e6444524181f8832888b26e9fc865ff6bb11ecec891a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113389, "uuid": "da159733-af1f-4288-8348-f94df16d6783", "value": "T1FE243967D25330FCD552C078826A7232B772BA3D47249EF743A3C7369E219C06E79925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113389, "uuid": "ecbc3d62-dc43-44ec-abf5-4be8e4028acb", "value": "17081ce96f78327d576e14ddd5592fba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113389, "uuid": "73797a0b-1c82-4020-9722-4831bf0f6e9f", "value": "3072:YKfPZ5SQdMDqhf6h8Yv50xTXa84P/UKydVnGGOV80QIS6MtWGa3NiAzU/zb:HJYWPrnJwQI2AiAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782113389, "uuid": "1337736d-4ea9-4547-83bf-df66ba9641c5", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782113389, "uuid": "aaa1a301-b296-41c0-bacb-49b023b76f84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113389, "uuid": "4f77d249-cadb-4131-8457-0fa217cfde87", "value": "SecuriteInfo.com.Variant.Stealer.396.84565984", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d92c89a-6e03-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782109696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109696, "uuid": "c9e2aa23-1b4c-4d1a-8dfc-b5734a0d4b95", "comment": "Malware payload (Mirai)", "value": "c2d81f2df63889d45468de6625ab494f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109696, "uuid": "1a6f6c5c-6775-44ef-aae6-dee910d6c888", "comment": "Malware payload (Mirai)", "value": "5d69b801926d789d11b2d77e01c6fc6c0939a7fe070d5a31dc00c99d754db43a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109696, "uuid": "59634e96-0385-4592-a6b5-fdcb53954181", "comment": "Malware payload (Mirai)", "value": "c268ac6f429f5c6c69975e0f9805b0f2eed2863d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109696, "uuid": "f77de3f0-b796-48b1-aa7b-02a51cfed396", "comment": "Malware payload (Mirai)", "value": "d928e0838d5eea8a0d627fe5c3770a37a687e1ae1cdf35cc161a7191944bee36dee07ba440a5de55eef74dc56552df24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109696, "uuid": "31fbaf15-7000-4e1f-b81b-558f423e31e8", "value": "T13284853799159A69E0248CB213B73B519D4746FB88E223D3EA2D9964BF3041F51BEFC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109696, "uuid": "1fe6ba57-477c-4809-90f9-150afdd07746", "value": "6144:xpcwX/3x2/4HwjoCyJrUmr0h+afjUHJMNb:xGQHwjZIrUmr0h+afjUHJMNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782109696, "uuid": "717ed4b7-3806-487a-b2cc-d031deef9f6f", "value": 386929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782109696, "uuid": "47b2148d-b560-41f3-859d-be24b90c2e30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109696, "uuid": "df431063-88ac-4548-b4b0-0caa95fe27a7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd075576-6de2-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782095602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095602, "uuid": "4b087407-dfae-4edb-84a4-1110c47c09ae", "comment": "Malware payload (Mirai)", "value": "c3c863ec3c05591b0b7143a0ead85901", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095602, "uuid": "660ac46c-bf0e-4923-af9a-9320f10b0be7", "comment": "Malware payload (Mirai)", "value": "5ea5fd6006918909f9026626019e19b00f8935ec9f03b9cab6d8f88ac8c77e8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095602, "uuid": "636b5329-ec4e-41a6-bf48-a4f1ce3886aa", "comment": "Malware payload (Mirai)", "value": "2ddbad1e2d138648fab1dd713e739c9d33b84dd7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095602, "uuid": "646b8947-5b38-4a91-884c-114b48c3a46f", "comment": "Malware payload (Mirai)", "value": "93d25acc17756678b26d9d90ed9d4e997637de66b7f977ea0d99afb9a604d6f23dc0dfd11c948070218188a1878999f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095602, "uuid": "60bfeb21-898b-48c1-b77a-aec205528ef4", "value": "T160730A81B9819B25C6D513BBF91F018E33165BE8E3DE73129D241F607BCA91B0D27E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095602, "uuid": "1d643716-b02e-4a07-814b-2d421b392e6a", "value": "1536:y0nC6qYfkiubZwoNCJYDQ7gppg6T63z5yAMw1f9r/1eUc6I+i3JqwsjAgQ:CskiIZJNlDWQpg6Ts4Xwtl/OJqwsjAN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782095602, "uuid": "3853019e-185f-479c-bda9-7e1d19df8654", "value": 79760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782095602, "uuid": "ecca4c53-5519-49e6-a244-27a3f7d19cb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095602, "uuid": "7ee37275-0012-48cd-9a7d-a668d6d6de4d", "value": "sora.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "554f5b8d-6e19-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782119050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782119050, "uuid": "351ddced-3b34-4fd1-bd68-1a575bc7af3f", "comment": "Malware payload", "value": "8e233b0250d85ae63076af45ee829c55", "object_relation": "md5", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782119050, "uuid": "7a898dd8-afaa-4f95-9250-8948365c8377", "comment": "Malware payload", "value": "5ecdf5efe2a74db93450f2b35e942b91ee6dd1b0f545c04810d2794b748b1dea", "object_relation": "sha256", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782119050, "uuid": "0bfb43ef-8688-4c02-80fb-5d4f2176a4f7", "comment": "Malware payload", "value": "ec14cf28fe8764d4f285b95ee7001af49ff0af68", "object_relation": "sha1", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782119050, "uuid": "db973ac4-605f-4535-b627-8eaa2bd651e1", "comment": "Malware payload", "value": "54cdc032b36ff280a5b266caa23b7299ba651e51e60435e289d79937d743c4cc354d394f94a433bd5880ea601312ea79", "object_relation": "sha3-384", "Tag": [ { "name": "py", "colour": "#E74BB9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782119050, "uuid": "21f76f3b-1f11-4711-add9-bee642b52db3", "value": "T127018306DD054384CADB70749CB83A10BB308AF7B6718247BB4AB1782998A9044E111A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782119050, "uuid": "ce542783-97fe-499a-b606-07833cad732c", "value": "12:QU5CoogpqI8W11BsRBtmrEa0gLwatTyhZHeoC4O5O67:QUDz8WD2mgmEatTyZfCT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782119050, "uuid": "4ec0aa23-2582-43ed-b106-ce77338ee449", "value": 706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782119050, "uuid": "3006acd0-9a10-45fd-b6ea-d30ca67095fd", "value": "application/x-bytecode.python", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782119050, "uuid": "39de72ee-90b9-4a52-9709-0055953c4e4e", "value": "5ecdf5efe2a74db93450f2b35e942b91ee6dd1b0f545c04810d2794b748b1dea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c465810-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782115304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115304, "uuid": "6ed8f808-385d-41b2-bf70-c8570fc40b58", "comment": "Malware payload", "value": "80421a43411dcd86cace0b7cd0f88ff9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115304, "uuid": "c80333d0-a882-49ae-960b-00e54d41feba", "comment": "Malware payload", "value": "5eeb5b2f3f1baa75a182f4e6e3eab5632e9d2afbba31f95af2cfd1962d695b69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115304, "uuid": "bfb93524-dc70-442b-8dbe-9a4ab17c4839", "comment": "Malware payload", "value": "1647d7a7b0225d993917976e70c36e3702c03912", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115304, "uuid": "268d8232-6708-4441-b61c-6aed9352f920", "comment": "Malware payload", "value": "d94a1c9c6bbb4b5d1b767f5a95d5e512f7ebb1740d5b846b8b1d3e89d686056fccc455b04ce36f25c5a63324ef6e3413", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115304, "uuid": "e95c4e72-e203-4be8-97fb-d07d3f783933", "value": "T164822C91E10B62B4C0EBC337675A521616FCBC062632663BABDC96714D93334FB182ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115304, "uuid": "78083c43-8e90-4b61-af99-decfd589ff5d", "value": "17a4bd9c95f2898add97f309fc6f9bcd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115304, "uuid": "bd17f275-2bb8-4e83-a616-ea757664ce18", "value": "384:CfINLG9eMSrpNXrTslx6kNRdrYvHE5mT:iIZpRr8dMvcm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115304, "uuid": "bda6eb7d-fca8-4e84-9261-02fe6867b45b", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115304, "uuid": "05b00ec9-ed7c-4cdd-aa63-f17ff51917ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115304, "uuid": "d05eb7e9-4225-4f76-aefd-7ce5b5203f5d", "value": "80421a43411dcd86cace0b7cd0f88ff9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27cd1459-6e0c-11f1-ae13-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1782113391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113391, "uuid": "fe076982-7557-49ad-83c2-40c2fa874133", "comment": "Malware payload (AsyncRAT)", "value": "a99bb6e07b5f1b469ecd1a75f16f8a40", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113391, "uuid": "897b8df4-a08d-42cb-8e2c-2af9bd1e1f8d", "comment": "Malware payload (AsyncRAT)", "value": "5f28fc0de30c2301ae8d82e8420df587a5bca6451bbaea053aa2ef48217b2081", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113391, "uuid": "346677d0-968a-407f-8a83-2a4586c1832f", "comment": "Malware payload (AsyncRAT)", "value": "2145d16a8e5920988be4007a4f1346ebc7ab98b6", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113391, "uuid": "92ce0b00-9ce1-4695-8dc7-97c3d5ec5db0", "comment": "Malware payload (AsyncRAT)", "value": "28511f304c41fdfc3ea046bd8328232efd32306ccc569a8ddd8d99e2b8de82474fa183b9ae27559363f680155c0c6f26", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113391, "uuid": "128e1021-9c2f-44f8-a372-c105da1ec4e2", "value": "T1BF172333B289613DE0AE6A311F72E1305A3B6E616C024D5992F40D5FFF6D1623E3B646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113391, "uuid": "dc05ed1c-0244-4f87-92aa-1ccac002f241", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113391, "uuid": "918f3497-b2ca-4117-970b-1dd97175cb8c", "value": "196608:UNhtxSRwmxu1S7hVZ9lxD+fW1cOWNHnAkB9oBMshIIhrsXqLpsr:Uj38w8uIdVZ9lt3TWNHA89CMsHrSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782113391, "uuid": "593abd5d-af47-4f22-b50c-1b46f94bbdc0", "value": 19790163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782113391, "uuid": "29db6f88-2552-40f6-aeb1-9f3668dfd48e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113391, "uuid": "c24d9b59-95f3-4789-9b92-19d11c944ff4", "value": "SecuriteInfo.com.FileRepMalware.21412187", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8350590-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1782141631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141631, "uuid": "5d8242e7-0a3f-45b9-beb8-2be32d6dd6a5", "comment": "Malware payload (PureLogsStealer)", "value": "43cdc7992d38c368cbf49a91fed6870c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141631, "uuid": "10406c3b-e061-464e-92e6-c73e1ff13131", "comment": "Malware payload (PureLogsStealer)", "value": "5f639000b51ef2dfc776bcea1795b9920d001c422fc406bca72a379f8ce152d7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141631, "uuid": "f41c2772-abc3-45b1-9cb1-04bc99995a05", "comment": "Malware payload (PureLogsStealer)", "value": "9186d1969f11767c5c2f46b80aec5edd2a90252e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141631, "uuid": "942dbd59-a483-4a5b-8ae0-f57f5f4f0116", "comment": "Malware payload (PureLogsStealer)", "value": "3c02a27603b83d7a17c020b71081a10b06fa5d20bb9cfb0682701831e41bc27b95176c040ec6b5a230ca2376f2bf63fe", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141631, "uuid": "e9a2d5aa-92e2-482e-a07e-066b5a1c3da3", "value": "T11D753D1FFA5FAB57F0F3E4767EC411528C8720A95EBB987964D3434880BAC21BD9190B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141631, "uuid": "708377f2-1759-4c81-b8d3-e5bec9c0815e", "value": "3072:ztGOmpGapJDoXXtdsmQz8uMGJwlnQ+gz03gizPknWNiJHQlNBdNYPBnjLE+EvVRH:SrviwwhYtQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141631, "uuid": "f4880cbd-937a-4345-b27f-d500336c3c6d", "value": 1612182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141631, "uuid": "7efc79b7-5844-4f49-9bd7-d80edf1af722", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141631, "uuid": "c9b9bacd-fa5b-430d-b3ff-6eb23de04178", "value": "Requisition_Confirmation_2026_Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b6fe617-6e52-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782143649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143649, "uuid": "b8a66ef2-9323-428c-bd3b-6ca9f8135199", "comment": "Malware payload", "value": "625eed465db82b5675967133b560be62", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143649, "uuid": "5b27066c-68b6-4ada-9590-7e4dc672777c", "comment": "Malware payload", "value": "601bec2832025448eccb8ec12e1ac32194799f7e233b75454fb6e918275a581d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143649, "uuid": "03e46c1c-6cee-47eb-b568-7fd14d56d776", "comment": "Malware payload", "value": "d063d4db644fddb8a0562b7c163b37cb00a8dafb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143649, "uuid": "4f7aa9ec-01eb-43f1-9df9-68a4036c8ce0", "comment": "Malware payload", "value": "9ab0e3697d6fb332128fd6764c9f5f224da64b6c5d5f491f50855c7c845910e43a4159c6732b338edbbf762c8f6942ad", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143649, "uuid": "f4f15c01-6f86-4292-93e8-40865c7051eb", "value": "T106F0E111148C55BBBA029D6F97860163C7CB60574C0637E571037498BA0BA7FE6D435A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143649, "uuid": "e29fc72d-fd3c-406e-8c79-b2f4b00d4b22", "value": "12:HvQwoghHwJRoidOQjUndmSRuj+KzLNt3YXAkgYwC+kwDCbctY:odg2ndOQgnd/Ru6KnIXVYC+NDOAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782143649, "uuid": "dff395e9-b481-4b08-8aca-a97f2130a2ab", "value": 591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782143649, "uuid": "5ee6958a-9db2-4303-b0f0-ce08a54ee698", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143649, "uuid": "bf77519b-d4b2-4ecf-9e18-5494c01f37e0", "value": "auto.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871b6a00-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782115269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115269, "uuid": "87fed93c-6ca4-4b71-8600-f98728db88be", "comment": "Malware payload (RemusStealer)", "value": "4f8186a34c9b0580111641749d875faa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115269, "uuid": "2746d5f5-b966-46c9-9b6d-8d5ae122d1d0", "comment": "Malware payload (RemusStealer)", "value": "61269eca1d774d5e3bc5fb9445de05bb7b0f9057876a9ef7779ecd5ca1582acc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115269, "uuid": "9fbedc9b-47bc-4cfd-a293-cbb7ad4de7d2", "comment": "Malware payload (RemusStealer)", "value": "594be30eb706112067443617d7690378c4113a37", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115269, "uuid": "1b861596-e551-4137-8774-a48ecf566a59", "comment": "Malware payload (RemusStealer)", "value": "063360ea95dfb98c43e51fbfe8fa1ea353e1d52b3ea1a91b86b89f8ad06c54da8e67c820a06bcc8ff622068ade32d078", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115269, "uuid": "dcc531cb-48b2-40a3-9ae2-597639a615bd", "value": "T13E264A47FCA109EAC09AA37189B392867B34BC491B3223D32E50B7782F767D09D75758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115269, "uuid": "f7273d0a-db09-4c98-ae1a-2345aa2783de", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115269, "uuid": "4bef1196-be49-4f13-af57-70e53df5d24f", "value": "24576:QiPddW5b/631vKLY8XfTtzF8be/3eGwG50D4SuS1KRfl2MG/uJvA2Bele5IK2ml6:QiPbQW3oLzPxWBGwgUT1Kdl9Y18tH8fN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115269, "uuid": "1b0a6bef-9ccc-496c-8055-7adaf81817aa", "value": 4695904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115269, "uuid": "a5c980c2-dde0-4826-9ecf-a7cb011d5356", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115269, "uuid": "23783517-55a5-464a-8f27-8e1ef0288a3a", "value": "4f8186a34c9b0580111641749d875faa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244c7f57-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141302, "uuid": "c55bb279-8224-4251-a331-0485a4bcef65", "comment": "Malware payload (RemcosRAT)", "value": "5e2b30ab494904b16a164c410f2783a3", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141302, "uuid": "92a751a2-88ab-4898-916c-9896f6c8aad4", "comment": "Malware payload (RemcosRAT)", "value": "61c857e42f076450574d7e708cf9ca8104c25ad32606317afdbaa33c1b49fb1e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141302, "uuid": "ddda0d64-8e50-45ba-a937-5c53d9e91da9", "comment": "Malware payload (RemcosRAT)", "value": "5893190dd59d88a9e214a3d39c652e83bfa8a702", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141302, "uuid": "84d3b993-c53d-4425-9f47-b57a314a0947", "comment": "Malware payload (RemcosRAT)", "value": "40e73798d49ca0affb74e013d744330c381e0f17332b6a7896b1fe0837528006345f9e638aa16617b757557afd092908", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141302, "uuid": "33068a2e-e499-474e-8ce9-3123b0e30d5f", "value": "T17094EA34ADEE902A7173AF758BD474A7F91FB663360E581A1093034A4613B41EDF263E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141302, "uuid": "3371c8f4-3da5-43f0-a340-dd55c3a6d1d0", "value": "12288:T9yqrtIhglZ4vBrp0TQAz42of6sYfNk6MVMu8ai3ISdm:fKD6jNy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141302, "uuid": "6f1bbf1e-edc5-4648-b8d2-01def39a2c83", "value": 447834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141302, "uuid": "d50fd872-03b5-4ac8-a73a-ce87ab45926f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141302, "uuid": "cb0a3407-7d21-4714-bca8-c985fcec1c7e", "value": "PO2606005221.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15176d4e-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141277, "uuid": "27818d07-b82e-48d4-860c-55a484325173", "comment": "Malware payload", "value": "e5ff1df3dd85935d83896680ccd8cfbc", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141277, "uuid": "b53d9533-ca81-4965-bc17-25d6f205d253", "comment": "Malware payload", "value": "6285809c3d7018d58b5ea74e3a48bec5456dc08e6212f3a6f94e11c9d19b8716", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141277, "uuid": "b6ac35f5-dcc4-4c4c-a8f7-261efbff6868", "comment": "Malware payload", "value": "0667c7c6030bf735008f2b32c45104b0e9ea3f4e", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141277, "uuid": "7351a11e-f61b-4055-9c0c-3b3d1c343845", "comment": "Malware payload", "value": "6b465996a7276911def6e948df720df30f08aec375177553ba24fc3a7f20669058650248542769d4a0899b602648b26e", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141277, "uuid": "28352337-5eb6-49dd-b000-b40e6bbd0be8", "value": "T156F5289117A0B2377721DBAD623AEE70980F605319D9CF14301EE318BA4DD4FA758AE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141277, "uuid": "116c5621-a491-40e2-b3cc-37dbb9b8fe8b", "value": "98304:XwjQyyO8iuKwS+pON5Q2fdccjS3OyxsOfB8Fudj8EwlDq7TdFNHamN:XwjQyz8Ot+8Q2Vc4S/xJxZ++7TdFNHau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141277, "uuid": "1fcd2393-e300-4368-b212-4e6c03027a68", "value": 3469217, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141277, "uuid": "c37428ea-2f62-4f17-9ee0-3433790cad72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141277, "uuid": "eb1f0271-09ec-4cf8-bd62-634160cd2ce1", "value": "Confirmaci\u00f3n de pago_6222026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31987c5-6e16-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782118027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782118027, "uuid": "733b2f24-ce1b-4fed-b9ce-d15217c6cca5", "comment": "Malware payload (RemcosRAT)", "value": "bed234640461f0df0e6bad0c5561880f", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782118027, "uuid": "39b2a7aa-b4f6-43d1-922f-5b7edebe4d7e", "comment": "Malware payload (RemcosRAT)", "value": "62f40f7903dbd37df23d07136fa0b87e6f08be9f7955fc4818b12622ddd35bb9", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782118027, "uuid": "9122eb47-7433-452a-830a-b2c284826f09", "comment": "Malware payload (RemcosRAT)", "value": "fb2649583d16c4ec5ef2edf76818f61332eedfa7", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782118027, "uuid": "2fd28ce2-421e-4896-ad53-ba6d398d1387", "comment": "Malware payload (RemcosRAT)", "value": "e9d02bf0b06f08e13e5541a955dde88878680642497a7338d241d04f2cb2b5959ba71888f81342dda8646f27332a6dd9", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782118027, "uuid": "00581518-147c-4720-bae7-ba0f7cc34dad", "value": "T167935B30DE5407A90F4B1BE9FC921A61C9BC961A053240F4FEE9170D540A9BCF7BEA6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782118027, "uuid": "9cf7102e-62a1-48ab-921a-1c52dd3424fc", "value": "1536:OkA7mh5qqnFOPqIlIJRBQkRpFjzqz5ArysZc7cr+hXaJUJHd:OH7mh5NOCN9dpFjzqz5dcc7a+hWUJHd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782118027, "uuid": "7c3de892-3857-49b1-bd05-5101fc1f6857", "value": 96996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782118027, "uuid": "86c1d822-885e-4c10-a8c8-854724b8f534", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782118027, "uuid": "79b319e5-d736-4a60-9c9f-d045784c1f05", "value": "Credibilities.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a63fc11-6de4-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782096403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096403, "uuid": "826daea0-e095-45ef-9ff2-d88a9a078f87", "comment": "Malware payload (Mirai)", "value": "cf1d682e438d6a4abf7750dae5e07739", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096403, "uuid": "e2e46d86-35e6-4522-af17-d1f27596f054", "comment": "Malware payload (Mirai)", "value": "639015f49fe00afa52244a61ddc8b32969ce8c884fc709281cb1f2938b447e4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096403, "uuid": "e711ed70-0d11-446b-a0e5-87336eb8f097", "comment": "Malware payload (Mirai)", "value": "28132b173a0b5cad81efc69bf6ec11eaaf0efe61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096403, "uuid": "e8872d28-f0e8-4cae-bbb9-f94c82d9c13e", "comment": "Malware payload (Mirai)", "value": "0835a728599e7cfb022a63416c1aabdb811904017426bcab22c5d129e001471def5f1b96a48a1c092aacb8557070c8dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096403, "uuid": "d8a5b7cc-41ba-4e0c-91bf-0fb4ed258750", "value": "T188533B99F4029E3DF88FE9BA84160E05B93023D212931B2767ABFDE37D331659D12E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096403, "uuid": "1b6445ff-f6e6-4736-8cd9-453be24fbdf0", "value": "768:me4gpsM204GEkRbjveXd/nQi122EQtBSv3gFHn1eu48B8vB6J7EzNfXQuJpozTy1:mo3EkRbDmoiz6IFn1X48B2SEzNfAuJL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782096403, "uuid": "fc4dd71e-cc02-4249-b910-5b89b3741562", "value": 65100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782096403, "uuid": "acbf6b5e-a1cb-470d-996f-c2ce6ded2283", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096403, "uuid": "39b03e60-8ed7-4952-815a-50b9838cb794", "value": "sora.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e29fccb-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141453, "uuid": "751f979b-4c53-4455-baf3-5fa3ac6df3b4", "comment": "Malware payload (AgentTesla)", "value": "d47a27a5665377adc5d50ece2b6c5ff4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141453, "uuid": "a0bc4069-d8d2-4dd6-8526-f29b2adf8aef", "comment": "Malware payload (AgentTesla)", "value": "63a6137794416354550a6b0b50c4e86e683bcd77d51e0b5b84bf9371468f2fab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141453, "uuid": "777ba1e8-c776-43d1-a9e2-cd171e96e7e3", "comment": "Malware payload (AgentTesla)", "value": "b8bc7d2a57a293b38e2604eb9abad2f2a0ee2252", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141453, "uuid": "2ca332aa-d057-444f-9e2b-3b962622598a", "comment": "Malware payload (AgentTesla)", "value": "1f2ea05b2be48b42387b9d302dc1b268c7338ec2208c428504e3ffba8b17c46e6bc393b596465ad93e401af8fd74e0ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141453, "uuid": "d766d103-d868-4650-878c-5b22c1711f9c", "value": "T102136813154D08072B15DBBC4EDCED500AED8B01A07697779FA27CEA836A735B2E6F06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141453, "uuid": "12906871-04bd-4632-98c0-43cdb2ce9abf", "value": "384:Yuz+u7ZP+ZlYBKKk0Sy0p8LziOxQjL+YU0b6JnnTTTzAZ6twLsaFvEv9JkavsOjM:TPiYtTy+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141453, "uuid": "228c5026-f5a8-405a-8403-986e2beb1a24", "value": 42869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141453, "uuid": "6579b4ad-fa8d-44e7-9d1d-778a50627ec6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141453, "uuid": "789ac4f6-5935-4a8c-acdd-a9707e5bc42d", "value": "doc_Ref0000001_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c983e0-6e5b-11f1-ae13-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782147608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782147608, "uuid": "b2d538b3-158e-403a-9a34-fb74b0d7031c", "comment": "Malware payload (NanoCore)", "value": "d96293c18b6651377c8e333a03b435f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782147608, "uuid": "f57a8202-b0b5-4580-8583-bcc80a91c63d", "comment": "Malware payload (NanoCore)", "value": "64884e1854751ea6e8971e8de277d184ed50072926a1dea1e4df4caa00541bfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782147608, "uuid": "32fd7670-a837-4015-94e5-02e4b200c384", "comment": "Malware payload (NanoCore)", "value": "335b52a00cb4b090e1bbed12e18b10fb09271981", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782147608, "uuid": "f8184612-d8c7-4440-ba9b-476eb3ecf714", "comment": "Malware payload (NanoCore)", "value": "13eab0d8aa7a2d7aae2581d9a930e1e401f01d5eaaacc56d1cbecdad33262af3c16e719ff4cf0f0c5fd96d06c6295f53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782147608, "uuid": "25a836e4-1da0-4f5e-a348-848791a1ebd9", "value": "T17B14CF2677A84A2FE2DE85B9611211534378C2E3ECC3F3EE18D855B39B663E50A071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782147608, "uuid": "41e2fd50-ff9d-442d-96c5-ea32f36e3f7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782147608, "uuid": "ede2f1b5-3b8e-4b3f-bf5f-df033bde6726", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI//svu1SEImfAF8V7m8CJvflRB:MLV6Bta6dtJmakIM5huvImfVqflRj0vi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782147608, "uuid": "9e1f05cc-2e20-4175-b08e-65053d4a0bbb", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782147608, "uuid": "09cdc53a-a959-44f6-928b-2dccd00faa78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782147608, "uuid": "0ccc762f-5c1e-4050-9acd-f0e28e0df329", "value": "monarchtoken.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb54c22-6e29-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782126072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782126072, "uuid": "a9334547-3543-4871-a090-44f4209e7e9c", "comment": "Malware payload (Mirai)", "value": "63dc0c9507eaad54b083e587eaddf5e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782126072, "uuid": "3033d3ea-c1b5-4394-8ab0-4770513e5521", "comment": "Malware payload (Mirai)", "value": "64b0ce58132f27a4d558f2d18bfe65afc2f827b99aeb1384233490422affed4d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782126072, "uuid": "98387925-4d12-4da7-b148-5b9df59d809e", "comment": "Malware payload (Mirai)", "value": "029ab20bb1811ed807c2e8ea8fdc4766220b766a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782126072, "uuid": "89139d7b-35ea-431e-8037-19ae3b83c4c2", "comment": "Malware payload (Mirai)", "value": "caa8363148278bd9390979c7bb7172110bda2323dace0d06f0f6258b876424612945483856160cfdd57e035601281b2f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782126072, "uuid": "999ab20f-bcdf-4e1f-b0a5-fecb16ff9e38", "value": "T19BC3E90B7E71BBACF768823457B74A709B9822D11BE1D280F1ACD7042E6434E645F7B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782126072, "uuid": "c44ba2c4-d115-4d8b-85a5-dafcd96a41c2", "value": "3072:EOb8zC1u/dYLSZg4RUbPGb0uM44sUZnkQm:EOb8zC1u/dYLSZg4REGbbM4QkQm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782126072, "uuid": "039d38e9-1524-4600-a2da-4fe795a3b183", "value": 122120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782126072, "uuid": "177a5fcc-70e9-48a4-bd67-78753a612d79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782126072, "uuid": "43c0e4ef-d947-4c3c-b3bb-96ec8034cab2", "value": "Se9I", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a45d925-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782141822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141822, "uuid": "d3bb3e1d-4e6e-4bc4-9305-76c7b0a9485e", "comment": "Malware payload (Formbook)", "value": "5ff472ffef4b625bd4454ec0ba85129d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141822, "uuid": "ea63eecb-6d4b-4572-b988-4e16173770fd", "comment": "Malware payload (Formbook)", "value": "651efc60866c39cc19a59f8478db1356fab41039fa1e509586181f269ca0660b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141822, "uuid": "2f84b952-497a-49cf-a255-269c13a3b4db", "comment": "Malware payload (Formbook)", "value": "af110ebc10430e04223006fb0476097fbc903512", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141822, "uuid": "29e15eda-5f94-40e8-a7d7-2b7608c9713b", "comment": "Malware payload (Formbook)", "value": "c077ffa1d06724e3d44b7f609925cab9f35aae3181c8bdf20af32982670da4cb386db1cf3e79deb825797ee9e1d4c658", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141822, "uuid": "23380816-bfcb-4076-8021-b701a2e27638", "value": "T1B295F1018AC42FE8CB9E5B2D50BF1549E3A00E8E6456658FE733FD46FFA760452072B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141822, "uuid": "579f1054-b45e-42f7-bfa3-16fe12f704d4", "value": "24576:V5uq1AKQZgiK2TH75RLJxoqlwlnoy/bxl86z4tuEbySQ2t4Amd1ZdtbPIdUfubtS:ff2KGlJW0hqxAGevcz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141822, "uuid": "dfc7ed7a-1b7c-4905-a0f0-5163ffe168ac", "value": 1983472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141822, "uuid": "b318a937-59b5-4cd4-9ae3-33380129132c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141822, "uuid": "b2bfcf02-71ba-4602-80d5-d9ffb1c8e662", "value": "doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43bebd37-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141784, "uuid": "a584d1f0-8450-4e93-b484-8503e867b8d9", "comment": "Malware payload (AgentTesla)", "value": "115a158516251b4a89b92263454c43fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141784, "uuid": "8e2bda22-3de9-4d39-bcc8-b23419dac607", "comment": "Malware payload (AgentTesla)", "value": "65b38711711172a1ed32dbada487d04915d6625fa6990acb4aca7c1d3fca8ddf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141784, "uuid": "8e8356d3-6e01-402f-9ab1-6676eefd98d7", "comment": "Malware payload (AgentTesla)", "value": "81524998769bc0d86293708fb6c7af5296ebf872", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141784, "uuid": "739b114a-220b-4cac-ba17-c2defabac801", "comment": "Malware payload (AgentTesla)", "value": "592ab507f2122dce68c232601a4fc084691c9eb9b45d1ff2676d2df8613776d10a50aa541765841f577d585212a91c1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141784, "uuid": "79ecad36-65cf-4e8b-9821-d2b28013a2d5", "value": "T1F2E27A01BE16BD4A0B91B5FF256F095D23584A85F0B816EFE07B82773EAE0EBF550841", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141784, "uuid": "2f8f03b8-49af-4c81-87e0-3b17356698fc", "value": "384:Fgd0vLozt/QZ8lIxAOCuJ/xy0tn0vMnaMK:FxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141784, "uuid": "fc0d8f44-62b9-43a7-bfe4-4cb07a8b326b", "value": 33512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141784, "uuid": "1c2b9ca0-5fd2-4bfc-9f9b-5fa765174047", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141784, "uuid": "24433b65-f569-40ae-9343-f0305b47cbaf", "value": "PDT5737083-HTCOSF0736.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a9f127-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782115313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115313, "uuid": "d77b0dcb-bffd-4510-9073-636394754f9a", "comment": "Malware payload (SilentNet)", "value": "9fda5127ffc0deb2cee86d7def78965b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115313, "uuid": "9f005239-cde7-453f-8a70-f4531f48a373", "comment": "Malware payload (SilentNet)", "value": "669d668e5fb3769d278e6ab8940d9efa67c06e35197e8af5b26165177f197b9f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115313, "uuid": "f08bb959-de93-413c-9df0-af95ef15f99a", "comment": "Malware payload (SilentNet)", "value": "85aacc440bf77dd3651271fcd446318210264178", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115313, "uuid": "d41b00c9-b422-4f8a-84ae-ecae114f2bbd", "comment": "Malware payload (SilentNet)", "value": "b31bffdab1e2a725d693a720fa2a048cb8e2979f26777b6860cbd9f8dd6636ee54db2d167b2d5142006bd74f96d32d41", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115313, "uuid": "e5042514-ca13-4df3-8c07-2bdd68f372ff", "value": "T1C8153355795BE88575CB0CFA2443CBFA6F985AACD291934BE9C17C004412AF2C1FECAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115313, "uuid": "9d44d528-ee10-430c-967c-52e74fd5abea", "value": "24576:6GJUVbhD/7W2pF2j0Z7aydMbkpraWj4a6M2O:6GJmzhpIkybkrj4RMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115313, "uuid": "8f6b9ac8-cf4b-49bb-821c-94f10a881197", "value": 943537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115313, "uuid": "2f736aff-91fa-45e0-b671-623f05f9f987", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115313, "uuid": "fd8ad463-a28c-4659-89fb-734bb3312541", "value": "glazed-1.21.4-n-16.1.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d63635d-6e89-11f1-ae13-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1782167033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167033, "uuid": "86519d39-a82f-41e1-baf3-ed2e6ad9f24f", "comment": "Malware payload (PureLogsStealer)", "value": "14b739a9ee44afb17b5d8625b006b075", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167033, "uuid": "5c5e2ddb-a739-4262-be5a-2fb552d77790", "comment": "Malware payload (PureLogsStealer)", "value": "67006c373b6d3eae743e96be45a7dd39cace6453948f454cc3a875a3802efe5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167033, "uuid": "acde5ca7-cb1d-4c5f-aa3d-0b37ba011319", "comment": "Malware payload (PureLogsStealer)", "value": "2680e92fec39941c1c1e9db520cc8a302004b51d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167033, "uuid": "6852b843-d0be-4d1c-9dfb-957904834f1a", "comment": "Malware payload (PureLogsStealer)", "value": "b7ff36ae507a6dd3be246c689c3e979f9efc8192ba3b0c7cf98b161d9776bc2c09e46566bd425e45c0c52c4db4ccf97f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167033, "uuid": "2ca8e68e-12d3-436b-b055-6fb67a5fb282", "value": "T1C1F4BE1B76528E21E2840632D1DB250697F165477637E70E7A8523CA2A033FBEE4B3D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167033, "uuid": "9f6eec45-0004-4c97-a8bf-a6d50813209a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167033, "uuid": "5f7212da-1f2d-4765-9002-4ed6425b0941", "value": "12288:D0SEq8jZRDsKO0lmSVAw1JQzy7GmDpQNQ6LZYzXdJYj33zR:DyRwT0tVAwme7Gm36LkdJYjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782167033, "uuid": "456d3fa6-a43c-4807-8d1d-c11f63a4b897", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782167033, "uuid": "3e4f7138-c265-4ef7-9c2e-989ad3465f98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167033, "uuid": "fa14b221-59fd-4718-b97a-d2c75cb69e94", "value": "SecuriteInfo.com.Heur.MSIL.Benin.5.82814985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7169c3f9-6e52-11f1-ae13-42010a9c0009", "comment": "Malware payload (Rekoobe)", "timestamp": 1782143579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143579, "uuid": "10fe27eb-3d97-4de9-b860-5fe7ce2cb6cf", "comment": "Malware payload (Rekoobe)", "value": "09afc145f15e23370ee3ad1bc5b9feb3", "object_relation": "md5", "Tag": [ { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143579, "uuid": "9e600003-2433-4fd7-b156-e8087238f179", "comment": "Malware payload (Rekoobe)", "value": "672fef6902b0e20024f0af11f62f7a13c14db045ac418e5fab6f7c9beaa44977", "object_relation": "sha256", "Tag": [ { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143579, "uuid": "5a852c4e-c528-4ced-86fa-007c7fb95b76", "comment": "Malware payload (Rekoobe)", "value": "eb64343e0e01fad08536cb57846d5641ace3b19a", "object_relation": "sha1", "Tag": [ { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143579, "uuid": "282491cd-3401-4991-ac22-47353ff06fd3", "comment": "Malware payload (Rekoobe)", "value": "38eb61cc7c0afdf491aea0b4127e97007a9a6c109f16f26272c4eeccf7b61fe53fbadc5c0feb692cbacf403122e6065d", "object_relation": "sha3-384", "Tag": [ { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143579, "uuid": "8ec27592-a01a-471c-baab-674c0e261d50", "value": "T199338E4765214E7FC88A22315FAF66217557BC38EF4A332776849390603EB27BE61371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143579, "uuid": "741f5423-a3ed-45cb-ac9b-6b7d154bb544", "value": "1536:VqzGiHNnsbnhhWNNuVV3CcMqHekyN/1H5xuM8:8CysbnhhWuP3CcMq+xN/1Zx2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782143579, "uuid": "6ee3d237-68e3-40b0-80c8-3237f03855ec", "value": 52312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782143579, "uuid": "6fb36ca9-65d9-4cd7-a61e-a3bb827f300f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143579, "uuid": "10c6dc9c-c168-4cc3-9785-fbf75a16003e", "value": "n", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e71cb47-6e49-11f1-ae13-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1782139735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139735, "uuid": "31c2cc02-74a4-4df6-a2c5-5fe864b2b3e8", "comment": "Malware payload (SalatStealer)", "value": "158b8af97dc35528e53d10e6ed9f6d62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139735, "uuid": "2b5a0ca7-3b7f-4dea-9ee6-45266539c0a4", "comment": "Malware payload (SalatStealer)", "value": "674295167707c56a258e7f8a55b34c12332793733ee86e23023af7fe099e16cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139735, "uuid": "f1daca32-7a3a-4716-a17b-4b41972daed3", "comment": "Malware payload (SalatStealer)", "value": "a837343932d5b5113189eced089c63b6c25aa246", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139735, "uuid": "a329a542-3ed8-4383-8ba3-62f933c1dc2f", "comment": "Malware payload (SalatStealer)", "value": "80ccbddcf734af508c89809f1cde2ecaf1322e356d73c1e9dd224abd9733e6f362974b3475b78f357e6c0ff8fd1c8763", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139735, "uuid": "aad47ded-5a62-4f81-a47a-71bf334f4839", "value": "T14B5633F78F395316F707C97066256394605273A749A30A360EC13BF9988A35E93E73E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139735, "uuid": "facb7a99-4d1d-4914-bbf3-7896e885a856", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139735, "uuid": "75f05347-c14b-4d33-9f02-26c8495ba43a", "value": "98304:m0jbQt04IOU4ouF9vTuDzR+r1xog3+wzP/5NG96hTtPWQGv5jpNrxZLa+f:mNtIOMe9bQzR+rkY+MPGmTtPhmtrf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782139735, "uuid": "b45ee009-114a-4376-8680-d0334adaf1f9", "value": 6103040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782139735, "uuid": "495fa413-184d-4fc8-a71d-a1192aa07450", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139735, "uuid": "c7293024-76f4-4466-9a2d-16e206d3af13", "value": "undetek-v10.34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf29af58-6e0f-11f1-ae13-42010a9c0009", "comment": "Malware payload (DocSaStealer)", "timestamp": 1782114933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114933, "uuid": "667358d6-72d1-40af-9c40-e7985c2fca0a", "comment": "Malware payload (DocSaStealer)", "value": "c76ecf8d8dc484a7cbfc0b43e286e97a", "object_relation": "md5", "Tag": [ { "name": "DocSaStealer", "colour": "#3749AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114933, "uuid": "a5f5977e-aa3e-40b0-9710-fd4b20614783", "comment": "Malware payload (DocSaStealer)", "value": "68b472722874374a6132ce1ec9470b14b7030030602d740fd5038d6560264c68", "object_relation": "sha256", "Tag": [ { "name": "DocSaStealer", "colour": "#3749AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114933, "uuid": "f63edea7-ba13-4e15-a69e-b4a6fdebec72", "comment": "Malware payload (DocSaStealer)", "value": "0ac00c9165c88cc409a8de6b0aca37a4f0256693", "object_relation": "sha1", "Tag": [ { "name": "DocSaStealer", "colour": "#3749AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114933, "uuid": "e10f5020-17e9-49d2-b99b-2438e66a8d51", "comment": "Malware payload (DocSaStealer)", "value": "76a41a265ad5a2c22a175490096bf1ac2549a6f1d3130e6828475e90a886a64b1d80620b879f80aff18a83ee4e6d768c", "object_relation": "sha3-384", "Tag": [ { "name": "DocSaStealer", "colour": "#3749AF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114933, "uuid": "e93e1a8e-e2cb-48db-8a7b-070f022c7309", "value": "T130F4AC437F40D946D4662E7189B5C7F8A331FC4C9A66834734E6AE2BBEE96C34D061C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114933, "uuid": "1ef691c5-b650-421a-bba1-58dbe0805d4b", "value": "393b9861b1c7f3216bf364a2b6e67d4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114933, "uuid": "6e4f8bad-3060-4c5b-828f-a43ce30cdaed", "value": "12288:Cmfxd5ujZaV+/TZM48HsweEaFD3uL+OZ3N1vQAb9PN:Cmfb5cZW+/FGnsDe5Z3NFQm9PN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782114933, "uuid": "0fc4abed-9cbd-49c0-9474-162048ef4e26", "value": 751528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782114933, "uuid": "269ed3af-f113-4845-b661-e034e31da45f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114933, "uuid": "0e944ce6-7feb-4da4-bad5-4bc1c7942fb0", "value": "Bonavol.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8718fa10-6e56-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782145333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145333, "uuid": "5bae8836-68e2-4164-aa47-5861a139f8b8", "comment": "Malware payload", "value": "0d8a27e404936aebafc01f102d91ae81", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145333, "uuid": "07c77db2-eba6-48be-a1b8-503dfe10e66b", "comment": "Malware payload", "value": "68c261db7c2cee9f68a7d455953912ed0b098298f8007036792b44b387560df9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145333, "uuid": "cd5091ce-f845-4608-9de2-190adc4f1682", "comment": "Malware payload", "value": "64617b34362758195206aa8a68680908cb47fe0e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145333, "uuid": "2183bd0a-bea9-45fa-8855-20ba3e367298", "comment": "Malware payload", "value": "dc4aa0e83286534246b5d5412f8c5caed6aa517718eeabb2119df3d2477c68cf76b4a5ea5aa0b0bc73aea22a0587dc1c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145333, "uuid": "361f4538-9b30-4315-bf96-3b187aabc62e", "value": "T107136D6526953C25AE99883B5D7F2F0CBDA983E1304491DDBFCA3CF18C15A9CE318719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145333, "uuid": "9faff92e-73e0-41dc-b529-c85ab367b472", "value": "768:sr9NyXsZztCe9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:qHusZWco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782145333, "uuid": "fd9bcd12-4cd3-453b-bc35-1418c924c8bb", "value": 45533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782145333, "uuid": "f5804899-90f6-4e82-8f41-d6b65780d281", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145333, "uuid": "f1394298-96cd-4f78-89a1-45621139726c", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33fbf68a-6dff-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782107828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782107828, "uuid": "b707ed33-8bbe-4705-9e17-869682eeb467", "comment": "Malware payload", "value": "169aadb5c48cb7109d047e8c680c4a56", "object_relation": "md5", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782107828, "uuid": "96e79b3e-ee69-49f6-9e9e-15ba8bcb6dad", "comment": "Malware payload", "value": "68e82279bff55cf3b9f1f22ec4a165b1b1245a359f7e8d86664b2541d8f8d3fe", "object_relation": "sha256", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782107828, "uuid": "30a92cae-bc7c-42f5-8c19-6ecc8e189698", "comment": "Malware payload", "value": "7da3c7b3795c2511acaa9ec85afc8365ae8ba73b", "object_relation": "sha1", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782107828, "uuid": "230d4f7d-bb9b-4db6-85cf-1be6587ca137", "comment": "Malware payload", "value": "707b018db42df17105da038f44b93fbeec08870ede672776964d9952fc652102d8573116c4a8ef47bdb38a160acb3138", "object_relation": "sha3-384", "Tag": [ { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782107828, "uuid": "20d7ffb9-88a2-49ac-8544-f0c047693caa", "value": "T13F34BEA79D838431E62608635F8CF9B1A5EEA3DC8572310505CD38D9CF8B2B7E135DA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782107828, "uuid": "4f89f6a8-8f3f-4556-bc9c-618b7a676be0", "value": "6144:6AcicicicicicgM1PfC3aupUaUUSy+LPboIKLDp7ortRiBXj1:6Acicicicicich1Pfqau5AZLPMIyt7oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782107828, "uuid": "178e1a77-8717-4f61-a32f-de288f7fd97e", "value": 252705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782107828, "uuid": "49fd48fc-0da0-4403-8805-0ba5b1d3ecaf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782107828, "uuid": "5f1ba117-6dde-435e-8bdd-e9d7ed03a1f2", "value": "QUOTATION#MV220636.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa491f2-6e89-11f1-ae13-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782167405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167405, "uuid": "6188a808-9a8b-4985-b8f4-16759e269c07", "comment": "Malware payload (NanoCore)", "value": "3d5d93c15aef85970fe374cd2c2ce97c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167405, "uuid": "7192dc24-b2db-4d9f-ba7b-0f92c8b02b8f", "comment": "Malware payload (NanoCore)", "value": "6920a822a55ba23f01bbd991875c21a6a7e4977bb4fd96f0b9b071e6be221d3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167405, "uuid": "0d2af9f8-9125-44a7-85e9-79eb1afa3d52", "comment": "Malware payload (NanoCore)", "value": "3ed43e46864876849ab8a75a3175f0bddfb91ff3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167405, "uuid": "bf147cba-fd0b-4e1c-9add-38713188ff8a", "comment": "Malware payload (NanoCore)", "value": "bb8ce6de8b70c27db1c538ebe1e7b3dac599f2bf81d5e0d83ef2db8e16aa379ccd6d9b77313723cd1798bc6bd7840627", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167405, "uuid": "11fc4cbd-07eb-4788-86b1-557fcaeec07c", "value": "T10314CF167BA9492FE29E867D611202138379C2E398C3F3EF28D464B78F667E506071D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167405, "uuid": "10a4455e-9486-472c-8f00-c9fd79781303", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167405, "uuid": "65947460-f3ff-4a16-86f4-f40f5102afa9", "value": "3072:MzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIgdC/Ma/FfqL4m1FYeRBtm23V:MLV6Bta6dtJmakIM5a/BFCh1FjM23V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782167405, "uuid": "c7d0963d-9ab8-4cbf-b465-b078131fbdb4", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782167405, "uuid": "07a8af86-82f3-4c0b-b283-78c9bf55d9db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167405, "uuid": "b8075318-ff07-46b2-bb89-ddee72539b0c", "value": "3d5d93c15aef85970fe374cd2c2ce97c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916c5bef-6e47-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782138908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138908, "uuid": "df0a70ee-eabd-4356-b7bc-55b490cef04f", "comment": "Malware payload (Mirai)", "value": "2e01679e7d06069f8beb9fc45d9b0f29", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138908, "uuid": "bb5e54ba-81ee-4cc1-8099-4735f3718698", "comment": "Malware payload (Mirai)", "value": "69e3b714d2a4fac4a6ba67c144a248714349c094d48fb40b2f11ddaff72ee27c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138908, "uuid": "17b88d59-7f39-4f23-b267-cf347fd90570", "comment": "Malware payload (Mirai)", "value": "0108269aa827355566bb80f76f3a62ccb6038c93", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138908, "uuid": "dfc99cce-4db7-4331-a300-3c46d467edac", "comment": "Malware payload (Mirai)", "value": "a12d79b784ba3c5e7c4497541d8b2a84301344225889fd0a19d9a43790c42163117872bc087c60669e66b5466f95c6dd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138908, "uuid": "6649f942-e536-440c-8aab-08a2bc5661d9", "value": "T1D5D36B23E635082BC1E494B321B36361E4F6036F14B9AA4FBD720E88FF159942167BF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138908, "uuid": "142d8c60-aae8-437a-919f-833c8910adc1", "value": "1536:b2S9MLRRNjWDlUtuWesyHTAB3AEHJhQ53klIuxR5c2rKHZfttJNm5CSlU8rktdQh:hwNyJMesyH0QQp9rI/JNOL5qUGFcBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782138908, "uuid": "df63eed8-0a99-49a2-8aa1-f08939fea3b5", "value": 138280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782138908, "uuid": "60de8fe3-0601-46d8-b323-5916af805c98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138908, "uuid": "12673627-0165-47d2-a4ab-d583be87b533", "value": "ohshit.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72e5148-6e4a-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782140260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140260, "uuid": "45092dc2-6785-4bab-a478-14a9c4939f05", "comment": "Malware payload", "value": "8c28702a17cddfe303b0b4fe03f2ca4d", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140260, "uuid": "a7221d99-83e0-4e7b-b3fb-128753c70a56", "comment": "Malware payload", "value": "69ff04f88458bf9f2f977687dcdc1006df399a3bd2262b95f36d809c6228c350", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140260, "uuid": "ea9f158c-41b6-46f5-b3e2-80f1cb019c6d", "comment": "Malware payload", "value": "bb67e18c86e72edb1366baf8259931082471e7c7", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140260, "uuid": "f95ef619-3ebf-4409-84d2-752b9824355c", "comment": "Malware payload", "value": "06323063b72555b01b77c392f2edbd6ed859fd692fd6f67da564dbcf612b89aa90edd88551467ba69a850d53b9d836bc", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140260, "uuid": "2ee8d3e5-a2bd-458c-aa5c-c4e4ab0be3ea", "value": "T169C4F141B1DADD46CA85427418A3532413F2AC3C4BB6EB17BE8C77FA6FF1A509D0A274", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140260, "uuid": "61467c2e-9f9c-456a-a8b1-609b7aa32caf", "value": "12288:L0p9dEZOXryL0m0nY24Q3/q84ZmP8JJlPp22Fxvyo4tj6p:gp9jXryFMYIPq8hgJRjP4Jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782140260, "uuid": "ded4ae4d-bd61-443b-ab35-3d7269acd2ac", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782140260, "uuid": "7d4b2743-3e64-49fe-9113-70c043a26b41", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140260, "uuid": "23af77b8-ebe5-447f-9568-fe0204c9f0a2", "value": "Rusko selo vodovod i grejanje.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a90adc5d-6e48-11f1-ae13-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1782139377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139377, "uuid": "660bee1f-eb35-4bf2-9503-83592827f68d", "comment": "Malware payload (XWorm)", "value": "d9e0461524386292212444734e44619e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139377, "uuid": "fa2ae17c-a8d0-419d-b6a2-9489057c163f", "comment": "Malware payload (XWorm)", "value": "6a0bf1dba11b61b4b53e78ccb483a7aea4ec3cfa81d2e7f9de55376c9fdef7ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139377, "uuid": "d741e032-9dfd-4e25-9f37-843108c548e3", "comment": "Malware payload (XWorm)", "value": "8b0954a8e13c1086945b93e9e967786e86bd0f2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139377, "uuid": "713793ad-675b-4abd-97d3-b73d84ec33cb", "comment": "Malware payload (XWorm)", "value": "249ce5466f24f730fc0528e82ed966d96356d64ae764d702a5f9488038c6a72acef38bc0d8eafa7ddb282dc678c6a72d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139377, "uuid": "36694c7c-c0a1-4e61-b7bc-3c011a53d8a1", "value": "T1497512AC3710F44FC9478A398670ED7496547DEA6307E20396D32EEF791E69ACE050E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139377, "uuid": "6ef4a376-a283-4a99-8f44-8ea2d83e3c60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139377, "uuid": "8b9daf0c-34d3-49e6-95ae-b6e857306cf3", "value": "24576:Ot9gBVBCY/PqmhhDRDVAS6EeI6beY7xgfTIq+NQr7HBBhyb:ESCAymhhDRVgdx7xgsT8k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782139377, "uuid": "f09d5251-4f41-44dc-94a3-0fad8ea893ad", "value": 1666560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782139377, "uuid": "bb82fe96-b501-4e25-a8fc-9e730922c524", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139377, "uuid": "f55a18cc-7601-4ea6-ad45-55aa59ca7875", "value": "d9e0461524386292212444734e44619e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad38ae19-6e4c-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782141102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141102, "uuid": "7b1b3d71-b4ae-4775-9f07-be76fe075a22", "comment": "Malware payload (Vidar)", "value": "71cb65bdb528dbde4338ae5db952d086", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141102, "uuid": "35822595-7539-4d60-8e20-6b4841cc2d5d", "comment": "Malware payload (Vidar)", "value": "6b1cddee856444740634d7fb9cce065955d4855a564b11a63e8d1b83516822c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141102, "uuid": "0ac7e526-1bd9-49a3-99f1-8bbc1637811f", "comment": "Malware payload (Vidar)", "value": "92a16c3982c8f6d0ac59d58362d6d44347384f4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141102, "uuid": "dec95f4c-442b-4637-8d15-1d4ce23a77b9", "comment": "Malware payload (Vidar)", "value": "ad7c7e9a4d8873209128b4bdcca0625de357eed735c28f3400d571891a9bd89113acd174975b396197840de898727f9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141102, "uuid": "5e1c6e7c-7815-4181-871a-5c05bee6cd1c", "value": "T1DEE57C07EC8208FAD4ADA2728DB64692B775BC051F3227D72E5073782FB66D06D74B18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141102, "uuid": "02fb5712-4bda-46d0-b70d-1b66bcae1518", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141102, "uuid": "39e39ad5-e397-4e26-89cf-2c2632d17df6", "value": "24576:Kd/PX6jI7r3MyUQGXJhkA8V98u/DXs562AKwgB/rc/ye3xOHMtBz0mwaSxhmQitj:Kd//60v3kQ+hScGs4vBOWA+8KKGz285V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141102, "uuid": "dfc9be14-46b5-4ab2-9783-cedb3673ba67", "value": 3289936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141102, "uuid": "e0f41dc9-fed9-44e2-bbdd-2e21eca04174", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141102, "uuid": "87105aad-fc99-40ac-a401-c0bbd3161194", "value": "Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7091261e-6e4c-11f1-ae13-42010a9c0009", "comment": "Malware payload (SiriusRAT)", "timestamp": 1782141001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141001, "uuid": "f68298b1-9c86-45a7-a8c2-146bb0978a3b", "comment": "Malware payload (SiriusRAT)", "value": "e3b0b549ad05e5f0214c646469b18b75", "object_relation": "md5", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141001, "uuid": "be36fca3-e2e9-4ce8-9bbe-1fa9639fea33", "comment": "Malware payload (SiriusRAT)", "value": "6c4d0cc51d3dfd00a01ef7504c993b475b5c081ee21b1f98be9e5404f35716e8", "object_relation": "sha256", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141001, "uuid": "0e016e77-9573-460c-a849-1199e68639e8", "comment": "Malware payload (SiriusRAT)", "value": "061822b8dfe34d2b2fe687a61031b42887bfccd7", "object_relation": "sha1", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141001, "uuid": "5c1e5d18-4fcd-4eef-a4e3-eb08205f8f1f", "comment": "Malware payload (SiriusRAT)", "value": "2cb031c5b27a3ad4088b8277468d74dc205d61a5102c5805369e3d3b04869d39821d42b65199d439839e556dff352e17", "object_relation": "sha3-384", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141001, "uuid": "a630eb75-26dd-414c-858d-46deaf987ff2", "value": "T1122423ADD60A757D508422F0B40187BAD476EFB9A47A00F2CBB1E0EC5EC95DD90E193B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141001, "uuid": "d97f702d-c3a8-4d20-bbe6-450155bfaf3a", "value": "6144:DmUN0Wp+Sh3+gFxy7EidjrC55L2UaNZvAnAbdGHM0:ik+gFxGprC5FuvAAp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141001, "uuid": "f344dc1c-5ab4-4077-86f5-4966b1160ddd", "value": 229256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141001, "uuid": "e13b21f8-c294-4a8a-abaf-5736fd256b0c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141001, "uuid": "800cd6e2-217c-4154-ae46-fb99e3a3bdb8", "value": "Bonifico Bancario.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460a8b7f-6e07-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782111294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111294, "uuid": "c4aa30eb-db65-402a-80b0-d608f156ecdc", "comment": "Malware payload (AgentTesla)", "value": "a0dffaba6f3cab810d6efd85a2d3726b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111294, "uuid": "3d634d2f-6d12-44a0-98da-e99bc6005d95", "comment": "Malware payload (AgentTesla)", "value": "6ceb1540bb2e1a52f1111c3372f96be6317861bcae788863072fe520a8b68c13", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111294, "uuid": "d36e24dc-a6fa-4ad2-8103-83d8b10b0970", "comment": "Malware payload (AgentTesla)", "value": "36f8342a42a6480a57b54e63d8ae362301fd11f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111294, "uuid": "2b3f3c70-7b70-4903-99fc-ad8b6932144a", "comment": "Malware payload (AgentTesla)", "value": "7505142e1afc018b1d2a521a9b51db736cab7ace82187864a883bc6becc8d9b1f2cae477474bfe6a3f56b9d4f5167c4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111294, "uuid": "6c9d87e5-da0b-4f73-9cfd-e8388d9ba387", "value": "T1DE340281F7908213DE62533318B96E719B761B2EA3D05A0763546E0839F33817DAF79B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111294, "uuid": "e7d10a96-6507-4a99-82c8-d5fecef26a74", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111294, "uuid": "a3ac55e5-5a87-42b9-8c79-7c857d38d981", "value": "6144:jfY+onP0DuezPrFyVEad8eKdv9THnufuqrwc:jfYguecViJrTHufd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782111294, "uuid": "9ec74638-6624-4eb5-9874-745bd3ec76b8", "value": 243560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782111294, "uuid": "6f64816f-0eeb-45fb-a2bb-3e3c764f210d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111294, "uuid": "4c457fb4-1e24-46da-8dec-56b1bda12030", "value": "Order959858868-699686767696.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6355ff26-6e07-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782111343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111343, "uuid": "b5a88044-4de5-4389-b152-a7c13b459e2d", "comment": "Malware payload (Vidar)", "value": "10c0804818712c05c2a972f6fd64f86f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111343, "uuid": "5b3f78f6-f7c5-4a5a-a5df-205c5b77ef02", "comment": "Malware payload (Vidar)", "value": "6d80382d125cb0253ef827c7da1054c30b1097511b4d538c15463a8ccab4772c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111343, "uuid": "8814ec24-d443-49bd-a8d7-966b2f24a82b", "comment": "Malware payload (Vidar)", "value": "5122a53d59c7d8199651b0eb541d93aed62b3080", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111343, "uuid": "9b7ef131-8e3e-4a09-83bd-a8a90f056b10", "comment": "Malware payload (Vidar)", "value": "a1afdf942cfd05cf2ec1a79a6e933752c416d6a7a77bffcdda0906c03b5a0b877b627795465579751fdf3d48cc10428e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111343, "uuid": "65d5e6c3-e716-4c8c-9ad0-97d360b21e31", "value": "T1FCF58C03EC921DEDC159A3708967969A7B39BC051B3223D33E90B3782E767D05EB6B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111343, "uuid": "c2bb23c6-3547-42b1-91fa-1127284e9782", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111343, "uuid": "67ee1149-2fe6-41fc-951c-545d7c6dd1c4", "value": "98304:RwjFwugHrphEclCLASdGqPmhJwklWUMuS3o:R4dgHrphEclCLASdGqPmhJwkAUMuS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782111343, "uuid": "fc87129b-933f-4746-a9ee-9322f833005e", "value": 3441528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782111343, "uuid": "26e34d18-3df1-4e15-aa38-ef284864b9b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111343, "uuid": "c784c17a-629f-4983-ab04-e8a863c03786", "value": "10c0804818712c05c2a972f6fd64f86f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efdab8a2-6e50-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782142932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142932, "uuid": "0ae76a2c-1efe-4372-89a4-f12b874c9e2a", "comment": "Malware payload", "value": "11a315fde958eb63b7b8524579f2da67", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142932, "uuid": "c14d084b-b69a-49fb-977f-89d10e23fedd", "comment": "Malware payload", "value": "6eac72c1d851b7f97ede15086771f332e2e652b71f44b77bab306e35376c4f85", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142932, "uuid": "6fc05ede-5bf4-480f-bf26-d99ab9b184e5", "comment": "Malware payload", "value": "0fdbd02419b23c89290f87ed89794108cb1a0671", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142932, "uuid": "c80314aa-a4d2-48a9-bfde-ed47c348e68b", "comment": "Malware payload", "value": "91cf5887bc1fdfcfc0547e1a7f260b64d808b12a55065401806f97e06fb2285a9d80dbc0b7e5d2c9db3201c3294620c2", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142932, "uuid": "831366e2-576a-4c92-85db-cfcc47675a8c", "value": "T15947338FD0B04A1BEC7F983989A95B6D8196EDD52F514C393301B39AC5F3BA0A87D017", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142932, "uuid": "f36f6ef3-31e2-4866-8012-98481bbe482b", "value": "786432:iX5wI/ovM+kAFdf714l2QrRLaUgTBZ68Bj3:/GovM+kyzSQQrYrTBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782142932, "uuid": "31b92c2f-f58f-4b8c-9d2e-b792dd679d1d", "value": 26562560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782142932, "uuid": "11c2e180-0f0f-4d92-b822-352ebaa8bb8f", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142932, "uuid": "3bd52209-90c2-4aab-8a7a-988482c28995", "value": "instaII.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32e135a6-6dd9-11f1-ae13-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782091505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782091505, "uuid": "c13ccc4a-7f78-442c-a6f8-0c415c712623", "comment": "Malware payload (NanoCore)", "value": "c02df52470306dd140e1e93f2e6abd01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782091505, "uuid": "fdd7ab0c-4e2b-4bbb-9fa7-b6f7b05a7d96", "comment": "Malware payload (NanoCore)", "value": "6f0219fb619845864f18d8dbe093e323fe6bd9a314e10c5affe9549024029b70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782091505, "uuid": "65fac339-8b61-4543-81e5-5a84ca973b8d", "comment": "Malware payload (NanoCore)", "value": "acfcec5f46e7213c0c4f939fdc181c3e117b97ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782091505, "uuid": "870ae1f0-7be7-43a0-9cc6-67936b09ffe2", "comment": "Malware payload (NanoCore)", "value": "5b5ecbd68f04b883d9af993e1e898310bc8a37c421b8dc758a0f8473e1a3425f8c8f3da661576e19f43a99b222510428", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782091505, "uuid": "e3219058-314b-4a62-bc98-1fe77dcedb61", "value": "T1F8C402467BA9892FE28F85B9601142570379C2E299D3F3EEACD814F25F162F10B1B1D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782091505, "uuid": "f94d2f3b-db6d-4e1a-b099-706e900b3699", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782091505, "uuid": "66ecd7e1-8c88-43b2-b31e-389e78baf5bc", "value": "12288:5LV6BtpmkuMQuET3qGbOQ1YiraHeW9IsJT346S:BApfFO6mOQ1Y0WT9I8TI7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782091505, "uuid": "435f8102-dcfa-41e2-b26d-d367d635e0a0", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782091505, "uuid": "3823fc53-02c9-4576-8740-ec6606d99d91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782091505, "uuid": "36601691-8383-45c4-aa7e-944c4ff8f277", "value": "skyupdragon.io.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6eed943-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782141951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141951, "uuid": "c4f2c258-371a-4be3-9bec-f2aaedc91690", "comment": "Malware payload (Formbook)", "value": "8e454af5c5b043f637de6c44c0f34957", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141951, "uuid": "12a39fcf-743c-4aa9-b8c5-25d4cf375528", "comment": "Malware payload (Formbook)", "value": "6f3cfd2058f91f144a3860fb0c4abcbc79292771db57f9b6bec66534ceeb1cf1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141951, "uuid": "4e7c4be3-f4e6-42a2-b71e-e89a7e6a410f", "comment": "Malware payload (Formbook)", "value": "00790b1da4f0b69fe240079b731d9c95fdd585f0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141951, "uuid": "ded7eac1-6aff-4a9c-8659-a01acc75b115", "comment": "Malware payload (Formbook)", "value": "8b1df633b6beb33d00e6994531e9c7bc5150ad5879f5ac286ad7173f88901aac224d3448ba6702b6ce381eba1c69490c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141951, "uuid": "addf8570-3836-415a-a2d4-bd8f1628ddd6", "value": "T15595F1015AC42FE48F9E5B2C50BF269AE3A00E8E6455754FE723FD86EFB760151072B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141951, "uuid": "366a2280-b5ef-46e2-918a-243aa5a7ad17", "value": "24576:VQa+XH4vmcryljb08B9PfRqLc++cCM9+V6U6tmoNa40e8UW1sqNwQArKd2K4spI:On8rylj5mJdUox941sqS4TA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141951, "uuid": "afef4e4f-4004-4761-a04c-ec4e357246b6", "value": 1990648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141951, "uuid": "940ea2db-bfa9-4874-a96f-5e46a392ebbd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141951, "uuid": "e019ecb7-69eb-4450-a4f8-831364edf39c", "value": "260621 1TO64XW790476015120 -Price Offer.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "949fec60-6e04-11f1-ae13-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782110137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782110137, "uuid": "697e536b-f945-4a0f-813f-f98ce490fc62", "comment": "Malware payload (Gafgyt)", "value": "72481abdf09b68e1e414fa8c6f923f86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782110137, "uuid": "2e5f0be2-1cec-4ed4-af7c-bf01108e3a8d", "comment": "Malware payload (Gafgyt)", "value": "6fc13dbd727a2823ad4df6d9e40b472fce8f1d5a6596f3a64f6255c7518d68ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782110137, "uuid": "b1763c28-ee56-4373-9d3b-9e410970de6b", "comment": "Malware payload (Gafgyt)", "value": "6a0d1ca08a720686f0c268e5ae894a1a7fd31b2f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782110137, "uuid": "7f9dc9ea-2945-4bd5-9dbb-cae9d6ef7b74", "comment": "Malware payload (Gafgyt)", "value": "18b13b7a1cc4a300b773a0cb2f410ffa01d604870996158fa7f2954914237d566e9c4db952c1e98c6c08afe0f6016ba3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782110137, "uuid": "163a804b-c782-417b-8495-7d577e534360", "value": "T160749523D8154595D1615CF322273389AD0B87BF89E732D3EE2A59A0BF2051F52BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782110137, "uuid": "d78f4583-85f3-4ca7-92dc-c13caee3bb68", "value": "6144:8+CltbZ5g9wjotExOL5my4PaQCCW6iGzNb:zCzbZqwjN2my4PanCW6iGzNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782110137, "uuid": "a7e89bbc-de50-4291-9960-83373846ee5b", "value": 356287, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782110137, "uuid": "2cc8d4f9-6831-4f61-bfbf-ae49c9231ede", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782110137, "uuid": "8d6b5d02-e3ed-4e92-80cc-dbf35f46adbc", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794d1296-6e1c-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782120399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120399, "uuid": "82b34176-410b-421e-822d-3f865a69190e", "comment": "Malware payload (RemcosRAT)", "value": "26847c115534833f25ee0118d303bc28", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120399, "uuid": "0326ec5d-abd3-4857-bcd4-d57a25d00767", "comment": "Malware payload (RemcosRAT)", "value": "6ff16b812dcb39404b71dbbeb517d28006303681189187b3db0f43c592c57a5d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120399, "uuid": "57cb2ca0-22d8-4c7e-960b-397b18551dd8", "comment": "Malware payload (RemcosRAT)", "value": "5880f5c8ec5a91588911911a9dd411d67224ae69", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120399, "uuid": "d4921762-1c73-4024-94aa-2ae0466e11e5", "comment": "Malware payload (RemcosRAT)", "value": "adf15ea3f73e20f9c608bb0ac8665493e6b9256995da7d3e4496163a0fb957442f15e8f455a381a69e9f677ed560c918", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782120399, "uuid": "c401678a-bac1-46ea-8dc1-b4631960aeb4", "value": "T161F6E49B80D38E07C672B5708F39C4725DB1F42E9996699CE24C629E494B8C0E4DBFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782120399, "uuid": "adfe60bc-ec4d-4933-a045-7f59c27638af", "value": "384:AlNxYXgl4UvV3pVNiWYTSwqSKkKT9AaFnat3Gtm6Hhe17U6/ny2RYGPwAdqhBIJw:2ks/8VU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782120399, "uuid": "6d868fcc-8437-4f23-b4c2-2e510921c371", "value": 15711672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782120399, "uuid": "fbb7a07f-20af-4588-a969-25444f7fb478", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782120399, "uuid": "a016ae53-77d4-438a-aa4f-6dc983cd0eea", "value": "FedEx_Custom_doc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f8762a0-6e0c-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782113457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113457, "uuid": "029a6006-7080-4488-b91c-5d4daa4a0b78", "comment": "Malware payload (Vidar)", "value": "6f7a3b6f41f48ee8cd250f8af2d1d026", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113457, "uuid": "0c7bd478-b6f2-4a25-9a23-d95000794df7", "comment": "Malware payload (Vidar)", "value": "7050c741d67e33357f81848ea9d886841db5974c2bf0f11fef69bd750d26d4a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113457, "uuid": "b1e5152b-9e00-4c66-be3c-d0a960d4e966", "comment": "Malware payload (Vidar)", "value": "534d09e62748282076dd418d3b8f7e55afa28bc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113457, "uuid": "ee4a806b-fb4d-4185-810a-ebc77728d04d", "comment": "Malware payload (Vidar)", "value": "c42215f908301f9f50d65356c60640f7ad80b4e015dfa3cebf4f77ca87f56c411a1c7002607857606f438d1849a0fa47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113457, "uuid": "c1f57b2f-e734-4f8b-943e-212676ceff52", "value": "T180B53228978BE5FAD19D4170225F4B6F76B181CE47A1820AC3668C6E3CC3FC46F61E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113457, "uuid": "d3af3d61-cfed-4213-a827-9e0155193b4a", "value": "49152:yk9xwqRmUoh6q1L+aIrt+l5cSjYk1bKvrnAB:ykYqneKavlyOYkAv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782113457, "uuid": "643b5839-2e4b-4970-981d-08ae05c5ec72", "value": 2430005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782113457, "uuid": "4c8718b6-9f95-42b4-a3d4-cf727cdc451b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113457, "uuid": "f301d1e4-3731-4cdf-ad21-9092ddc0128e", "value": "Launcher.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b081a1-6e79-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782160424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782160424, "uuid": "784990f2-ac8c-44f4-8db7-742a4ae6d06a", "comment": "Malware payload", "value": "0b79ff992990c9193b881ed75fc92e4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782160424, "uuid": "e1590038-3106-4fe0-9789-cfe58ef8598f", "comment": "Malware payload", "value": "70cb436ed48972a4ed04b1b2daf2fcfccacfcc4d0cb5e88930ad995685758474", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782160424, "uuid": "cd260e3a-d4b9-4ad7-9eb0-c267814625ea", "comment": "Malware payload", "value": "5e85a8fe3407513c501c44b3b9ab09a08428a8e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782160424, "uuid": "63925a7d-f390-48d7-be46-477b8cc62ce6", "comment": "Malware payload", "value": "aef39319f9a8f8147c853dcbb22a443506ef198e61b94eb4056a6fe0c88d1225c7aac0a52d9cc70af993d028d6fb9d14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782160424, "uuid": "2dcd4951-1a81-4cf6-8230-b107f79192dd", "value": "T19946BF1623D520A4C1B372758D537513BAB678295B31D5DB33C8875C3EB26838A3BB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782160424, "uuid": "863cae6b-ce67-48df-8789-2a8ec4d583ea", "value": "04fe167f13752284b9f68a4272834cf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782160424, "uuid": "7d0a18da-4b7d-4a53-91b8-2cd35262dc55", "value": "98304:OeX3ldF9wHr00YS/eRy0RWp4kHQGl/paY64ydJIAI63VLylEG:OeX3ldF9wHr00YS/eRy0RWp4kHQGl/pj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782160424, "uuid": "ac8c9ac6-a49f-48ab-a73e-800cde8375ba", "value": 5406232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782160424, "uuid": "20c439ee-0942-4071-8386-e858201efcc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782160424, "uuid": "a548343f-21db-4659-bdaf-1a87b42d6e32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73eb466f-6e4c-11f1-ae13-42010a9c0009", "comment": "Malware payload (SiriusRAT)", "timestamp": 1782141006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141006, "uuid": "bff98d4a-d06d-4c01-86b1-2af83dc41eb7", "comment": "Malware payload (SiriusRAT)", "value": "4c218c15755622abf91253982114da54", "object_relation": "md5", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141006, "uuid": "51b31c26-d5e9-4cd4-88fa-ec9162630458", "comment": "Malware payload (SiriusRAT)", "value": "7122d9c3a7cca9754cdab80ea7c79856234a735cf744262bbe28708150153a0a", "object_relation": "sha256", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141006, "uuid": "277bb7e8-91ef-4672-b3da-07e24e081a34", "comment": "Malware payload (SiriusRAT)", "value": "03f6e6b6e9eda69f83dffa9e66ed662c4a7d1b91", "object_relation": "sha1", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141006, "uuid": "a3ec3e22-05da-4e23-a6a6-79d311723c69", "comment": "Malware payload (SiriusRAT)", "value": "0aef4b0b339927faed3d76066868ee4c97552bfd4a97b4035bd1b83039d568222e8ca6b708c12e4300760be37b1c9d58", "object_relation": "sha3-384", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141006, "uuid": "2fad76ef-5027-4e4c-9eef-56dafb30d9a4", "value": "T1E365F418FCDF581AA251E8F147C1ACC2DDC9E8BB627DF93B11914A0F4062C91ED616FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141006, "uuid": "71a215fb-32bc-4eb0-9f2e-cf11e075dfef", "value": "3072:sQAlM6m95uoPKv3b5wCDBF4akaJ0HLTCSHHt4wWCzIxHUrwwIDFA8n7JkDWExOy5:n55uoPOTD0t3BldzIxuIDFgdxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141006, "uuid": "8394f8aa-bc04-4a3f-bdfe-ea0c241f4e48", "value": 1535120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141006, "uuid": "88781937-a633-4bc7-96ff-77692d5f6949", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141006, "uuid": "bb45c979-cff6-4961-aeaa-d13b1c7524c7", "value": "Bonifico Bancario.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267a39c3-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141306, "uuid": "1bcd13c6-684d-4ee1-9f04-82ce63ff9ec0", "comment": "Malware payload (RemcosRAT)", "value": "eb3cd9eea1799cb4ddee9cc5ba89f58c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141306, "uuid": "11cfd4cc-0540-47b0-ad4b-98df7173d88e", "comment": "Malware payload (RemcosRAT)", "value": "7123256ecff0daa41a49448c5fd399c35b02ea28bdf8f129c0ff4145a0a04a3c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141306, "uuid": "95ce0ff1-4a37-4bb8-94e7-3072dc811624", "comment": "Malware payload (RemcosRAT)", "value": "2a5da97c42e28d1ce6ac8556af7b54b56d27371c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141306, "uuid": "fdb834d5-7b74-4d27-9e53-e1bb5fa8dcd9", "comment": "Malware payload (RemcosRAT)", "value": "3e2951854ce6d60fbfe07391c4391d352dafeb0e3b3dbed3ebcc784b975181e676b0641242dc8d5e82464c3c06f72671", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141306, "uuid": "26e52c58-2728-4ba2-aff1-e41ebf028cb3", "value": "T19594E838A9EA502B71B3EE55CAD4F797E95FB663370E5819109303CA4613943EDC223E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141306, "uuid": "09f82d51-ece6-4cf5-8c53-fc957900927d", "value": "12288:9mfm9sh8u+OSJ8J8Cxh+VXQfAb70ZG9VFQDxXPyqhvwubfJ:cCQ8DTCZwuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141306, "uuid": "6d21bc78-4a2e-4187-81cf-1ebc552aa821", "value": 435460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141306, "uuid": "9c2a7fe5-ac44-47b0-9d27-c30d9d8156c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141306, "uuid": "38e5c3be-1b4e-40be-b51a-46bd7cd84c30", "value": "\u7535\u6c47 23,480.25 \u7f8e\u5143.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "773e408c-6e13-11f1-ae13-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1782116530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782116530, "uuid": "d076c10f-7141-4646-bcda-5c82f9c61a7c", "comment": "Malware payload (MassLogger)", "value": "d4bebcd0938e4803da14961a31b74258", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782116530, "uuid": "48344d3e-8579-4d0c-91eb-a90835d2a4ac", "comment": "Malware payload (MassLogger)", "value": "71829f75b01941def1951cd3aa880d0f5e779cebf6d5737d24fe3a93705a7d22", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782116530, "uuid": "f95e52b5-a3a4-4a38-beb0-12c3cc974364", "comment": "Malware payload (MassLogger)", "value": "932903521916e7d0d7ebaa2f716bd13f0b08f02d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782116530, "uuid": "392b064b-4963-4c4e-a397-897a255e00b4", "comment": "Malware payload (MassLogger)", "value": "c9b7befd5348e27e2b0c08d01835a39c7e3e4b8af5d7306ca9cf2dffb1489cb14c7a3ccdfb1f92687662f9594d7c6797", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782116530, "uuid": "103f4ff8-db39-4b4f-8def-4727e89e104f", "value": "T1EC756BB4B93EF22B543B5F026D51B006FAB91A4226196106606B3F0E5472E16FFC4B7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782116530, "uuid": "432c550b-6b3a-4096-8963-658cf33302d0", "value": "3072:4ApEaRBR4qUXPlpVo/ITC0dUd39Mxeu5KGQB3RN/jRMXnA6ShWlOGfMjKUVYVfQh:oNrQoNuMN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782116530, "uuid": "e1dec0f0-405f-42d7-b041-3c4ca156a658", "value": 1650428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782116530, "uuid": "7255fd9e-ae6d-4329-a4f4-1cfee909945f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782116530, "uuid": "1fa87fb0-c956-4bcb-aa4a-9e34c2dac599", "value": "INVOICE_PAYMENT_TT_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c8dcbac-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782141477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141477, "uuid": "f34ede05-f85d-4182-85d3-a2ba9102bcef", "comment": "Malware payload (Formbook)", "value": "c3805268c45dba7a70fe17083907f189", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141477, "uuid": "938e2f02-83c7-437b-9d90-7a6b03f6100e", "comment": "Malware payload (Formbook)", "value": "71d9a2e4e87f95f31c5042df8c3617efcf1530046d8be442898ef1771eb0d541", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141477, "uuid": "661ed685-da1f-4ada-9b94-f5712a7ae57c", "comment": "Malware payload (Formbook)", "value": "9501650bad444db3518741760cf668e8193babd2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141477, "uuid": "09b75c71-318e-4af4-befa-d25487a4e694", "comment": "Malware payload (Formbook)", "value": "d496d209dfb80a1665e85045e6bb5b69651511332c79bd7a71e1882f4cb08ea16945da8194a3efa977f877946708d9ac", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141477, "uuid": "6fb92859-80f5-4f8f-8a2f-9648ad16aa05", "value": "T11D73326E1ECA70C61F267DD9903D7FF645C633B9D5187856362C82DEE894032AB81E0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141477, "uuid": "3024b75e-cae1-4907-b8b6-4b9025a6fca0", "value": "384:jeFNC+H/9LObxwpAd6j8us3wXnUUvDv2Qnpq02+VCPwua3kl1EeJfsomgrqQuwWd:wc+5NzvDTv2QkwB3kU8lJRnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141477, "uuid": "a2a507ce-f9bf-4ec5-bceb-7bdd1236102e", "value": 73555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141477, "uuid": "4c5f665d-d66f-49f8-b24a-a3ee0bcde008", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141477, "uuid": "72d399cb-ed46-4900-9787-1496d24260a5", "value": "swift.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac0515c-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1782115355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115355, "uuid": "f926c0ca-2830-45d0-a93d-4c80b0873e82", "comment": "Malware payload (GuLoader)", "value": "09406d8c037ab49a52afe0e1d6d0eaf9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115355, "uuid": "40775ee2-332a-4da1-a961-3825cb049077", "comment": "Malware payload (GuLoader)", "value": "72e855025d02c02fa90b0ee9296d8a59a6c008dff1b70682b58474a8183836b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115355, "uuid": "932b1fb1-90b8-4d39-b0db-c8da25caa608", "comment": "Malware payload (GuLoader)", "value": "176cf51a8c84e358c1473b0b25ff7506a0a7e447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115355, "uuid": "8cc50af0-4ab7-45af-bca8-7f5ba961f246", "comment": "Malware payload (GuLoader)", "value": "9d1e2652f9782e0ca24b85f00e84f232070d644a7fa4571b8ac2ef048e2145636f16bd18e9a5ff03784cf50ae6fbb4f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115355, "uuid": "1301cc68-e71b-414b-b9f3-17b39e8345f9", "value": "T1BF05F11F66901757C9F6EE3181E2BB98AABB8D26275BC71347E0FF056D31EA80D801C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115355, "uuid": "494171e4-0640-45cb-bc0a-8892336c18a3", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115355, "uuid": "3d88d658-e604-4f8b-88ca-c8c03d9a329d", "value": "24576:jyWZSQzRvZyAzSa6XX/m2q2ohF5UgVrR7:ulEZzzdivm2xohF5xN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115355, "uuid": "f227cfed-4b7e-47cd-ad05-f0cec5167a5c", "value": 815041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115355, "uuid": "df9868c7-cc47-4909-8450-f80c4154a5a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115355, "uuid": "d083a733-9c24-4135-9abc-ae20ad0914f0", "value": "recibo4747.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5dab98e-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782115347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115347, "uuid": "5bfa4a82-e7b4-4741-ac4f-24c6b621cf2e", "comment": "Malware payload", "value": "fdb166bb4bb67394e1d5e9a4c4106627", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115347, "uuid": "a8c86bd2-83ad-4e78-a345-9ac0a28efd07", "comment": "Malware payload", "value": "7456734296ceae1d803a5afd093c316692b8f6d68a537cfaa72c61d4b193b755", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115347, "uuid": "b204f4d0-8ae0-4286-ae2c-00aaa131ca69", "comment": "Malware payload", "value": "35eb26557d6732ec6024ac86df9932ce33b95898", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115347, "uuid": "175f10d0-a69e-4766-be41-946eb390bbf6", "comment": "Malware payload", "value": "bfcfbb62a83479f9ab9b8adff565f41f36cb1692b23b385bcd37cca732e7889356a5d1bb3992558c7384d55c2fe25124", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115347, "uuid": "19a6eb08-f925-4ed8-804f-db37b654cb1c", "value": "T14C52FCC5B1D371BCC0A9C33DCA8F4163D6F5745B5A328ABF5ACC45942E82121AD7CAC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115347, "uuid": "68c71de0-6380-4193-a7fd-309d2aa1943f", "value": "17a4bd9c95f2898add97f309fc6f9bcd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115347, "uuid": "1aa8fc02-b0e8-4ab0-b088-8b01c03cee0f", "value": "384:9BV8XajZuCF3pKlQMcjDeDcB2RaM/LplE:hxbYlQVjDeDcUP/3E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115347, "uuid": "6e50ef04-94d7-4a7c-a781-f21c715a6841", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115347, "uuid": "6e1dce0b-9808-4ea9-8f30-1e059b74d095", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115347, "uuid": "4b62f186-507c-46f5-b0d4-0dc16d0290a9", "value": "fdb166bb4bb67394e1d5e9a4c4106627", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b35ea7-6dd0-11f1-ae13-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782087904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782087904, "uuid": "f8d470ab-d846-4a4a-8832-255480e35343", "comment": "Malware payload (NanoCore)", "value": "2f6a5ce3a14122f2cdfc94278106037e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782087904, "uuid": "02fe204a-0a1a-479e-a978-f870fbd3dce8", "comment": "Malware payload (NanoCore)", "value": "74bc14dbea1315b1d953c16382b3373233aa245b9b6ab5301a9f6943c0a67887", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782087904, "uuid": "ddfb63a5-fcb8-4c57-8f4f-eabf87fa2d09", "comment": "Malware payload (NanoCore)", "value": "ee62b5a594eb90a1a6e251ccdf8a93dbbfb4e577", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782087904, "uuid": "b1b30178-da3a-41cf-b264-dc553618d80b", "comment": "Malware payload (NanoCore)", "value": "e33d2d2788c57361b223ffd71670e936efdb7abda595190e40fe1034222024dca8c771b92df4cdaadb587374d0dd9fc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782087904, "uuid": "5a8829f7-603e-49bb-9636-c659ea152b70", "value": "T1D114CF5677A84A2FE2DE867D612212169379C2E39CC3F3DE28D455B78F267E00A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782087904, "uuid": "231b7274-6f9d-4c4d-9b56-f29001dbb124", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782087904, "uuid": "c9083f2e-d188-4e82-9658-679cf7152f42", "value": "6144:MLV6Bta6dtJmakIM5d6V2qhLyNPYTbEjr:MLV6BtpmkSM2uL4YTq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782087904, "uuid": "f930977b-e6a8-44a5-ac7a-a3dc16a689b6", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782087904, "uuid": "ff9b487f-684b-46ac-8b06-598c2848a8ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782087904, "uuid": "804be9c4-d3b9-4feb-8281-b1c75b232171", "value": "2f6a5ce3a14122f2cdfc94278106037e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "190e5242-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141283, "uuid": "6512b1ae-8c2c-4808-bc9e-1cf6666af827", "comment": "Malware payload", "value": "a84fcc8d89cdd8e373e930af4febb8d9", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141283, "uuid": "592ff960-9597-4eed-a463-f06a6627c8b7", "comment": "Malware payload", "value": "76f4040829c84eaf58b7cfc292b7d378ceab505e9bd78eb8ef8482e516885a23", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141283, "uuid": "bfc7f24c-09e5-491c-9a60-131a2fdc66be", "comment": "Malware payload", "value": "c46ed005287133d52616f6c563d57145c6051963", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141283, "uuid": "87902773-a5a0-48da-bb4e-d7b59943a399", "comment": "Malware payload", "value": "c19762c3d278dc8577fa5d3d2b919c3a3d02fbde989299fe006da170eb9e2024eb1442846116b1c2e110de82d553f637", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141283, "uuid": "a964808a-893e-42a4-8c04-91cadc5fac12", "value": "T11592F8278908AEF4086E32D2298B1C1B86111341B670790DF98ED89D3F7F751DBE29EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141283, "uuid": "d5a30094-d5f6-4b8b-816c-cc723b0f9a44", "value": "384:Ky7s9mpuBQW9Bi4nsBh1ZTchDv13lZcY59T7AK:KO7W9B0jTTczoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141283, "uuid": "3e6122f2-aa65-4c76-b904-6a97fe60fcf8", "value": 20089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141283, "uuid": "9f7cd1c1-ab9c-4c80-9df2-af019292dbd9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141283, "uuid": "fa7a24ba-9525-42c6-98b8-d14e147effdf", "value": "Doc_Ref0000002_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6676fbcc-6dcd-11f1-ae13-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782086437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782086437, "uuid": "fb91e00c-f17f-4b94-a6f3-3413456badd5", "comment": "Malware payload (Formbook)", "value": "171581b5985cc62267113330699b461f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782086437, "uuid": "54f9c239-1e48-4319-8b02-67af7c298fe9", "comment": "Malware payload (Formbook)", "value": "77276fd72e3394ab7daf64241538e56fe4e742d6e6d1c8649fdff48012a1e6e6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782086437, "uuid": "84abec40-e61c-489e-afc6-ac724ed94be1", "comment": "Malware payload (Formbook)", "value": "eb3673f84d050e05329499fbc6e762c3e663012a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782086437, "uuid": "13aa07f8-ca2c-4af8-83f8-52e70324d33b", "comment": "Malware payload (Formbook)", "value": "6637745bef158e409dac89a93334ffe01afb979dd18388ac762b15163b9baf3cf7d2794a317536d57da2b3e3599a6a5a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782086437, "uuid": "f309b4b8-b50e-4d0a-b894-602ea2129e25", "value": "T1C79501014AC42FE48BAD5B2D50BF255EE3E00E8E6855658FE733FD47EFA760052162B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782086437, "uuid": "e63b9394-a0a7-4bf5-87c0-fac358ebdd53", "value": "24576:VNUnT/XbmMgVgbt2xy7fffBrHQiCtWPVFO98zWbyYGA7qINVICG:XobH5eM3CG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782086437, "uuid": "009a7815-a7da-41c1-a45b-2847d9d5bc96", "value": 1995688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782086437, "uuid": "56bd3c4c-c53f-4f73-8d94-85fc15f44648", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782086437, "uuid": "082eee1c-dacb-4bd0-bf49-89cbcd2c37c0", "value": "HSBC_PAYMENT_ADVICEpdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c5483c-6e3b-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782133768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133768, "uuid": "314a7031-b8f2-4b42-9b65-28ca1e467fcf", "comment": "Malware payload (Mirai)", "value": "ea827c82bb74ddf41fd87d898950eab3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133768, "uuid": "4246214d-29ee-47cc-a100-5a13d4ea4518", "comment": "Malware payload (Mirai)", "value": "780fd4fa429659fde212bdd7048f205b966ef2ffc7fb253b2342ed22537bef28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133768, "uuid": "254ff29a-95ce-49a2-bd56-2d43bc001a1c", "comment": "Malware payload (Mirai)", "value": "96ea6493cd671123006cf4c79314286e21e52179", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133768, "uuid": "904852c2-fa67-4edd-a558-4fd9c809a041", "comment": "Malware payload (Mirai)", "value": "6a05d3d4d2e82bc14a275ff69745453378ff26e618548732f8d717850f446cc115539449d2acba7a317007174d085ba8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133768, "uuid": "987d2265-ea55-4990-a712-5b6d965ab76a", "value": "T1EAC2D030A19E4E8AFBBF2DF80978B51877F48A8D7794EC9034A197115204C27AA5ADE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133768, "uuid": "47caa606-d7b5-4b97-a1de-8a023b752476", "value": "768:y13X64OdfHKtAk7P83Z+/eN+dT4uVcqgw09E:yrO1qtJP0+NdT4u+qgw09E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782133768, "uuid": "bcf0e8df-a8ec-4d45-bdf5-80fcb9b41fef", "value": 27880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782133768, "uuid": "18af0c88-bf44-4105-bde7-9660fd7e6591", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133768, "uuid": "18e49839-5a56-4200-a88c-3e3d6badc33a", "value": "780fd4fa429659fde212bdd7048f205b966ef2ffc7fb253b2342ed22537bef28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eba2507-6e40-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782135924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782135924, "uuid": "f45f338e-521b-43fc-a12e-d9c3c7d930ce", "comment": "Malware payload (CoinMiner)", "value": "9fd222a83d7848f1aef9e43a885a89fd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782135924, "uuid": "f7dcb1a1-aad7-417f-95d4-e9038c268248", "comment": "Malware payload (CoinMiner)", "value": "789d88591e1400fad82e92ab9afcb8ee04b7671fa2ac19ae2fa70cbbf82757b3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782135924, "uuid": "83dd6146-339b-4d12-a8e3-5a7cd2e11d54", "comment": "Malware payload (CoinMiner)", "value": "8bb8fb2f001b434f5de5cc52f471c755eebadfeb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782135924, "uuid": "c39509db-3f8b-45be-a27b-bca655c7d547", "comment": "Malware payload (CoinMiner)", "value": "6b984996adcb7a56632b3802fa8c135e9d126dec91db093707c5b619cef8f7ebc51403c75c1912696bc8077fccff90e8", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782135924, "uuid": "1d2d4ec5-8780-40a3-ae7e-7ba6fcb03ec1", "value": "T10CF533949C0184F9C065C3B34BAACF6B663B749103135DDB1EC36D704B6BED59A38A8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782135924, "uuid": "a7f7a13d-4626-46ec-94e8-1cdeaf049583", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782135924, "uuid": "0c72a93d-66ed-451c-b50c-7718b2d1060f", "value": "98304:j8wE7Fop5ZFVA3deyKnnAxNXHzVOXIMLMEWQxCa1RlMnF:j8wEJqZzikyKnnATn/QxP1RlMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782135924, "uuid": "70b19cff-f1aa-4470-a102-5d710d2f8e5e", "value": 3446760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782135924, "uuid": "48897612-48fb-49a7-a71a-41cc89b00d2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782135924, "uuid": "e8099621-ec14-4158-896e-b19fdf017bde", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1286d557-6e0e-11f1-ae13-42010a9c0009", "comment": "Malware payload (ACRStealer)", "timestamp": 1782114214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114214, "uuid": "b4bf21cd-3c9e-4864-8ffc-49e2b494bbca", "comment": "Malware payload (ACRStealer)", "value": "86f56605a3b68ac76822ce362490191b", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114214, "uuid": "5959431a-15e8-473c-bf22-086aeb544a76", "comment": "Malware payload (ACRStealer)", "value": "796403c1803614afec320e7236d40334eac7f4b854dac23ca25dfe1a7d31a0cc", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114214, "uuid": "f31f608e-7f50-433f-a9c0-b58b27599924", "comment": "Malware payload (ACRStealer)", "value": "69835e23ccc4203098778e7af87d193be073e725", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114214, "uuid": "8042e3ff-cc2c-45a7-bce0-d58f882ffa20", "comment": "Malware payload (ACRStealer)", "value": "af498d133bc59067edcda0fb9931417625faa990d8f3378cf2f402b95defde32727a9133a68bedbba883e8ed31d57e23", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114214, "uuid": "fc8cf28e-e9bb-419a-806d-09f2b9a2d937", "value": "T16AF6DF42F7E60A56E9F78B70DCB7431A6731BC196A13CA5F1010A12D2EB3BD14E50B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114214, "uuid": "c6d85474-2fd4-4335-bda4-3f9c7b69f088", "value": "1a642b14be9fe0cd220cc41027df7334", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114214, "uuid": "ef4fb517-1c04-44cf-ab27-14b0da39a1db", "value": "196608:l+OZwnrgRTBDg1DQP4kdC/2N1nc1Ol6OL0cs8STR+oNKJokeadU1v+ORguA:ljyrWADQP4kdk2N1ncNU9sGoNKJQasG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782114214, "uuid": "01961f31-54fe-461f-9581-08cb670cf6a9", "value": 15768368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782114214, "uuid": "733d70e6-4b90-4ef3-b29c-f4a4db241799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114214, "uuid": "7c98b871-8aa1-4a9d-97c9-bb2be2eca084", "value": "SDL2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dab112d-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141318, "uuid": "5c2c2047-d552-451d-b62e-d189e1daa122", "comment": "Malware payload (RemcosRAT)", "value": "e25e21da6173cfd8e4a51f739bac4b95", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141318, "uuid": "5951a688-74d5-4849-af7b-15e0dd51d9d5", "comment": "Malware payload (RemcosRAT)", "value": "79ff59e011daa5c9e1a65e4bf76badefd96254312656ab1525e54a4816385199", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141318, "uuid": "885419c4-e7c2-457f-9747-12ef59eb8d68", "comment": "Malware payload (RemcosRAT)", "value": "e86bb2c91315a65bec64860c2393337e41c0ad56", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141318, "uuid": "dd51949e-4d5f-4413-aed6-26e6408cc112", "comment": "Malware payload (RemcosRAT)", "value": "2848880f033e93f4ecc0d32203d639c839f78d6af84bdcc414bbf2efd8a01fbbc49cd1d8afe9eb8de09615479d98574c", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141318, "uuid": "8d6adb82-f3a7-45c1-82be-9a77ade7b47d", "value": "T184934A30DAA4079A4E4B1BADFC911A51C9BCC619453350F5FEEA070D610A8FCE7BE66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141318, "uuid": "a8475ca7-0b88-4dff-a262-7c2efcc0b11f", "value": "1536:WNA7Gc5mxqnFOd+xlUrXBzqFZrNeUYoY/hZOQclAKhyJULZ5q:Wu7Gc5m0Os8FmZrN1Yo+TOQsAKEUL7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141318, "uuid": "53381ed5-4896-417c-ac4e-1cd1fa9bd766", "value": 92057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141318, "uuid": "62ae48c7-f5a6-4e0b-bd96-af9b1bf32e38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141318, "uuid": "8c4f80ce-4016-4748-8db2-bc6f57a92c61", "value": "PO062026.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75fe50c-6de7-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782097767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097767, "uuid": "bf68473e-b536-4d94-ae35-98800c6eccc8", "comment": "Malware payload", "value": "605b32f92cc2c144a56e8570ed2cad20", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097767, "uuid": "c45a2b10-6228-4159-a8aa-aaa24170f7ab", "comment": "Malware payload", "value": "7a14e4c99413fb0873b9497a7e2981335514434a9c1b922c9c48ce969be11c4c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097767, "uuid": "58b30764-ef90-42aa-ba9f-e9818f1b9146", "comment": "Malware payload", "value": "30650227421a0d68baaaf8d9811c05613ad9afdd", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097767, "uuid": "3df01ebd-a69e-4a42-8896-995466640d39", "comment": "Malware payload", "value": "40296988bfe647a02923d90e92d2adffa9bf08234389456223e95bd579a616f4f8cc8ff2d581cad32450bbb5e81ffa0c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097767, "uuid": "f7c5ec46-48c3-4b7a-9897-fe5c60647e36", "value": "T166D02EA310230230A0628827F2E69498B4854BBF8C0AC11EBA4320B11E40648F0803A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097767, "uuid": "49fb0e8e-894f-4304-9e49-51c77b62edf7", "value": "6:hTqsShxIn8Z+Unx0bAulNXYq9DG+NjVsNXYrkJ:VIhCUxQPiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782097767, "uuid": "6b3eefb5-1157-4311-812a-bab748b97e09", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782097767, "uuid": "6ca30765-c06c-41d5-a799-f48f88413af9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097767, "uuid": "7e2d984f-e7a6-49d3-91aa-0401ed06da6a", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6121034-6dd3-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782089148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782089148, "uuid": "99150763-74e1-4bef-ba02-75f50392b648", "comment": "Malware payload", "value": "4b91737bc193f862bd2e1e11b5716e13", "object_relation": "md5", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782089148, "uuid": "c38cbf43-2b99-4094-b024-3f8ab1d6d365", "comment": "Malware payload", "value": "7a913722f58debf79258bce36700ee2628f866c81e80bfeb8e1d86a8c42a3a51", "object_relation": "sha256", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782089148, "uuid": "607632c0-e867-45f2-98fd-26e45eb31e93", "comment": "Malware payload", "value": "6832d096ab47bbdd3f1c001930cf536afe2018fc", "object_relation": "sha1", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782089148, "uuid": "c47450fd-ca3b-4028-8dcc-98f632095920", "comment": "Malware payload", "value": "923f9ea0e48fc5ba27e1cec64b8fcf67ed26ae8a875f0426ad7b3ebd9d6a4a47af4062cafeb1d03dd1e979cbe9efe493", "object_relation": "sha3-384", "Tag": [ { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782089148, "uuid": "632e5f12-e859-40ff-a96f-6c706793f82c", "value": "T10EB44B376E296D84DF950FFF8122D5628DD8EAC7A0A5C0E5BC400941BEE97C4F968363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782089148, "uuid": "9155dfda-66b0-4a08-b907-070407fa22af", "value": "6144:8FIRhqO1ViVAj4Z4F7fa72/0O+IL4YCeWj1lPms/:8GBC9Z4la72MONcYAj1//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782089148, "uuid": "b02487d0-3a70-4945-904f-50b5104c51f2", "value": 533846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782089148, "uuid": "47f15a3b-c8b3-4da8-8439-59cc406faef1", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782089148, "uuid": "6a55e37d-ea60-4143-8412-cc678b76f0a8", "value": "MacOS.Setup.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "954992fa-6e55-11f1-ae13-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782144928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782144928, "uuid": "3a1a7e9f-c52f-46e6-a3c6-07a6760e8b6f", "comment": "Malware payload (WannaCry)", "value": "6735cd20825820a7065894676a056491", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782144928, "uuid": "babbdc12-4ef2-4853-80d4-c5d87178077b", "comment": "Malware payload (WannaCry)", "value": "7b55a11d09462a48b0e2c2875edf253827f304ad28eaeb1553c7633b86e87807", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782144928, "uuid": "e0b53c0b-1315-4237-ae80-3d7ccf714171", "comment": "Malware payload (WannaCry)", "value": "6f5272e60fc23e7d911bc651fbe8e58187a73d30", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782144928, "uuid": "bddd878b-c4f9-4dc0-ba43-24cfe6a83d75", "comment": "Malware payload (WannaCry)", "value": "3e7f4b400c51bfd0d3646e6e7df207a44f18b4cbf92b593270203a9197b35d067acd78404b5c70b5daa4bfade793dc57", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782144928, "uuid": "1680552e-a317-4562-87a2-d34583c90a5a", "value": "T19236BF1276E190B9C6630330AE6B76B6F7FDEAB21136D70B67980E093E71541E739342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782144928, "uuid": "8a7e8872-e9e7-430f-b334-2a1b48ad4f40", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782144928, "uuid": "1cb32de8-4e9d-4113-acfa-bc158b1b1f24", "value": "49152:jnXnsEMSPbcTa79jk6fuqqvozAPMVd0N6l6sWCTmArSsjtLaa5W:DXfPoW79jNfuqq5CdIg6/xyzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782144928, "uuid": "1f99081d-625b-49b9-bdb5-f72e3aa0482d", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782144928, "uuid": "ee06a4a3-7ecc-46f7-8563-606e99c000ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782144928, "uuid": "d05b9256-43df-4496-9b9d-00add2eba205", "value": "7b55a11d09462a48b0e2c2875edf253827f304ad28eaeb1553c7633b86e87807", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c504b9d-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141396, "uuid": "8676279a-17bf-4e08-88ad-8ddcffa5c075", "comment": "Malware payload (RemcosRAT)", "value": "c60523cae498e4325896acd5f0482dc7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141396, "uuid": "d91111ea-4b09-4249-9e7b-1da289f10dd2", "comment": "Malware payload (RemcosRAT)", "value": "7b92ba4332b2c6ad2faacb11be86e26c049cfb8258331fa4b92d06ae2edfd6a3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141396, "uuid": "c4bdf935-fad5-482c-9ac2-b221509feca2", "comment": "Malware payload (RemcosRAT)", "value": "ab44ef217e920401dadfa1ee7cb51c0ad1750bf0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141396, "uuid": "617a8d55-e209-4a29-a344-845dfef14710", "comment": "Malware payload (RemcosRAT)", "value": "2cd1d3b59b60f1f33a58be83cfbcd489b3e65e1a7654e4b924e47a5962ad331517e46dc9f121bcae23a5653a87c125cb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141396, "uuid": "694f74d8-f80b-4338-a008-23f2de12b50d", "value": "T14BE6F601D158AB8DBCB78E32DD11EE50094EB6D8A1FCEDA5010C72C53B7CD92A9B9973", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141396, "uuid": "815a5039-6b0a-4a1c-a39f-7e924169a907", "value": "1536:lTwq3qXEh4CI9ItaBR6fPCZAX8KMGtlANRIkioWPj68WzCkEayAz70SsLdafL8ct:++SF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141396, "uuid": "f28362b5-103d-45e3-aad0-f1e1681ee4d9", "value": 14942664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141396, "uuid": "1225f12e-5534-43cf-843d-1a3d17dde2cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141396, "uuid": "d8e7a527-1299-4c86-b01a-22490266e798", "value": "TELEX_CONFIRMATION_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "177750f7-6de2-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782095324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095324, "uuid": "8b06509c-3314-4f6c-b279-bf874f889214", "comment": "Malware payload", "value": "ec130731ffe1aa6f6f2367a5134715a3", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095324, "uuid": "43eabe34-4da9-4757-b301-6268f2f2ca7a", "comment": "Malware payload", "value": "7ba980da964f7c1e6e90364932cc8a4ea035d123dd4e2a8a61fb6a7df130e590", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095324, "uuid": "ff0aabe4-5415-47c4-870e-d7abf5a96819", "comment": "Malware payload", "value": "4b24cc93499dd93806afbf87fb11fb5fb8c49a0e", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095324, "uuid": "9f62bbec-f4eb-498e-82f1-8a11bd44df9d", "comment": "Malware payload", "value": "6bfc875dc03a87b73fcbde69163ac128203e36caad941a876064fdc102f589f0d2e4e3d18bd8eb0bc49cdd42c6ba1bf5", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "SmartLoader", "colour": "#8C1758", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095324, "uuid": "c8e17ffb-fc8f-49aa-991f-3686543d8669", "value": "T1EA86331DC1BE6514E39AC2B979EA042BB450DF0DDEFD63068BAE60054C8F4E76A03766", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095324, "uuid": "b5be667f-0406-49f0-a04c-a96afd5d4de2", "value": "196608:7z1eAk86TxuL+qkQhEeI5sAl52f2GW2/an7QvX:7wTxluhEJ5z42G7//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782095324, "uuid": "995d3e25-4c04-4674-af0b-3432ef14e8d3", "value": 7954177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782095324, "uuid": "6d9bd7c2-d467-4dff-b83c-8ccf16a62458", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095324, "uuid": "45f13c8f-3f66-4c81-87ac-2ed68bbd4004", "value": "Launcher.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23220c97-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1782141300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141300, "uuid": "8668118a-15e8-481f-989a-33594ace52ac", "comment": "Malware payload (XWorm)", "value": "e40c10a632578128f8cd3146aca022c5", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141300, "uuid": "d103b567-8ead-409b-9e71-bba620f64e61", "comment": "Malware payload (XWorm)", "value": "7c0579fd065cc4d26806798476d2a2e1dbae44eddae9f3cefd1e607ef17b1fb6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141300, "uuid": "b4513ecb-8966-4278-b861-4edd6997a2c8", "comment": "Malware payload (XWorm)", "value": "d706cc331a4fa00bc1e4dc499f340fdf8b25d6ba", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141300, "uuid": "1ccad25b-a61e-4295-8cc5-9fd1c33cd728", "comment": "Malware payload (XWorm)", "value": "77feeef61a86c7e73bc9ca2eadd1773dde18edb557c1f6fb5350db2d316a60fb0c4a8f76e3bbfadb9055ac010b3e603a", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141300, "uuid": "9d409e26-2985-4431-ad76-3e3a94c05c00", "value": "T16FA560CDDD0F34802CB5720DFBC32C65616669EE98B5886BE6714B4A88D1E3334A61FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141300, "uuid": "a501885e-9ba3-4b84-9d49-e6f27c7217af", "value": "192:3q+u9MZms8iCfyz+a7tF506ODW6andPLsFYbyA59BBBk:/ccP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141300, "uuid": "82cc8594-1e93-4c6b-bfc5-391bf1da7eca", "value": 2079937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141300, "uuid": "3c6a2837-7c5e-4c92-9270-f4f30648d4b0", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141300, "uuid": "b4f2621a-9a23-4910-97f8-f5090d2aa5e7", "value": "LPO_0039374.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4ce76e-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782115329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115329, "uuid": "b82a6d14-e2d0-4619-8393-3aeaf451892d", "comment": "Malware payload", "value": "d739642d43003cc5efa7257a7b2d6557", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115329, "uuid": "14f26dec-6fa9-4dd2-8611-88001b525972", "comment": "Malware payload", "value": "7d98c1d7fb1f38f9e6dded3e8a9143c78f3364b2e0f73764705599e6ba1d095f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115329, "uuid": "bb875227-498c-47e7-b8fd-6be03d45934f", "comment": "Malware payload", "value": "cd811f421c27eb4c961395b4494a0ed879024ba4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115329, "uuid": "10ca0a76-0585-44bb-9b36-b8c1447dec2b", "comment": "Malware payload", "value": "fa15979d3debcb6796f99a2e50bff0b3b36b35097cf257749069acf0bd015edef4052dd0b86b52d9b1fe2cb4743e700c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115329, "uuid": "08231d29-6459-4e2e-9ee9-2d997503b008", "value": "T125E733E59BC874D6E20DCB378535D518AC72B80E0B4748EF27D809563E6F2E93A7DA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115329, "uuid": "5bdab582-a4b4-4cca-a431-3c445c922cdc", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115329, "uuid": "3a6e328f-d443-4263-97c6-b6f50d692764", "value": "1572864:IgQWPVr6LrtO5SrjtAsIgqTcaNH21A/gE1oeOahi81ePNx:jdPJKrtOsHtAsg7lxrmeVlQFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115329, "uuid": "323b5ae6-f89f-4c8d-919b-bbd5ae7510c3", "value": 69290734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115329, "uuid": "a89345b1-43c1-415f-8fb2-76e0a2c089ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115329, "uuid": "c9b8508c-dc05-4976-9a10-9576c5e3098b", "value": "d739642d43003cc5efa7257a7b2d6557", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5a557d4-6e21-11f1-ae13-42010a9c0009", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1782122648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782122648, "uuid": "6b56d78d-8c53-4d23-970b-e24b631381f5", "comment": "Malware payload (Cobalt Strike)", "value": "82fa0aa7387d7173c9a9ebd1e8dcbb84", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782122648, "uuid": "2e62d5c9-f526-4642-a03e-20540e48f19b", "comment": "Malware payload (Cobalt Strike)", "value": "7e1435b42bd584c4edeaa1fc4055de16e99c5242e0a9d0e24b5a677e1c356563", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782122648, "uuid": "9b11503d-7bcf-4cb9-8299-302d55c4c525", "comment": "Malware payload (Cobalt Strike)", "value": "5d592bb2433bca01152fa99773bd785e631fea73", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782122648, "uuid": "1522a594-a326-4334-812c-8fd856db7f16", "comment": "Malware payload (Cobalt Strike)", "value": "02697f301b5deecd95419c28e31da78edb6a311ccd73ccbe1ea70c82a6c1adebd05ccc401264d1da16901d8587975103", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782122648, "uuid": "327fc297-07b8-4ac2-8f05-07ed320672c0", "value": "T148857D5B32A482E4E8BFD034C5566279EFF3B809236157CB16D55FAA6F232D42D3A310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782122648, "uuid": "083e6530-8450-4159-be07-fcc71169b1d4", "value": "fee89532d982ec4c4810fb82830c6918", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782122648, "uuid": "cad12e36-7555-4c44-be71-ce0db1039387", "value": "24576:wFLfAfgVNpNPsTQu2F96fdOg6aEb6jOJRaFR06hKi5RZpRrTQKXZ242gzk8lu:gegVNpNUTcGQl/JR006htrjIn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782122648, "uuid": "19ab19d8-af91-4369-a75d-df630afc6b04", "value": 1772544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782122648, "uuid": "455ee6f0-e9e5-4b17-8105-f3045725c450", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782122648, "uuid": "78c91d57-83be-483b-a591-5fdd2badf0a0", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598d392c-6e85-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782165443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165443, "uuid": "ef03ece6-6dba-48f6-9b69-1ace942aee03", "comment": "Malware payload (CoinMiner)", "value": "888a4026189eeac6cf412251e24c7cd1", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165443, "uuid": "531c6cc4-097e-44d1-9311-0805f22f5a46", "comment": "Malware payload (CoinMiner)", "value": "7e1e3dd418f70e0a973727bd106ed4bee047dd79a8d1c20004d37ceb477d5d6a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165443, "uuid": "65e405c8-83d8-4190-8544-9d6f4157e158", "comment": "Malware payload (CoinMiner)", "value": "f3edb0071ebc759c2c80d7acf4beb95dfe338c30", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165443, "uuid": "fcd8dc35-1a89-4387-beee-962c5f6f96fe", "comment": "Malware payload (CoinMiner)", "value": "c2db3bc7a6d46d7abcb56d808c7f80f265b05e95f69a1389ab9182e05defd22b46ee81d7656dfcf8288612c492fe19a0", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782165443, "uuid": "cbc70ebc-6155-4d8e-8f26-32460fcbdd9d", "value": "T1CEF5339865E24073D99384B0C0180F8B6E1B3566DB58D7F303CDD9583E6EAC15EAEF98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782165443, "uuid": "4c102f3a-3ead-4437-8ffa-febea169fff3", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782165443, "uuid": "716814ed-c3b6-4195-8495-49b8408169c6", "value": "49152:1WQQPo2H2Pt/v7kARmXjh8+11XaOMvJlyWSbSSD1DrWRJ57BJ9UF9:1WjP/WPt/vPoTh94Py/SKg57BJi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782165443, "uuid": "57a5b5c6-1ee6-4216-b696-0ae6f70eb894", "value": 3446248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782165443, "uuid": "dcb7d018-cd89-43ea-8349-4602f1991373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782165443, "uuid": "c11b04b4-9d82-4fc5-8e2c-500b70a0b859", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003995e8-6e50-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782142530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142530, "uuid": "3c6505af-d9a8-4921-bbc9-17d01fc87bb9", "comment": "Malware payload", "value": "565508e3e8190d4c4f197d96f061a380", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142530, "uuid": "70c305d6-efc6-4bba-be69-4ca3ebb7e596", "comment": "Malware payload", "value": "7f80b94a0161f315d2eaa7bd08f3d3fb6bb06afa740b1ae43cd90c0fd55fb23a", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142530, "uuid": "15c2cc5a-d239-4d38-81ab-e87bd3b822b1", "comment": "Malware payload", "value": "5a3b947db19cf624cdd2f8d46f6ff82e98d09d1e", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142530, "uuid": "d472d340-bb02-4a52-b31d-1d682422193c", "comment": "Malware payload", "value": "ce43ddaf77c79899ebef0db17e74d473ffec89733abdd000734e5beced7324655154c601e727fbd220d684e37ea7adc1", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142530, "uuid": "18231fb9-0445-443f-9b39-114114001d4d", "value": "T18565371BBCA505F6C4AA5332887661917AB1FC990F3223D72EA0B67C2F767E49D35304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142530, "uuid": "3095af39-ca7c-4ce5-8c09-0f6353f30d24", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142530, "uuid": "60d44a59-56b9-4a81-8f9d-42b5c53a7b69", "value": "24576:yPE3I6EYLikcXVY33IL7M6IT+6/NBele5yKD9eX5yU:ycZEYukcm3Y7MbW2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782142530, "uuid": "7299c2d9-ec20-4e44-b752-d46d614e438d", "value": 1533440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782142530, "uuid": "d911e60d-83b1-451e-a425-f29805083c59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142530, "uuid": "450a51e6-7002-4643-b229-9f25e298e216", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231f087f-6dd1-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782088043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782088043, "uuid": "7a6d8174-4be0-44e2-b8e7-845f870801af", "comment": "Malware payload", "value": "08ff492d3f19596a9b5b0fc308e88f88", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782088043, "uuid": "21b9ab20-3ccf-41f8-937d-31cb556fff59", "comment": "Malware payload", "value": "801e5217b0436f2531b40777da305d5017d6db19b545db051d82c9910f9d223d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782088043, "uuid": "cf6871af-87d1-4f65-a7ff-f7230dc8d1ff", "comment": "Malware payload", "value": "6cec4e201d3e58cc108be7f8f215508ccbddf331", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782088043, "uuid": "931e4b87-70d2-4e39-bdb1-38bc2f3d823e", "comment": "Malware payload", "value": "da7b28bbdf97ef3b5e1a9867c021b1dbc05eaeefbadd2524646847718c2e6021211b57eb36d5c4dfadcbad0f5419c272", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782088043, "uuid": "1319c9ee-5d98-4800-b0a4-08f08984d578", "value": "T1C2267D2271455DA9CD13CFBC7026CF85AE69ADF2BA420123A1F5D3A460EB39049DDF2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782088043, "uuid": "b3dedd9a-849b-4e15-af03-d3efda1dbc77", "value": "d9cdd14f1e51bf231e8fd705275c2c8a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782088043, "uuid": "b281e11c-2afe-4cc5-9bc8-3c0cb636914c", "value": "24576:dSE3hORgdNga3OcqyAiH0ydNAoGCBQlDobvGj7WAt:d3hORnfydWCjGjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782088043, "uuid": "1863a80b-f815-4cbe-b188-00b30c92405c", "value": 4480768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782088043, "uuid": "ee03eff5-f09c-4ed7-bd9c-b54f52eb0d5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782088043, "uuid": "2aa63103-70fa-47a8-a26e-fd8928c580e3", "value": "libcurl.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7114c17d-6e52-11f1-ae13-42010a9c0009", "comment": "Malware payload (Rekoobe)", "timestamp": 1782143578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143578, "uuid": "f928c92f-eac6-4af4-9572-f8b958982063", "comment": "Malware payload (Rekoobe)", "value": "e4cbd88781a5b2f898d83a543bc48ee2", "object_relation": "md5", "Tag": [ { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143578, "uuid": "e8ded9ca-01fc-4be7-b1a0-087b061a9ed3", "comment": "Malware payload (Rekoobe)", "value": "8068546fc20f0be3935f49dfcd0938b18ea2828427fd10902bd33ffd517ac5e3", "object_relation": "sha256", "Tag": [ { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143578, "uuid": "c4182b38-f785-444c-b2d0-fd56592e0381", "comment": "Malware payload (Rekoobe)", "value": "62d72d0a735bc898dc8978c47a19fbc4fc9eb7f4", "object_relation": "sha1", "Tag": [ { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143578, "uuid": "2fb4e5ae-5cf3-4f5e-89d1-66214c58882a", "comment": "Malware payload (Rekoobe)", "value": "f1eb945603a64752f359bc1bb969b525e78153aa31b91c0541fa6c53350a677fa25a1ac44d7b90243c1b3bcea8db2359", "object_relation": "sha3-384", "Tag": [ { "name": "Rekoobe", "colour": "#552D49", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143578, "uuid": "08970bdf-e1dc-4aa1-9f52-2b702fd16cef", "value": "T1A0338E4365214EBFC88922314FAF67217997BC28EF4A332776849750602EB37BE60371", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143578, "uuid": "c1b73b1f-06a9-4ce4-b092-1c9183b68900", "value": "1536:HGiHNnsbnhhWNNuVVHrDqHekyN/1H5xuM8N:mysbnhhWuPHrDq+xN/1Zx2N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782143578, "uuid": "49a30293-7e74-4ee6-91cb-1a1d3738c9d6", "value": 52264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782143578, "uuid": "f8499073-b7bc-429a-8a7b-4b6825162759", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143578, "uuid": "feec6dee-d32d-4b4a-bec3-72a5326ff944", "value": "d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a3be97-6e4a-11f1-ae13-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782140278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140278, "uuid": "3e71c31f-7875-401c-8adf-f2fb522a98af", "comment": "Malware payload (ConnectWise)", "value": "e4841bff2e9072bb045ef9f6d0643280", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140278, "uuid": "5e178aba-240f-4ce4-ab06-c99f0a181823", "comment": "Malware payload (ConnectWise)", "value": "80ea7456faf8688b78fe1b82d534bc6251c70cddb9ec076225adac334ad988ca", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140278, "uuid": "6371d470-0d6c-4fb4-b3c1-28bfef1523a8", "comment": "Malware payload (ConnectWise)", "value": "f1fd3ca4a4dccaeee98eeb6fc94f4eeba7d89f3f", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140278, "uuid": "c76c57b2-2f48-42bd-a8e7-6edaa9e2851d", "comment": "Malware payload (ConnectWise)", "value": "7bc0069d05139d0d6a6db1794186d45fe29a6fb905fb64c6aeca81c6387fa1ca74a1a2090af58fbc420df69f3268da66", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140278, "uuid": "d2257fed-4a94-422d-8383-90917b607323", "value": "T14846E002B3D695B6D4BF063CD87A42A96674BC044712C7BF57D4BD692D32BC08E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140278, "uuid": "1504bf3e-3141-4945-8243-990ee99f5f3b", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140278, "uuid": "e5a4a54a-4e83-4fdd-9d6e-7e8350379b6a", "value": "98304:Wzs6efPhFFNUhJFF3s+BoiGg1Gc977zbt:yfefPCFF3bBR1H9773", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782140278, "uuid": "cd0d4bd3-e25b-4ee9-a9d4-3cc9b97774cf", "value": 5628312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782140278, "uuid": "56136fa6-2bf8-4074-a0f2-441a2db52e4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140278, "uuid": "838f3c5f-b2e6-4850-8449-bba4ee802d48", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28358239-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141309, "uuid": "c4a1acea-d50f-49ea-a941-23a2f4675f54", "comment": "Malware payload (AgentTesla)", "value": "1f7634cdccc3168ed66561bd6f483c56", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141309, "uuid": "d391400a-01f8-458f-8257-4a6b658904b6", "comment": "Malware payload (AgentTesla)", "value": "81301f724ee7b7a4f96f182599608ac6cf954367f13d813656c1be637ce58934", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141309, "uuid": "22e3167f-b250-45b7-a2ce-6077d182cf57", "comment": "Malware payload (AgentTesla)", "value": "180c313395ccba0cc72f9049fb7d8383aba8ba31", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141309, "uuid": "20bca0ae-ae56-42af-abdf-14a782959777", "comment": "Malware payload (AgentTesla)", "value": "970906fb828d96a920a3dd7f744e29ac30c3a9bcd7258b155041175a271db2db0c71bc7eacc539bf4aa2f47693e872e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141309, "uuid": "38721581-a17c-43c7-8fee-89d7596796d4", "value": "T1302362B82604C5C35C92BB00D887EFE8E2683E237CF95689525447D68A2DD97FCE1DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141309, "uuid": "d2913f89-0d81-41cb-b24a-3ed968dde679", "value": "768:E4vA+25ve3VUDvCV97qfIY+b3B1JwlLezpG:E4vA+MvCVtqAY+b3B3wlLezY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141309, "uuid": "5e1eef5b-e976-4e3d-93ac-36eefe38c9f0", "value": 49277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141309, "uuid": "9089c893-9eab-433d-8993-632b54f59b15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141309, "uuid": "fc9d757c-73f7-4d57-b183-14feb7def70f", "value": "REQN_MF-E-26-019~028pdf.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfeee67-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1782115250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115250, "uuid": "8bb6387f-c4d3-4bc7-a009-18eebe088ce2", "comment": "Malware payload (LummaStealer)", "value": "0acfe0a8740e071874d3b0789ed5cd30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115250, "uuid": "16b09385-4062-4444-b01d-c0b3eb5827fd", "comment": "Malware payload (LummaStealer)", "value": "817ac7a4ee5b546a812b129c9b9cfbb4581988bd95ac3e2a32a83b82f1bf430c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115250, "uuid": "1e7a2e73-9fce-432d-82a4-7406ae99f23b", "comment": "Malware payload (LummaStealer)", "value": "5c06f652d16fd71136c9c1af45661989d03b7ed8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115250, "uuid": "4b0654f0-b7ca-40f3-ace3-8a30a6d7bfe8", "comment": "Malware payload (LummaStealer)", "value": "249e71d3b320d2d9c20a53c48359bb75acbe63b31cafb712c8f9c79a400d3ec792d6d26e2cfd78d1aa7e777b5a244b16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115250, "uuid": "0e70d151-3837-4c46-9dcb-56aa6d80c730", "value": "T191E57B00FDC718F6E503563248A7A2AF27399D060B36EB97EA413A39FC772D50936359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115250, "uuid": "209d9eee-81d7-4788-898a-470e3e999dfd", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115250, "uuid": "9dd261a2-7b75-4c86-ad1b-6c97dae02451", "value": "49152:2bYq7BB/lTMNkf4AOwH2tm7qji9wxkYibs/b1RcO:eR7BxlMkf4AOp/ji9eke/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115250, "uuid": "9fc981f5-0214-439c-92cf-127bcff28ae3", "value": 3088224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115250, "uuid": "517863fe-b010-4114-be46-b1dfb1b19b5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115250, "uuid": "1291f6b0-5808-44cf-9fc8-feacaa99718f", "value": "0acfe0a8740e071874d3b0789ed5cd30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f52ec56-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (SiriusRAT)", "timestamp": 1782141321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141321, "uuid": "529e7abc-82d3-4a83-9d74-72bf1a560c90", "comment": "Malware payload (SiriusRAT)", "value": "a65959f323391321beba89312391a706", "object_relation": "md5", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141321, "uuid": "e5606540-9838-4dbc-88fc-7c449476d3e3", "comment": "Malware payload (SiriusRAT)", "value": "8208dedd51639c570af2d9fc3388cfb3320505618700a843a0d6544bee88dac0", "object_relation": "sha256", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141321, "uuid": "856df650-e579-468c-8b2f-ced02791045f", "comment": "Malware payload (SiriusRAT)", "value": "8881557af5bdf3837483c10a730c8911e91abafa", "object_relation": "sha1", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141321, "uuid": "2275de73-60ae-415b-81ef-a3a896535e1a", "comment": "Malware payload (SiriusRAT)", "value": "c4d04695cc997efe8a7e3fa6139591553edbfb2dfad485d66d53a0834bd35eb3657c9cb1611eaebf5d687ed2172272bb", "object_relation": "sha3-384", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141321, "uuid": "231cf180-3f28-4422-b306-d43a7ea9af58", "value": "T1B47412066BD4D2B6F4BF1775BA714B7C9EB0F1E78626015B09F1A0E45B2EBD30089328", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141321, "uuid": "ea76a904-8b4b-4022-8e1d-849bc64cd318", "value": "3072:s9gFiwnPldDvCVROsFkjzEQkCNMmJvgfek:GmPl1+HWzEQkCN5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141321, "uuid": "3efd7a20-fa08-4a1b-9e1a-3672b15b8444", "value": 344064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141321, "uuid": "8139035f-97ec-4e98-a210-1bd998738f52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141321, "uuid": "2ca63cd6-c5d2-4069-b072-5fade17a0b79", "value": "8208dedd51639c570af2d9fc3388cfb3320505618700a843a0d6544bee88dac0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de600a84-6e0c-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782113697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113697, "uuid": "783ac2a6-b7a9-4e78-8781-ad872cb210ae", "comment": "Malware payload (Mirai)", "value": "c345743efa71d24d7aa8cde5dc83b4fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113697, "uuid": "f0f51bff-9821-4081-a821-903eb7312cd2", "comment": "Malware payload (Mirai)", "value": "825f035cc82208bdac48f1c8925ea5c37727c03a304eb7a5ea10287993a0174e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113697, "uuid": "767924f7-6da5-4192-86d1-e3054868c986", "comment": "Malware payload (Mirai)", "value": "7bfdf45565dcfc0b29e2899c2c2374b143dc021b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113697, "uuid": "488e80c2-2c51-41de-8604-434eb06e8a25", "comment": "Malware payload (Mirai)", "value": "d21a6e0fa1136e54fa4922f7077cc6fe94e9c147f88fb3d34aada53fe75a2ca5f31a893c28c924804499741aa24e9862", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113697, "uuid": "6387cd44-76e4-4104-9979-c4a82a2a3348", "value": "T160534C02B2180A5FF9D31AB0343F5FE187BFE9C025E0B689695ED7598635E332485E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113697, "uuid": "8109e768-4d99-4846-a656-8b855cf8e1b3", "value": "768:L9ETpVKRF4LoDfud18vSmqzQgdPfe0czC+N5XYizjrs+yRDQf/1qfgI6iSV:BET6Rq1gSmQ+LzDIiEbW/ogI9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782113697, "uuid": "9e94f1f4-1182-43cf-9180-bbb9f4b1346b", "value": 64240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782113697, "uuid": "c29b1aca-e51b-4490-886f-19f17ebd753e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113697, "uuid": "29c1049c-cd2f-4c73-ad23-e8574352b6f5", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31788b46-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141324, "uuid": "871f21ed-52f0-4fd0-85af-0c9cea7cd171", "comment": "Malware payload (RemcosRAT)", "value": "26245d4d82e7c24e2a583e4d438a9b45", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141324, "uuid": "7602dc16-dbb8-4588-b886-7d8e76b5d3f1", "comment": "Malware payload (RemcosRAT)", "value": "8261a1a695ed597f381712ca5e94ec2935f7b5f1324bbf8e8766fc4fac230b31", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141324, "uuid": "4cc0fab7-0964-4ea0-b805-a28ed813eaa4", "comment": "Malware payload (RemcosRAT)", "value": "4664e91cbfd214065394d75a277ba6b9c4d8c559", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141324, "uuid": "ed094049-1dca-4794-85c0-ff1122464201", "comment": "Malware payload (RemcosRAT)", "value": "228864eb7a2f7451190f755ce90f85552f546be983a025c337c844c56183c64a4d0a89e31de480d945f5fb09bb080d7e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141324, "uuid": "283b9554-9305-4ad7-9d27-dcde8d55960c", "value": "T16D934A30DE6406594E4B1BEDFC951A61CABCC61A013300F5FEEA170D540A9ACF7BE6AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141324, "uuid": "2283713b-409e-466b-83da-12e8600aaeb2", "value": "1536:VtA7O15mqnFO9tjUkFl2F7cLCbxcQXw1ym8vsReAZ0wc1YvDnJUReg9:VO7O15RO7d0hw0m8vs0I0w4Yv1UReg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141324, "uuid": "0d4cf8f3-de19-49b1-b5cb-be13fcf825d3", "value": 96490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141324, "uuid": "506c25cf-7647-4b5c-a376-2ea337d68d6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141324, "uuid": "c6b4c321-51dc-4a94-af1a-cb67dcd4c482", "value": "Payroll List_pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5618d3-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782115334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115334, "uuid": "81dc34af-fa6b-4b45-9fdb-32cb21511bba", "comment": "Malware payload", "value": "dc2b3799c0a6ac921eaa63911fcfb37c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115334, "uuid": "e650004e-2271-4832-b546-91ec467d16c0", "comment": "Malware payload", "value": "83e9683e8c6163b7b2207b5ff0dc5c00b780fcb44463d29780a06f5edb83cac8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115334, "uuid": "ac545652-875d-4ed4-af43-f783e290bbda", "comment": "Malware payload", "value": "2b9229cb6af473376ea7f2420da4191da4cc133c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115334, "uuid": "23de5581-6b08-490a-8a18-439ce2aa7a5f", "comment": "Malware payload", "value": "3f6b59dc73dfd366c9e0fd7016dcd434b5ae6324db3bfa2a66fd158b8a0a5c984e004197d3e378c34381cc264309d200", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115334, "uuid": "966a47bb-1b83-44f6-865d-36b07268b761", "value": "T1410833A5ABC4A4D7D7198733C136DA14AC62FC0D074788EF27A849563E6F2E839BDD10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115334, "uuid": "662808fe-d3c3-4510-beb0-416ac36700bc", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115334, "uuid": "a79f4dec-3b52-454f-bfb2-5d7939b753e7", "value": "1572864:N9zyznEWOQWPVr6LrtO5SrjtAsIgqTcaNH21A/QE5oeOwJ1crzZO0:N92znEWOdPJKrtOsHtAsg7lx76elKrzB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115334, "uuid": "44f00125-492a-4ba6-b9c0-8fa50d683104", "value": 80374297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115334, "uuid": "c1cde431-1ce4-45ea-a0be-422ab933115d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115334, "uuid": "e11cf6a1-b89e-4e95-9edd-ee78e18fd8a5", "value": "dc2b3799c0a6ac921eaa63911fcfb37c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a44d32-6de3-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782095959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095959, "uuid": "1c34d0b0-5b5a-494d-8d5d-15cd0f7e752d", "comment": "Malware payload (Mirai)", "value": "6c54dc573e8fdb22cc507602674636d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095959, "uuid": "f73391df-6e8c-4bb1-9ce7-f719e8c3ab76", "comment": "Malware payload (Mirai)", "value": "84a09f4fdf90abd5364f982b3d7d49aabf862a38bc78b66bf23014daaf19d8ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095959, "uuid": "e060ef59-9ebb-4504-bce6-90b4bd99d7e4", "comment": "Malware payload (Mirai)", "value": "dd3ddefdd068758e48d29a10d1ea2d88c150faeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095959, "uuid": "96625d7b-d4d1-4ddc-ac2c-42d12fee3c00", "comment": "Malware payload (Mirai)", "value": "5d7b8e7287f2156c8036b5a8f12b79ddcd0fe1d1a6175476349f200e0ab89b895c471c310b1d5fafc2fc12a3bf193280", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095959, "uuid": "eee194a2-13dc-4c13-8a42-b441f087e2f7", "value": "T1DBD2D1B86B1249D7CB6EA2B44EE50B272D708FA2E0426C076564D5D77B0A86C3CB6DC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095959, "uuid": "c8501f15-0329-4e55-ac4a-3b733c712b4c", "value": "768:U4ylAtv6pqLJM0RXaxGyUbXtheU/SA+iJgGlzDpbuR1Jc:HMBqTRXa+Zhr/fVJua", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782095959, "uuid": "4de11a13-fb70-420c-b736-73ae4b8f2f83", "value": 28876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782095959, "uuid": "b03a99b5-73dc-4318-8327-a4021b8e4f37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095959, "uuid": "ec37eac5-1414-4265-b6a0-5eb3806f2d37", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8d86196-6de3-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782096051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096051, "uuid": "5f362463-e1ef-4bad-9899-a147efccfabd", "comment": "Malware payload (Mirai)", "value": "74e71ccc947d89710a89e6055c25178f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096051, "uuid": "118a7f62-4b79-4fde-961b-d0671dc6f2b0", "comment": "Malware payload (Mirai)", "value": "84bf32c6c5852dcfe76cfe8ce6b40a4408603b3e52137a9562bfddbaddc760b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096051, "uuid": "7890abf7-ca14-4f88-8a71-bf143622bde4", "comment": "Malware payload (Mirai)", "value": "18dc5ac54947125482d8ee2e5fd89e11400715cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096051, "uuid": "4bcaeb60-f6f8-46f6-a03b-17a81c468f35", "comment": "Malware payload (Mirai)", "value": "a82bc9eac2d2a591894a3c13893e73d35f08b1bfe25238ace22148103b5fb1f919f336fc6e3ceb75df4a3a54e05099a1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096051, "uuid": "7605dcba-fdf7-4ad3-9e17-2bf8152f9fbd", "value": "T1E683C6297E218FBEF79D823947B78F22964837C637E1D581D15CDA005E7028E641BFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096051, "uuid": "c20a1b43-3899-4920-96d3-98b0aaecd7da", "value": "1536:E6/iw/0w8HoQ5uy8NxqlcJ0vXxh11xYqcn6BZOpkMoAfEG:x/8RHTgMcJ0fmqJZOpkM/8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782096051, "uuid": "c84c10d0-a984-427e-b4ed-c6bc21e642a0", "value": 85312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782096051, "uuid": "76eba152-757b-4492-8501-20482088f388", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096051, "uuid": "7a35c765-cd27-456f-900c-5022a2eb8f46", "value": "sora.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "646dd2ba-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141410, "uuid": "93de9053-0b10-4ca0-a89f-051646dec96f", "comment": "Malware payload (RemcosRAT)", "value": "1fec5fb4798383259eff3b3310697c04", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141410, "uuid": "9e6546f0-4126-4a4d-ab08-a09081729874", "comment": "Malware payload (RemcosRAT)", "value": "84e004cb51a9e3ad3cd6356d5bc8bc4ee65b0483f9be33a169d95f3fb4e48295", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141410, "uuid": "f6b53ec9-263d-4e6b-8634-44aaa11c9edf", "comment": "Malware payload (RemcosRAT)", "value": "e405bc0bd2936612218167af50f40aab72ba0d31", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141410, "uuid": "f5def02f-01fa-478f-93f4-ecb5fb3e974d", "comment": "Malware payload (RemcosRAT)", "value": "c1978b35f3197317ebd263240c13f2c24c96e1fc1abbf1081af56b4d4af64aea3452f7c3577c50b70b9d2c25b5ae7f59", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141410, "uuid": "827fc5a3-33ed-4905-8988-5039e210361a", "value": "T130F45C20DE34067A0F471B99FCA50B62CABDC609462650F5F6DA070E61069FCE3FE769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141410, "uuid": "79ad3de1-8a30-4082-bc84-06f22b65d79a", "value": "12288:rzvDARLIxAxgn9NUKURZ7tH9Y/yH8VI5ebArDPTMyKEo+sni2t:8RLPg9W7tH93k0ebAfbeEo+sp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141410, "uuid": "e4c3cd11-9fc1-432a-843c-aed8a3728704", "value": 761282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141410, "uuid": "fe437549-ef96-4dac-9cf9-cde8d9f02859", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141410, "uuid": "6b5f9969-72f1-462b-ab85-8e5bd5cd14fa", "value": "PI0023013311_document_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82a84b09-6e29-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782125998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782125998, "uuid": "1fb3dd01-0eb6-4414-977e-ee0cfa9c6b92", "comment": "Malware payload (Mirai)", "value": "32b38f669395c8540a57ba6f2f538da6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782125998, "uuid": "bc0fbd6a-2e51-425a-bb81-6372950b3b78", "comment": "Malware payload (Mirai)", "value": "85afd7d3fa19f2aa78aa04821d7966f28abcbf9ee088637828d0ebe6c459b709", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782125998, "uuid": "fc7c118f-4853-4ba5-82ba-fe6aefe93e49", "comment": "Malware payload (Mirai)", "value": "7a1a2d7b7e2d0695843cbb57238d9b3ab1a9729a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782125998, "uuid": "b266a275-6399-42a5-b592-baf258771962", "comment": "Malware payload (Mirai)", "value": "0beab71e1ce19bd7c66330c2c157183ea2932f3fa069f5eb4efeedb6d8fcdbe34f499e77fa53bb94b5524213cd4330bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782125998, "uuid": "82c277f2-e638-4b3c-b91e-aa726273dcea", "value": "T12A933A55B882AF96C6C74576FF1E438D331613ECD2EB3213FA14AF6D328B9560D2A061", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782125998, "uuid": "e50f338e-8f55-47e9-aa4d-e2e0f3e4c976", "value": "1536:3UD2kIVbKxd1+Z54qh3R0INMcec1gdV8lqOFp1SnrEvFQ9noiA1rRzvbk0QMvkJ1:3II58+gcB9NMZcabqRFp1SnrEvCM1r16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782125998, "uuid": "1155f160-9c3f-4e32-8fcd-c10af079b160", "value": 93052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782125998, "uuid": "d975232c-8153-477a-a9fe-2a2cf3c27cf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782125998, "uuid": "bc6dfb30-95b3-42b8-a892-8b96bc8fd213", "value": "N2sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a9c356-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782142006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142006, "uuid": "bc800b2a-e280-4fba-b81f-84f6719803dd", "comment": "Malware payload", "value": "5731af5a1af5ce58997d11ef34711599", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142006, "uuid": "101dcc2f-c0e9-4b5e-88fe-aa2aae089cd6", "comment": "Malware payload", "value": "85f6237e75c61bd190e9ced3b704c75719c7dc0f30ddfdc53a11eca27e4f9592", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142006, "uuid": "ae0f6e7b-43ed-4564-a4d5-a1c739dd31a4", "comment": "Malware payload", "value": "baf04449c381711a55ded110e4ca5f287c54e6ba", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142006, "uuid": "b8c24195-142c-4632-a143-09b59c9f424c", "comment": "Malware payload", "value": "3642792816d6fa6684ec7fb639feb36d0cc362127285fd2603bddc012504fae08a3a01406ebc1e4afee245179e9231c8", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142006, "uuid": "f10f5d3c-b18f-4166-8365-b8d958d4eac9", "value": "T11CB2687E843728FF61BC1E5ED19B4C3A6E40C8C8394166A1FD2E9D4ABF6A3D1C452D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142006, "uuid": "74b24139-a4a4-432e-935c-6fc8f1e77b82", "value": "384:F1hAlABZGXkimpJpyjD+Zm/JSvR820Q5S/pB:F+QcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782142006, "uuid": "4b1fc238-bd2e-4543-847b-804beabd6510", "value": 24837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782142006, "uuid": "3c043ca7-2b3d-427d-b085-c06dc96b1a2f", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142006, "uuid": "0d1d7c82-7efc-41a4-87b6-e6123993d71f", "value": "SAT1205226.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0944a9b6-6e48-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782139109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139109, "uuid": "72d694d2-cd7f-4244-bc21-9bd7b568bc90", "comment": "Malware payload (Vidar)", "value": "a604cd455d2e8c3d199753e13ed77d04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139109, "uuid": "762efa4f-b6fa-4004-9e16-b4d5026045d6", "comment": "Malware payload (Vidar)", "value": "85faf8edd9d7b2c78e1a8bddd0ead41b822adc0d4bb67bc1a5cda9a3e4ba9c5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139109, "uuid": "3e996294-d6fc-4364-9331-922fb814f132", "comment": "Malware payload (Vidar)", "value": "7bb76f4e92d6ba57bb57c0bb3d365aa934dedcb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139109, "uuid": "743a4426-1d96-4ac1-9d24-74f2aa271a9a", "comment": "Malware payload (Vidar)", "value": "fa3c8b38cfe5fefff11f23a5f8d97e94de9720eee825d1203228a36cc09c5b6f72415974ef407c3f2af687e4fc2465ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139109, "uuid": "c52bee07-8ba6-493e-8f54-26ce92fea5cb", "value": "T16FF57C06FDE609E9C49AA33188B7A6867B36BC045B3227D33E90B7782E367C05C75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139109, "uuid": "54e14c87-ab08-44c2-9db2-dfa8bba1d3e8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139109, "uuid": "7e919f58-8031-48b6-88de-3d6c9235e679", "value": "24576:IYzIRPv8ak3QGxNs8qaFtKKpmN2luQ9tgXgQ5Xp98yXcVnDEhwQr/a+89FhvA2BL:IYzAPEaTGFqqcSXx+uyXCYJQHYszdkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782139109, "uuid": "0f0be79e-35e4-49b6-ab41-f801e20b612b", "value": 3375448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782139109, "uuid": "2c3c1fd7-fb5b-4d28-bcf7-49430a8492db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139109, "uuid": "2f43de61-1241-445f-a044-c0e387b2fbe9", "value": "\u041d\u0441\u0430t\u0430lin\u0430\u042564-v.1.234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e11bae-6e5d-11f1-ae13-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782148205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782148205, "uuid": "b4ed9c6d-1930-4a02-b9e9-07fd9396bc5b", "comment": "Malware payload (NanoCore)", "value": "ccb63727589843ebfd9c49225cf200da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782148205, "uuid": "f84981ec-764c-4702-88a3-e592d9f7b053", "comment": "Malware payload (NanoCore)", "value": "865983b972f9f13e6f555a15aa1831e936e347691b6704fbec8a7c77296f4d98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782148205, "uuid": "52c6ac02-5d79-4245-bd3a-03e9f95f0f66", "comment": "Malware payload (NanoCore)", "value": "b992568a0849a8da56114ec6a21822ea7bdc75e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782148205, "uuid": "e5dc5b29-4811-4716-a51f-6ec5366c8823", "comment": "Malware payload (NanoCore)", "value": "0c84bd4082a936b4b753c63d1615be3e6cb2e4ba2cb6a0ccf3ffb834688f6557060047578f2de0133e53cc94e6cb70c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782148205, "uuid": "ed9ec488-aed7-49ef-9024-0d5da5a831e9", "value": "T18DC41295B7AC892ED28E857971120607D3B8C2D3E8D3F3DE28E455B64F062F90A871D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782148205, "uuid": "f4d6a977-7c2c-4696-acc3-bf55630de361", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782148205, "uuid": "04e344fb-884c-46c6-9c7b-32b64ea56f64", "value": "12288:pLV6BtpmkCIxz2QECR6t8Pv+IgCDqvfxir1iBpzAylmSoVXi8xGab:RApfCITE3zIHWvfEr1i3zCSoVXi8Fb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782148205, "uuid": "04885cd3-405b-47f6-935d-ae7bb3bbab1a", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782148205, "uuid": "246463b3-c464-4143-bf60-40d8b03b50a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782148205, "uuid": "2a14dca1-e8df-47e1-b934-226a2795bab7", "value": "nanocoreRAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdcf3ed7-6e71-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782157129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782157129, "uuid": "b87e0d8e-3f9f-4924-b399-17054ff5f5af", "comment": "Malware payload", "value": "39e04d46193216dad5acb1594da30180", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782157129, "uuid": "2780f5ef-bd0f-4663-9665-c02f92aa4d9a", "comment": "Malware payload", "value": "86c9eb820a1bf427903b3884c22ef74b738b2e085e4aac012a5b86613e444360", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782157129, "uuid": "5e6b34b2-0fef-4f5f-9990-be8c4f21d406", "comment": "Malware payload", "value": "c1b14dd5786dc2119721d637a5f2d4c82b7dbc9e", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782157129, "uuid": "9ca7a8c1-d882-4690-9d03-6385bf8d8fd9", "comment": "Malware payload", "value": "f65db365982c0afec5fd25e47e643703aa47ef484b7f5bfe408a29cdc492063f651554dda13e8d55da463b1677e74f10", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782157129, "uuid": "74072d10-14c4-4a5c-bd90-aca8049cd118", "value": "T1A9E57C0BFCE509FAC0AAA2318A3291967B61BC051F3513D72E90B7782F76BE05D78754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782157129, "uuid": "1e8832f3-0332-4de0-bcac-bd37901d48a2", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782157129, "uuid": "00f10e78-3988-4609-9a0d-a73a85845901", "value": "49152:DjygXpiZid+gOXwGJmUjcRKwziYdNNmv/UeOkC3pe:DjbamPKwzBPNmv/Mkd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782157129, "uuid": "bb3ad049-5ff8-457d-a9f2-18adc1830291", "value": 3053056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782157129, "uuid": "dfd9bf45-770a-4f7b-a6bf-103903daf92e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782157129, "uuid": "9a576623-dabe-4df9-a81a-126e00e3efc1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f5e404-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141661, "uuid": "510f89c2-9e8d-4d24-80c1-e9f6d37fad86", "comment": "Malware payload (RemcosRAT)", "value": "8d477b65ae7b18a9c371aa714f87aa71", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141661, "uuid": "35f123f8-c3ff-42b2-9ff8-7a616fcbc3c5", "comment": "Malware payload (RemcosRAT)", "value": "86cb4f8c718af7852cb61401a72a8821f8c40e62e719b09af55cdf4c3545502a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141661, "uuid": "407d7b63-7fc2-4384-bc31-5ac043a804cf", "comment": "Malware payload (RemcosRAT)", "value": "889f83a29921dd2f7d7a2d337ab447b84d466f61", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141661, "uuid": "457f3647-aaa4-40f7-851e-2876f6412df2", "comment": "Malware payload (RemcosRAT)", "value": "893e18b0c6424a6c6493f21acba47f13940c0ce6807e1715943155b80b0defc1015d70d665ce95ad182be125f4317642", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141661, "uuid": "c2aa8a8a-5fef-4a86-a255-f0a6626bc341", "value": "T179E6D1D30FD1260D7CFF35ACF63A082B4D16D4A2FF10419E48690AE68D79A893B79593", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141661, "uuid": "1ffb8b64-9627-4f2b-9080-42cd7e1c3271", "value": "384:0ORuvHpqa37YOyIGPR3lxqQOUak6D9L7JhwDljxNSv9/W/FIqK4688F7gCz4fSut:jvjXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141661, "uuid": "7722a77b-7c25-43ba-8475-d15a85d17623", "value": 15030082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141661, "uuid": "470ea087-b271-49a6-9e73-5e15949fa042", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141661, "uuid": "564b7162-f912-4d64-ae34-9c12a3d50c06", "value": "AWB_Documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95351344-6e86-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782165973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165973, "uuid": "21d2f610-2f9d-4e9d-b6e1-393516afc0cd", "comment": "Malware payload", "value": "f55fb6ce3a371000c727199ecd63d163", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165973, "uuid": "2188f66c-9c58-4f39-b28c-68a6da5b6e43", "comment": "Malware payload", "value": "871b154967875601596183c2338abe153fbf6df273a24526d85bc3ec42de1433", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165973, "uuid": "0f068261-4b4a-4077-9857-0d920eecbc1d", "comment": "Malware payload", "value": "30cb30a517ab162c8e32b1b2c01c917771b3eb3f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165973, "uuid": "132e4bd4-8ac8-4a94-9ff0-ac5ffc13c48c", "comment": "Malware payload", "value": "79fdbcb87f767a30899d81e78c857ea7faf0a13fc41ed0fd1f4dad6ce486b79f0376d9ac48e30997fdc344ad1c5949c4", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782165973, "uuid": "2704f034-e2e1-43fb-8c22-c9bdde81f86e", "value": "T165137D6566913C28AE9988371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782165973, "uuid": "a3574474-87d1-4205-92ad-394f8ae2dc6a", "value": "768:0XRWNGxVj9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:Ilxmco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782165973, "uuid": "31169590-3d77-4ecc-8499-8ff6fa4128b6", "value": 45521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782165973, "uuid": "aed892a1-2904-4930-a548-bf80aa4199e2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782165973, "uuid": "2fc2b627-1d12-40a1-9167-b7a921cd82a1", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be523849-6e41-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782136407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782136407, "uuid": "80b1248a-df0f-4ca7-ba61-0f38e2cfe0b3", "comment": "Malware payload", "value": "3524085343339795ce69fa1d9ab43a8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782136407, "uuid": "0529e61c-bdcb-4933-858a-f7e8037327b2", "comment": "Malware payload", "value": "87dcdb8b509e89b59a75ed560d5ca383bc69f062bd75552cc9b247879ef0cf03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782136407, "uuid": "2ac89fe5-99a7-456e-b094-8d2cc2b9cc0c", "comment": "Malware payload", "value": "abdf925b1777c52000fd783101a0cd09e96d90b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782136407, "uuid": "cf95a764-ad1c-4a81-89e8-46b4e1686673", "comment": "Malware payload", "value": "d703658ee1ca037997642629f5cabfde3265d7344963417c76d1d38a3df5fbacae2ed89e73ef7b2a990414c22039bb1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "VMProtect", "colour": "#7E050F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782136407, "uuid": "37d0bad7-e09e-4268-ac78-f9b80e900553", "value": "T1E625AC427F41E816C5566E768AA8D7F46331FC4D8A52935330D3EE2BBDEE6C34D06288", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782136407, "uuid": "592214c3-06b5-472f-9567-cffecdec27c3", "value": "a4fef10c0ecfba33222e8f791dd1074c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782136407, "uuid": "f0ee16ff-7eec-4614-a500-793579dfe159", "value": "24576:0me9NtM/wcwjwEoLbfkDGXchH38S1JSz0lAGJ:0FeYcw8EoMMcV3rOz0Ow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782136407, "uuid": "bf5a97a9-78d5-4f26-ac98-6a977c50c948", "value": 1002832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782136407, "uuid": "651f5bb3-07c3-4777-a226-32f724123e7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782136407, "uuid": "5e71b76e-f846-4256-b0af-a7a1d012c63f", "value": "Phantom Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14244d71-6e45-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782137839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137839, "uuid": "14e309ce-812e-4b6d-8710-a1c2f9739e95", "comment": "Malware payload (Mirai)", "value": "c3406825be3171f85be5992c232114e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137839, "uuid": "dd149ad2-b686-4836-baa5-52e36c2dd256", "comment": "Malware payload (Mirai)", "value": "88d028a54a136782982817d1d93c89b075b7f04897b0c0681311add7c8712eb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137839, "uuid": "50a8642e-f3cc-4895-85f6-797fc26c5b91", "comment": "Malware payload (Mirai)", "value": "b25420bc4f64cec574015d962e96e6a04e94695f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137839, "uuid": "469f2a86-a3b2-4705-825b-92d294cd742a", "comment": "Malware payload (Mirai)", "value": "2aa9b276e7d84b57736af8dc39fd9785e7005d20320e7c19b3fe2bc083f70eb427540e579341dff5d22e4f5bb96e3f15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137839, "uuid": "454e88ec-b300-4f18-9343-1814338bf43e", "value": "T157D33903F6C148FDC068C5B013BF7131D972F4AE523A7287BB94AE216D4EE951639AD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137839, "uuid": "c616e95d-3990-43c2-9c66-750a976a3294", "value": "3072:62R2vF3Iu3zJk9T8lhfbqcL1dQ0mnqmLI2:6I2vNIoJkgXRdkI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782137839, "uuid": "8b69e3f8-f8da-4b8b-9aa4-cbeb076aa7af", "value": 142759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782137839, "uuid": "454d9c66-a9a8-4f0f-914a-25d94ab5aceb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137839, "uuid": "93aa642f-c60b-44fa-8a0b-16941d7ab738", "value": "88d028a54a136782982817d1d93c89b075b7f04897b0c0681311add7c8712eb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad5ad14-6df6-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782103974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103974, "uuid": "2fce11eb-2b04-4599-b6e3-5212b6a2de6e", "comment": "Malware payload (RemcosRAT)", "value": "4f3ec0d0085e21427939cf1a2679ad05", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103974, "uuid": "e33e4e87-9814-468e-a8e9-f7a139145150", "comment": "Malware payload (RemcosRAT)", "value": "89b0bae4decab7d725cc35fd6f7004eb1255980961449b1ef79db23091654643", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103974, "uuid": "86dfaf9e-55c4-47d5-952a-0043e9963a06", "comment": "Malware payload (RemcosRAT)", "value": "d19e87bdcdc396de338ef52d689b4cdfb8232ccf", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103974, "uuid": "a70349bf-e042-41ca-a0ce-f70db7e7a47d", "comment": "Malware payload (RemcosRAT)", "value": "b291d5cf7ed9a7cdd13647e283f538f2496495b065109554fa4730b651ab6140f7962ef98600b43ef52e69fa51bb1466", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103974, "uuid": "11569058-4a24-4221-99a3-1c59942e1cd2", "value": "T107934A30DE9407990E4B1BAEFC951A61C5BCC619512200F4FEEA170D510AAECF7BE76D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103974, "uuid": "40419fca-dde1-4243-8904-7945d91351cf", "value": "1536:WBA7qO5fqnFO40xIlnYSOndli/dKuDnQsF81mcfxGOTdddJUPP564G:WC7qO5SOjGQK/dKuDnBu1m2xGOTdhUPo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782103974, "uuid": "aac73482-9bd4-4d0e-9b59-c7a70f58488b", "value": 97093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782103974, "uuid": "0b562d7f-cac0-4679-8082-d25f968de6e1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103974, "uuid": "7ba6f7dc-b709-4a23-bdf7-2a4fb1c3d73d", "value": "TT_Slip_SOA_Proforma Invoices.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a1a5c1-6e07-11f1-ae13-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782111424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111424, "uuid": "1dc0997d-8704-4e51-9bcf-b11c76c212fd", "comment": "Malware payload (Formbook)", "value": "d7a4c7a58e3751f1e0c8c23983ed209d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111424, "uuid": "03d959d2-85cf-4645-9cb6-7eb213e13a15", "comment": "Malware payload (Formbook)", "value": "89d12a60639016a1a7713c291d5104878a7024b091c4040600144ccb977e51da", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111424, "uuid": "d8410b2b-780f-4b02-a661-4038c704d747", "comment": "Malware payload (Formbook)", "value": "f212548f8b2df72ac5a66c6ad05db6802d4c73f2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111424, "uuid": "1bcefbe1-2af3-48b3-acd4-1574988bd3a6", "comment": "Malware payload (Formbook)", "value": "fbd232db1adc5c465c5f32afd959b7fd235bb68094ea4ece0d306329a654d6b1c0d4db0fc3c585b5bc254b46287ed6c2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111424, "uuid": "5d579db0-7b31-49e4-a2dd-1751fbecd90c", "value": "T13B164B905724A47469EDC33EE833AFB4448E20071A9CDF6D352E9218BD49E4F579E8E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111424, "uuid": "9043c6f1-4093-4f92-a889-08a76d8e61ae", "value": "98304:FitvemNvn+NNVxnTV2+1Em89jTdqwcQ4YvWdAXs08PMkYKyre1OuvwT3uelwe:Sm8+zom89MbYv8wX+/1Dvgme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782111424, "uuid": "4bcad6d3-bd7d-4a9b-900d-0e8248b9a7c5", "value": 4109341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782111424, "uuid": "643feff3-a322-4a45-8c62-c04ce7799f13", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111424, "uuid": "eeb5d425-cd94-48df-ab76-99b0d5f0d9d8", "value": "RFQ(F100)-05-400030.pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6365b43e-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141408, "uuid": "d9fa406e-4968-4c4f-a415-4fa8447be10e", "comment": "Malware payload (AgentTesla)", "value": "9a0f48a93e46de7604bae4bdeb43b370", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141408, "uuid": "773a3b8f-c252-4902-a751-7437fd040b7e", "comment": "Malware payload (AgentTesla)", "value": "8ad65f2edc59082f3b40672a3d89593b415ec64176136c9f6f783adf1e055e31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141408, "uuid": "cfc520da-9f63-4ce5-bc01-e7f902672812", "comment": "Malware payload (AgentTesla)", "value": "84f138acd0c13fb852438d76430f24d037ba82a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141408, "uuid": "2579445e-82a3-4f61-bc08-abf3330dbbb9", "comment": "Malware payload (AgentTesla)", "value": "32b7d692ad5aca435f17394dc232bb90f570d33b284d774b4343930abfd484f88b43c265ac6ff3e30121c974567404e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141408, "uuid": "76673ca2-315d-4306-9a7f-24df7d2d7a32", "value": "T1A175721BC265929D69B372B158A4B019BE10E12F331FEEC494E6975FF963008EF5213E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141408, "uuid": "babfe3a9-9479-4359-aa67-7fdd02d15b12", "value": "12288:5lOoDYXXV3ijBxZxhyriRG0ja2oegf88TgUvUKyTMVAkRFkvQ/p0aFoK:5lRDY1CzT8UV0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141408, "uuid": "fe8b423f-0c06-4ffc-a3e7-7fb2f9c40235", "value": 1605326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141408, "uuid": "a41310d2-94cf-4e0e-91ce-dc429a42d3bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141408, "uuid": "90c0bdb2-9ecc-4593-8422-c2ee99cd0ad1", "value": "PURCHASE ORDER.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce554f9-6e16-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782117963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782117963, "uuid": "1c001a90-f7db-4be0-ab03-d3254c666ac0", "comment": "Malware payload (RemcosRAT)", "value": "8fb3db11447678753ec8ba9a9711e51d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782117963, "uuid": "6323dd52-8225-4945-809a-f43dda937b1c", "comment": "Malware payload (RemcosRAT)", "value": "8ae20a166e6b2ab746c2f97d92967b6df83c85d6cd81acab1a4883638c5dde92", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782117963, "uuid": "634fdfc3-ff1e-41ef-b7a9-8c58ce51588e", "comment": "Malware payload (RemcosRAT)", "value": "41cfe3dd052cd4edc497bfc6b0b94ee88d3731bc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782117963, "uuid": "74ae863f-1c64-4d3e-a7a3-28506933debc", "comment": "Malware payload (RemcosRAT)", "value": "b45f420508409d345d96ebbee921639ecb1a5a7af6e953a11fb8c71abc4eb051bb192dadfcba791c5fc7852d3a823b02", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782117963, "uuid": "fc700fc4-e065-41f4-8c19-6fe1bcd0ebfa", "value": "T15FF45B20DD25076E0F4717AAFC955B62CA7CC909562611F5FADE0B4D62028FCE3BF628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782117963, "uuid": "c26e9ff8-b452-46c7-982e-59dc467e28c0", "value": "3072:9XSRIOkIeSRIOkIQGhj3SRIOkIQGt8SRIOkZSR2SRIHSRIBhmoSRIOkIQGhuSRIY:Ebs1Jr91dV9qdij3XIAziD516Vqx2AQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782117963, "uuid": "25aaf632-59de-4c82-bc64-8ed7ae91b236", "value": 763280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782117963, "uuid": "fa1114b7-cebd-49c6-ad3a-bcffff5e127c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782117963, "uuid": "97278415-bdff-4a90-ba39-ff70c2a79371", "value": "EUROPA ANFRAGE E261138 A001 PRODUKT DIENSTLEISTUNG SPEZIFIKATIONEN.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d041564-6e34-11f1-ae13-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782130713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782130713, "uuid": "55b4e1ec-a901-444a-b9e4-8c0526fbeb0e", "comment": "Malware payload (Formbook)", "value": "9569b0891356ac6e9aaab74ef25083fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782130713, "uuid": "a64fbba2-2acf-4367-bdeb-20ea584774a2", "comment": "Malware payload (Formbook)", "value": "8b9e4f92bb9551e01ed45c1fffaef2c8771e3a84e01c0fdb6bcec4a7428e0621", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782130713, "uuid": "c456192e-0523-4185-987b-d81a8d699c0a", "comment": "Malware payload (Formbook)", "value": "64a9ade0087d1fdac507354157e47e7b35d6a69c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782130713, "uuid": "fe15fc40-2af6-4bd5-a222-14bcf41079db", "comment": "Malware payload (Formbook)", "value": "3278d8c4abca0697f5d46dfa7f13690e2e0c6941ff7eb9ac5a8bb63914df0c9e4299f168765d6e4598e426682ac67128", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782130713, "uuid": "c651121c-f261-44d4-9949-98fc5fd56642", "value": "T16F14BE921B206541C13A6EF6063A7578CA390CEB033156BA2D5CF6390F46FD97D2F1AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782130713, "uuid": "42fe142f-f33a-460c-9c7d-71576d5e69ae", "value": "3072:5Eho15QeA6ahEPIr1xWhwiutwtNtuZYYFDtdYtY60nhrHm+wjL:5iohDPIewiuqI+WDK90hK+wjL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782130713, "uuid": "9f8924c3-f3d4-45b3-a072-997ef1b78811", "value": 196250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782130713, "uuid": "59121182-f3d1-4476-aae9-eb6d79eabfa5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782130713, "uuid": "9e3b59f0-01ad-4e43-835e-c585afb9125a", "value": "952203.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ff8f223-6df5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782103526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103526, "uuid": "650a646f-12f2-47ab-a2ee-7fdbce5c215c", "comment": "Malware payload (Mirai)", "value": "da754c10c761ae9a8a03eec7c1497840", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103526, "uuid": "0f5ef764-f700-4beb-86ff-b5e97ee53093", "comment": "Malware payload (Mirai)", "value": "8bff0eab714ae1b746abeca672ec23ff941d6748027318f9006221151c0b81f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103526, "uuid": "ca3fbf54-fabc-47f4-9cf0-78997f57c236", "comment": "Malware payload (Mirai)", "value": "3fb9bccc73670b7a03fdf922defc58083f9c891e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103526, "uuid": "bb57bf34-1d1b-4161-9fff-848c32d893b8", "comment": "Malware payload (Mirai)", "value": "70ac1a9d899e26a58460cacc9ad8cda67c7305ef95ff630b3065f22f4118b6e6e1418111808c6315c6096348185c511d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103526, "uuid": "0b9191d8-7931-4ddb-87fa-8e1e0fb73dd4", "value": "T169833917B5C088FCC18AC174072AB13FE976F1AD123DB2F79794EA166C0DD608E2E958", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103526, "uuid": "a2a2c70e-feb6-4de5-9cca-3818710b203c", "value": "1536:KK1yStwBjvszIlQG7ZS4enmB/ljLSl1VKVBi8R6OnFn45yrkOz4sm:tUSovU4D7enmBRLSliVBi88GFn14U4sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782103526, "uuid": "a80617a9-572d-40b4-82f9-98d3a6b9af50", "value": 88544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782103526, "uuid": "6795043e-c597-4258-be29-ac5e5a0bdea9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103526, "uuid": "657bcbbc-a260-4a95-94f5-e0439039b9e1", "value": "nerv.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85d8b70-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141577, "uuid": "891452dc-965a-489e-a856-b35378deb098", "comment": "Malware payload (RemcosRAT)", "value": "8f7e16a8f34982a7922e5e43b95a3829", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141577, "uuid": "fff438f8-b079-4aa8-855c-524140432add", "comment": "Malware payload (RemcosRAT)", "value": "8c4c624560184a6b580370527f4e8a3918e3db7162862f68c424ae8b80240a35", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141577, "uuid": "843af3ef-ef19-4383-aa73-acad2693b8ce", "comment": "Malware payload (RemcosRAT)", "value": "f79f913b48c612887ee8a6a2d9754f8551aeaed5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141577, "uuid": "e267796a-a2dc-4601-aa87-3063d1851d1b", "comment": "Malware payload (RemcosRAT)", "value": "ef13218c3a1445ee90ea3a7113b1aef33d9cb0e778b70c2dbcf5aaf25ba3ef677d99ae4c8461d5699956d3df60337610", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141577, "uuid": "3f8ceb86-58d9-43d0-b244-e50c89bf0c1a", "value": "T1F5750F1CE6A3A821F8B7E814FCD1AE27FF1B37AA318DDA5E95D1074E48130473E54269", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141577, "uuid": "982d1db7-e70e-4601-9992-54142a1fb331", "value": "3072:CRPqf47JuX6f5ruoIBwBogjX9HpWejfCxV4GZdNi3tgtuBkGyBGbwdxtgBgaA5W4:f47na59BaDP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141577, "uuid": "8ee2716b-5872-402c-a401-c727ec05f2a3", "value": 1621742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141577, "uuid": "81c7179b-8ba4-4f61-9cf3-624fd57f21b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141577, "uuid": "937cd9c1-d6dd-4853-8197-2c0907fb4b51", "value": "MT103 SWIFT USD 23,480.25.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1e7cc8-6e07-11f1-ae13-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1782111354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111354, "uuid": "475d7f00-3b33-4949-8ec4-22dd406b5df0", "comment": "Malware payload (AsyncRAT)", "value": "e7bd61aa375b6ac78519d028cfe2e5a5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111354, "uuid": "e2f348d0-0428-4997-81f1-9169406592c4", "comment": "Malware payload (AsyncRAT)", "value": "8c63a57313ad2479a758ca018134377043acbeade2b457f7f3392364b78a4a32", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111354, "uuid": "95d6bb02-67d5-4a47-8d40-f10bdf7683a8", "comment": "Malware payload (AsyncRAT)", "value": "77fb506abce5720bf0bcbde5ce19b612f98a34fe", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111354, "uuid": "3bbe1751-5aff-4271-b811-614b0fb8e489", "comment": "Malware payload (AsyncRAT)", "value": "b5d062673fccb7e61afe285986411a16eafaf0b5f9dfe537422c6c4ecd17e1bb0c467e2fdb8dac7d13ba6433ab84500b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111354, "uuid": "74e37a9c-0742-4aca-bcfb-ec9819476d44", "value": "T16984AE8527C07DD4035B9F3E752BB1C8E4660D9E39C8668FE321FDA2F9B1606A6D1234", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111354, "uuid": "87abf72c-1899-4949-adea-d38c76ac5448", "value": "6144:VK67XewER2wtpMs4aMud6m9vltImOEzH17HSrprYsIALF8dsoh5:VKeXgRbcd89vrImOL9rYsIALMsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782111354, "uuid": "00e81b23-2436-44a9-b6ec-8c72b1dddf32", "value": 402852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782111354, "uuid": "42b0d84c-d7a0-4530-add1-3921c7179af8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111354, "uuid": "ad8ec11a-5c40-4e79-9be6-ac6772a12c95", "value": "Product Inquirys.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810aa245-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (SiriusRAT)", "timestamp": 1782141458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141458, "uuid": "4270882a-36e8-4ac7-8a8e-3e5e58c48738", "comment": "Malware payload (SiriusRAT)", "value": "e8264569668cbe6d7bade99eaddc3fd8", "object_relation": "md5", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141458, "uuid": "0c286e4c-9444-44bf-a214-e7139a561654", "comment": "Malware payload (SiriusRAT)", "value": "8ca5b11d25c4d0db1ced97822517d198fb6b5b98ba39ef8710438aaecf99da87", "object_relation": "sha256", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141458, "uuid": "396d47b4-fc7b-4150-a752-45ce13bb5e9c", "comment": "Malware payload (SiriusRAT)", "value": "c5e5d44110e8c8830e1f9125a1d34033ac9bab39", "object_relation": "sha1", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141458, "uuid": "6c260da5-47cc-4536-8cc9-109658488a27", "comment": "Malware payload (SiriusRAT)", "value": "c5f5924180781c7d9f9bbc607a9e2515c520e0102a004a8fd2e13de75cbdfc52c4121a4ca17c92ddb367a05913587fb9", "object_relation": "sha3-384", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141458, "uuid": "b12a30d0-95b9-4805-aab5-b04c1b556d34", "value": "T187C53399BE78D73F3E18E08B8E2BCC4B74767F5C6853638737A55C689039B035668860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141458, "uuid": "527919cc-c1c9-41c6-8bb1-3cab62648cf2", "value": "49152:d9C/duoQeyiAVu9zgZ0aPyPSGtM8lDi8fQBn/4eKFq4llpFzDVw7RuXR:dDoQeyiAVu9MBPyPSGtM6DtfU/4Y4lBF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141458, "uuid": "6c8fd0b9-00dc-4bbf-9dfb-bb00738a1338", "value": 2611777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141458, "uuid": "d1a5540e-b8d7-4717-b9ff-2775d11bf061", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141458, "uuid": "8a289c9b-83f9-473e-8fde-2cb48b96d92b", "value": "bonifico.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a6efd3-6e53-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782143819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143819, "uuid": "62aab85c-84e0-4e25-b54f-c0686895fd4a", "comment": "Malware payload", "value": "443111daf1ecb31a584cd51072578168", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143819, "uuid": "166b2ddf-bf0b-45e1-bf21-8ddbb67c7a9b", "comment": "Malware payload", "value": "8cb94cb781435177519c91fd9663b960d3521dff7943d10f78831e0a5ad0873f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143819, "uuid": "daadb857-32d1-4100-be95-c26009900bc3", "comment": "Malware payload", "value": "a55a314da344b86e3537a2d1f74e67032533c121", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143819, "uuid": "c408c8fe-de63-4a35-bdbe-2c8d51955ba3", "comment": "Malware payload", "value": "3fc4ccfd19b7c45f1e5ea72cb457da87525cd8c0d2d50330079524608b7e8845d1572e04cf3c11771ba770c22f58ff15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143819, "uuid": "cb9b65a0-0509-42b9-a12c-3c01899e6980", "value": "T16C24D91A6E228F7EF7A8C73047B74A30A75933D626E0D544E1ACD5145F2039E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143819, "uuid": "a3f60af0-66b6-4688-8135-6d4293e89dae", "value": "3072:oHJlwRneQ19Ozf7jQmE02l54D5mt0s+uY/acSzSPT:oH8RneOwXQt+5nsdYicSKT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782143819, "uuid": "5aefd131-3ef6-4c1e-a3b0-a10e70bc4866", "value": 210320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782143819, "uuid": "212435f6-c03f-42de-9e4f-582b20ffa711", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143819, "uuid": "13227099-8ff6-4281-9a5d-8551a321e9b9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad16fe33-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782115332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115332, "uuid": "0d6c9687-826a-43e3-9520-75243ac5e539", "comment": "Malware payload (SilentNet)", "value": "27f4951f2598ad84ac3e258f895fdd7b", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115332, "uuid": "4be0c9f4-7f34-49c4-9e8d-ba240e227d41", "comment": "Malware payload (SilentNet)", "value": "8d02027644a2555af673e1adc9e3f36645cc9f6c3acf6e5d772132b7b786e19c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115332, "uuid": "f59c7ae7-7747-4d18-8e84-ae0cb5be3b19", "comment": "Malware payload (SilentNet)", "value": "33f7ec72da2de2ec5a053eaa12337c3638601587", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115332, "uuid": "b23f52a0-34d5-4821-86b5-613bf28a939d", "comment": "Malware payload (SilentNet)", "value": "308139e5048bf482a7d36a01d3842de3cd62d97e402f85d07734aae284d4b4f452fc6b58c8cdec769d9eea89e0d26ce6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115332, "uuid": "a77ec530-753f-49d0-af9f-dc587e9d97db", "value": "T14A1533A69D52A6D1C7039D72E829358DCBB67F9CA393C50D430FBBFB82241741E162B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115332, "uuid": "996c05e7-c44d-4944-8193-ac5eaccaf6a5", "value": "24576:vW9KCXPogk5hhyTZtivwqRbcVDKeVo0KnRln:+9bXPoFhhyT2oqFcVxV1K7n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115332, "uuid": "d7a765d8-ec84-4550-a738-5abb44db5e2e", "value": 938588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115332, "uuid": "d0294d7c-f4f6-486c-82cd-bc097daf3483", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115332, "uuid": "6398e5fc-363c-4beb-b1a6-c76c9ee3047c", "value": "meteor-client-1.21.4-31.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8bf5b7-6e89-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782167029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167029, "uuid": "a2ff90b0-654a-47d7-952a-d8a2290b0058", "comment": "Malware payload", "value": "d0a66dd44ee64b76de79cddab13d2745", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostShell", "colour": "#768394", "exportable": true, "hide_tag": false }, { "name": "MB-0009", "colour": "#E8335D", "exportable": true, "hide_tag": false }, { "name": "UAV", "colour": "#F3B08A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167029, "uuid": "78ddbc04-56ba-4ac7-b1e5-bdb95fe79a65", "comment": "Malware payload", "value": "8de34006dafd990853a45cbe9aaab4ee18c8cd4c1ad0a98fe71f8d63cd60db25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostShell", "colour": "#768394", "exportable": true, "hide_tag": false }, { "name": "MB-0009", "colour": "#E8335D", "exportable": true, "hide_tag": false }, { "name": "UAV", "colour": "#F3B08A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167029, "uuid": "ab7157ee-5bf0-422f-b590-b7c05f3f062d", "comment": "Malware payload", "value": "c4834de90f419c5517f3a1c13d219d71fc85e742", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostShell", "colour": "#768394", "exportable": true, "hide_tag": false }, { "name": "MB-0009", "colour": "#E8335D", "exportable": true, "hide_tag": false }, { "name": "UAV", "colour": "#F3B08A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167029, "uuid": "c0a0b061-b521-4688-bab8-42f9c33a6fbc", "comment": "Malware payload", "value": "ca8266ac1c1062ac4bc39221e78442107e93ef65763a73b05cc48b40d9999d55bdd663319fc6bbd6cce99698fc566620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostShell", "colour": "#768394", "exportable": true, "hide_tag": false }, { "name": "MB-0009", "colour": "#E8335D", "exportable": true, "hide_tag": false }, { "name": "UAV", "colour": "#F3B08A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167029, "uuid": "87180bb8-5b02-4808-bad1-15be613e6008", "value": "T1ACF61207ECA269ABD0AAB13189725652BA61BC443B3123D33BA0B77C3F777D05979710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167029, "uuid": "68ff0084-b4fa-4f37-aca0-2320f6aeb623", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167029, "uuid": "4e9eb045-5ff8-4950-b8db-7031832ac9f0", "value": "393216:dg20O1AknheBkQxFCWXVD8qC9/fa/wWSo0zqC5h:dsONnhM6AVDBwWazqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782167029, "uuid": "83ca1844-39e9-47ec-bbaf-b8f7bf5b9275", "value": 16241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782167029, "uuid": "453d2fce-a8b7-417a-a386-79036814db40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167029, "uuid": "4855d0aa-9c51-417d-9a7b-73f2b77ebcdc", "value": "22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7449a176-6df5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782103641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103641, "uuid": "b5b5cac8-cb9b-47d4-a488-3957cbbc5d84", "comment": "Malware payload (Mirai)", "value": "b93f554871277f82a082602190c0c548", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103641, "uuid": "ed49ce75-abcd-476a-acaf-87a53d490141", "comment": "Malware payload (Mirai)", "value": "8de571b44211ec6fd985428d1464daf0e4d31202c8286de9c2c496d026595caa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103641, "uuid": "216cd0fe-de05-4d5a-a2a4-6e852d2f0456", "comment": "Malware payload (Mirai)", "value": "c0dfc2b92c3610c1448094b7e0aca300cd376590", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103641, "uuid": "55e6bfff-cdee-4e0f-aa18-9caa5b4a0de4", "comment": "Malware payload (Mirai)", "value": "86bcd5bea0cd394684b6f13f51a49e7ada112b71a905786ff5da465f94b34df11786ae45bcd4e0249763284b3ad02052", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103641, "uuid": "56e28245-f73a-4801-9be3-8c0b639368c0", "value": "T18DB32986BD826622C5D423BBFA6E418E772623A8D3EF72138D215F2037C791B0D77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103641, "uuid": "751ec192-e594-43a2-bd26-41ac3889b692", "value": "1536:vOlvWIlGPodwHHK7CDvDNUsdnYkqlGBPRLUW7aMyfr0V5EcFYlTWzLxuIeK:vOlezoONUsdnYkq4CyDyfr/nW//", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782103641, "uuid": "58740956-d259-4699-bddb-04fc639ede7f", "value": 107924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782103641, "uuid": "b25a9b4e-fef5-4739-bc77-305c6ab140c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103641, "uuid": "852c56e1-b421-40e2-b2fc-4ca46868157d", "value": "nerv.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c261c5-6e89-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782167289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167289, "uuid": "18e395b2-e68a-424a-84b8-ca8754a7d63c", "comment": "Malware payload (Mirai)", "value": "25b53b3c2ea33bc6186f2fde8bac7302", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167289, "uuid": "84cb77d0-f607-4114-b5b3-54b830329360", "comment": "Malware payload (Mirai)", "value": "8e38a4ce5a1f81ccf6c9b0a71071d837a35e22593ccad2249191e39fa268fb77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167289, "uuid": "52cca8ea-9749-417b-8369-58f55bd2f06c", "comment": "Malware payload (Mirai)", "value": "0a43ded2109aeecee54b054c7e501660c4aae03c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167289, "uuid": "59a371fe-b61a-4adf-95ab-c10a762d043c", "comment": "Malware payload (Mirai)", "value": "424b2bd9bba026e20957489969cf6332b66b56d1885910a52d7f1b8fc3ae9b61aab0f54c0ec15758d77c19e8f669bed3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167289, "uuid": "25c9769a-e478-4875-b5a3-dbdb9017bcf9", "value": "T1D5A3F885F8509B17C6D655BBFF4E438C772A1758D3EE320399266F20379B86A0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167289, "uuid": "06541e72-d6f6-4845-a70f-013044701830", "value": "1536:3qFGo5QMJ9ND4VWPF7SOVCA+j5Eh3OwlfOwywd0eU6Twg+H7xDDOpE:3mpQMR4MFNVA9EJcHF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782167289, "uuid": "be34e979-72f3-4c9c-8e98-8f19d98ea348", "value": 101100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782167289, "uuid": "771350ed-3eb4-48e5-9d2a-0ca234a2e4ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167289, "uuid": "c5928a17-67fe-4d70-a09f-f69422a81efa", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24d72b4-6e09-11f1-ae13-42010a9c0009", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1782112361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782112361, "uuid": "df0c1686-9cf1-4fb6-9419-55bc2a92dce7", "comment": "Malware payload (Gh0stRAT)", "value": "da26a2729ed04d876c8e9c55175ffc2f", "object_relation": "md5", "Tag": [ { "name": "abtrojan", "colour": "#2C7DBD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782112361, "uuid": "ec39dce1-bbc7-45f0-8f74-f94de978a6f1", "comment": "Malware payload (Gh0stRAT)", "value": "8eae6ca0380279f0c047e6b5d49808db591f9e14d106226017eaae62b79c1a10", "object_relation": "sha256", "Tag": [ { "name": "abtrojan", "colour": "#2C7DBD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782112361, "uuid": "d6eb7fd1-33f2-4fe7-af1a-1150b2f0b5ab", "comment": "Malware payload (Gh0stRAT)", "value": "a4be417dd9ef150c53eaed54d1bba4c97e5883f4", "object_relation": "sha1", "Tag": [ { "name": "abtrojan", "colour": "#2C7DBD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782112361, "uuid": "9cb13f70-109b-46d4-a43e-37c9fd7becf1", "comment": "Malware payload (Gh0stRAT)", "value": "2c761be0ccc7008286ebbefcbcbd4c372c067a6c652d257c55716729d4154b40a0348826ddec3f44ddff8e0fb51a36d2", "object_relation": "sha3-384", "Tag": [ { "name": "abtrojan", "colour": "#2C7DBD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782112361, "uuid": "de6917b9-6b57-42f8-b983-64e1d222ecac", "value": "T10207337BF26C653ED5AB0B3140B3921099B7B7A0A42A8C1E47F0854CCF7A5B05E3B756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782112361, "uuid": "bc59b50e-6049-441e-9d34-faa7361bfb1a", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782112361, "uuid": "53957fdc-b701-4007-993b-e330a73912fc", "value": "393216:3POx23so+VDbdfEmMlZJcPQP1M6Ikto9p8H4Rx:/OgZiDZrMGPHkQNRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782112361, "uuid": "f14b0752-e67b-49f1-b670-44ac025afe85", "value": 17047126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782112361, "uuid": "d480afc6-8427-4770-996d-6e82f95ba0e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782112361, "uuid": "642281b8-99fb-4e19-973e-956c9d4fe80f", "value": "\u1796\u17b7\u1792\u17b8\u1794\u17d2\u179a\u1782\u179b\u17cb\u179a\u1784\u17d2\u179c\u17b6\u1793\u17cb \u00ab\u1794\u17bb\u1782\u17d2\u1782\u179b\u17b7\u1780\u1786\u17d2\u1793\u17be\u1798\u00bb.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4dd630e-6de7-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782097843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097843, "uuid": "b6eb0f45-fbe4-4e13-8e82-b29808c11a27", "comment": "Malware payload (Mirai)", "value": "cab67f8dc2ea81b6e2d5c72259a3b9ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097843, "uuid": "f5529044-55c2-436a-b3c6-a261ac155d03", "comment": "Malware payload (Mirai)", "value": "8f220944e1c64266ef33f1ebbf64d0e6ebbaea6262137fffced01443bd12fe96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097843, "uuid": "dc129047-d69b-457f-8af3-04b968262d1f", "comment": "Malware payload (Mirai)", "value": "48f8118706835ba5fd8e1a43ec71cdaf8bb9d917", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097843, "uuid": "00d37cde-e6b7-4066-a002-6c5ceb1ad86a", "comment": "Malware payload (Mirai)", "value": "b4a5e122a726fbf0a049a5d06f3dc97f9d8fe8b395b1a45be5107a1e7924876b9c6308332557fe5265ff7712a0e45b89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097843, "uuid": "be6ced29-66fb-4918-96bb-1f76352b352f", "value": "T106C3F952BD429B13C6C311F7FBAE42583B136B79D7EA3102A9247FA0274B8DA0F27551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097843, "uuid": "c47211fb-b18e-445d-8f40-bc339010f06c", "value": "3072:22s2IHs09ZZtD/pPDfKzyhhdY85KRkDn2:VIHs0zHDBbKzyhDY8KeDn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782097843, "uuid": "de8df09e-19b3-4019-91ca-a167b1cef32a", "value": 124996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782097843, "uuid": "ef171d27-a245-4dfe-a969-42c36f673110", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097843, "uuid": "dcb71168-91ed-47ff-8518-67915d079827", "value": "data_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab80854c-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141958, "uuid": "41e9537c-798c-46b5-93d8-324b524cc817", "comment": "Malware payload", "value": "05079fd1341faee585beaeda48f58e97", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141958, "uuid": "ce862378-7764-4863-bec3-ba3f178b74ae", "comment": "Malware payload", "value": "8f8a9e2630c8854f3c067330869f7458d760ee92ce0912a8a572a22af07dbb34", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141958, "uuid": "3eaefded-94b3-4e72-af85-57ef3fc864b8", "comment": "Malware payload", "value": "0e3dc399adbbd0c58454c43986ae7082030b7288", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141958, "uuid": "449370c4-8532-4239-8e54-1089e8048c6b", "comment": "Malware payload", "value": "99c7219baf43bd143d6fecb40b4a9e743cc16913f076c7abb51d89eb1dd0f9001ca4c80e054703130c8789a3e0c87273", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141958, "uuid": "de5d930e-1405-4f87-9edd-eaa3fa87c077", "value": "T17375E9748E5A267172F1C2F8E1DB35FAA74FA2B771AC7D6D04A303844283582E9D644F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141958, "uuid": "c427aa81-956e-43eb-b158-eb2a16059bf6", "value": "3072:IzXOHQ1n+5j7TJzToYv6d+SfR0ud+rI1ylGc4wpL3mfRrbIO1a21aMMYxWfNhdpa:G+97FCd+SfR8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141958, "uuid": "36bd6ce3-eafd-4c20-84ef-2f456b9ecb01", "value": 1552830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141958, "uuid": "15e56eb0-e9f1-45d4-ad6c-05c98b12da6b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141958, "uuid": "50b84429-f0da-4172-9ffa-2c09d35cb312", "value": "Doc_00086575346632346644664564.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0605bae-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782115311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115311, "uuid": "0318112d-5d99-47e4-a70f-ea7a8c060d92", "comment": "Malware payload", "value": "a3b4d5b0a1ef879fa0c000e94d9d3d3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115311, "uuid": "83f72d11-c9b8-4a4c-a983-a13ffbb98d42", "comment": "Malware payload", "value": "9280afc68568f85d1094c28203d7843747858e8d5b954e9e0d5cbb4966052dcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115311, "uuid": "d21d49f4-80d1-434d-925a-0b82c5658da9", "comment": "Malware payload", "value": "22aa508a8a77e0ffea7a47a24703f45daa18c83b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115311, "uuid": "980645dc-0632-457d-98b6-e083719fc347", "comment": "Malware payload", "value": "c4fbce5b00ea24e25a8095acaa6ba08c2ba5997b21ad4d9528406027d1178fc42da21aa2e0fa5da34a392f0d010a16c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115311, "uuid": "13491132-f00f-4c4e-bb2d-f885a49e704b", "value": "T1300833A5ABC4A4D7D7198733C136DA14AC62FC0D074788EF27A849563E6F2E839BDD10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115311, "uuid": "121e59c1-93d5-40f5-8ec2-ce5d08ba6882", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115311, "uuid": "2e67bc6f-7765-4f74-b98b-2bec9073bded", "value": "1572864:N9zyznEWOQWPVr6LrtO5SrjtAsIgqTcaNH21A/QE5oeOwJ1crzZOV:N92znEWOdPJKrtOsHtAsg7lx76elKrz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115311, "uuid": "28dd77c5-6333-4e04-9aca-e8cbf0b4046f", "value": 80374297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115311, "uuid": "70936e3c-8c41-429c-be2a-562aac181b3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115311, "uuid": "bf9e097b-61b2-4178-91a3-bc2315508e4e", "value": "a3b4d5b0a1ef879fa0c000e94d9d3d3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7413377-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782142032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142032, "uuid": "df3fcc96-4267-4f07-b375-7bd8274a108e", "comment": "Malware payload (CoinMiner)", "value": "833fa87f27753cce6db881c080475663", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142032, "uuid": "8fd8ff36-dbc7-448b-b10b-931d22bb1e75", "comment": "Malware payload (CoinMiner)", "value": "930070e90a3b037b5132ff7bd2c49899d3da39679e9ff377ef5d7e40ea57d39e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142032, "uuid": "2be3adcb-4e3a-47d5-85bc-90dc4c16b60c", "comment": "Malware payload (CoinMiner)", "value": "db16d6f72caf600aa8e6ba5672e3062b773628ca", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142032, "uuid": "c959e111-79bc-4711-a484-27bdea619eb1", "comment": "Malware payload (CoinMiner)", "value": "6e6dc5e97268e0636015933277c6921d6b0067ad256deaee1ab5ddc437cf3a793e11eb0cf7dc1ad709d0b03d7b7e1729", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142032, "uuid": "f4300a11-44f2-4a84-87bd-f8a083777a32", "value": "T1A0A4E10F75B49636E92DCC3EA38B09396B10B42D92411FC775A3B8804B767BCB179A74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142032, "uuid": "9a693961-a40a-45eb-ae90-16dd38916c09", "value": "e81d90b230abc81b286482b9dba12e35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142032, "uuid": "33419ba8-c6e8-41e3-aac5-eda5017c0515", "value": "12288:7Sfww5yYBfmTHjy3defztF8Na5KO5QjK:Wt8Im7sdG8NTkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782142032, "uuid": "ab18ebd4-52b2-4c50-b4bd-cac2b8790c00", "value": 462336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782142032, "uuid": "b083b480-22d1-4064-9b88-7a84ecadf6dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142032, "uuid": "1c5dcb91-d615-4526-b249-8333ec69e319", "value": "BackdoorMenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95b6fcc-6e0a-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782112883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782112883, "uuid": "7ce22fa5-def1-4602-a3ce-6c08d3f9aa34", "comment": "Malware payload (Mirai)", "value": "4cc8c0011ff25175b4edd773324d47d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782112883, "uuid": "390f4915-c101-4382-98cf-7dec25039f0e", "comment": "Malware payload (Mirai)", "value": "93b2b10275c52ea32e58e6265bbbbbef309283c2193f193c288443e1560651f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782112883, "uuid": "5546d1a5-d5a0-465f-8fd9-56f07780a365", "comment": "Malware payload (Mirai)", "value": "406fa553091ff022695a4a2e258fb4b40f123da6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782112883, "uuid": "c7fc3f5e-d5ba-4308-9bf2-df22d9e0533e", "comment": "Malware payload (Mirai)", "value": "9e6ec43d8f7055270326ef5f078163ad6a92c6533003fbc462030151a82557a498d542d044ab145ceb3f08b104b01e67", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782112883, "uuid": "58c3ceb6-b703-4bea-b2dd-6f5d0de0af80", "value": "T1D274B573D8158995F0245CB3126B3351AC468BBB48E722E3EE1B1962FF3145B51BBEC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782112883, "uuid": "727869b4-dcec-4abe-84e8-4d6af4e946c9", "value": "6144:O2X8lWJxbya7UfC56NBXmX/Vcse84a0ANb:O2F5UfScXmX/Vcse84a0ANb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782112883, "uuid": "cd5ff08b-41c8-45b0-a3bb-35573aa0b67e", "value": 339912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782112883, "uuid": "4d48da52-b9b1-47c6-b101-94662ab89195", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782112883, "uuid": "a0d20d0d-219e-4665-8420-4ae49df0b79f", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29966c4a-6e04-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782109958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109958, "uuid": "40484c3f-4cf3-4ed9-beb8-ac9a1ee36774", "comment": "Malware payload (Mirai)", "value": "ca331db410c5d233d27b53a4d7aae567", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109958, "uuid": "99034aab-9798-4b4b-9fab-3cb1b98765b7", "comment": "Malware payload (Mirai)", "value": "9493e0fb1c8e98101f011154d73d97b5f5bea466e69771167f265dc0430e05ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109958, "uuid": "bd04c7db-7e53-4b2b-a348-edea5cb9d621", "comment": "Malware payload (Mirai)", "value": "299b7a73094080752d6a5922d0f63389e5f9a24e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109958, "uuid": "301aff10-1db1-4660-b63b-648daf35ca61", "comment": "Malware payload (Mirai)", "value": "78ee8269327844a790889611bc28457daad577a16e1288926eb4a9d3afe9c31b414bc28b8d74111603086ea268f7dd49", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109958, "uuid": "a8401df2-0eb6-4729-a478-b062aeb0cba1", "value": "T1DD74C63399164992D0508CB212673356AC4BC7BF88FA22D3ED565DA4FF3145F22BAEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109958, "uuid": "4105244a-5b19-49e2-8da6-2cd4407b4e9a", "value": "3072:LUw1QiSUBNP6Xg69UKwD4BMEbxiUC07QUmX/VMso84ayTNb:4w1Q5MlewD4BZnPmX/VMso84ayTNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782109958, "uuid": "eeb14627-c08d-4c5c-a08d-e25f036bdca4", "value": 360114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782109958, "uuid": "646fc7f0-3973-44cd-8569-b27783f2502e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109958, "uuid": "00541b77-6db9-4255-9360-b3b77d7c34ef", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23204dd4-6ddf-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782094055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782094055, "uuid": "46d15fcd-08c9-4223-9eb9-b58b09e62fab", "comment": "Malware payload", "value": "51a41100fbe14088241bc9a977c820a8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GameHack", "colour": "#4EB4E3", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782094055, "uuid": "13b69e35-1908-4a49-9efe-36a9ad2988c3", "comment": "Malware payload", "value": "967e1665f6935556bdaf20d9060eb03d45382a5c0dd232675daac3c6962e2a86", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GameHack", "colour": "#4EB4E3", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782094055, "uuid": "8f52e669-884c-42ca-96f8-6c45a7fe6e02", "comment": "Malware payload", "value": "c7992d4bc8a2018578a46741548f53aa6a81ad88", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GameHack", "colour": "#4EB4E3", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782094055, "uuid": "102986ff-b499-4f4a-a55e-3c661d44c024", "comment": "Malware payload", "value": "583beb5e2aa4fb2a535f0bfb1de89324afb427d689d916ff9aceb03dc61fb7f37475f3b673b9a421f221fbbe166a0442", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GameHack", "colour": "#4EB4E3", "exportable": true, "hide_tag": false }, { "name": "RiskWare", "colour": "#8F06FF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782094055, "uuid": "4fe55794-3bbc-43ed-b5ea-cf9083d95251", "value": "T16A667D077E4AA43CC116C6B1A24F4E679D35B4CA1B207CDF86C4A3782E71BF54B3A949", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782094055, "uuid": "78277c60-f56c-4be8-ab35-c480c35000d2", "value": "8c26864f747d8de2cfcda33d420fe52c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782094055, "uuid": "f9543f81-32ea-4eb0-8fcc-6e44cd2de6b0", "value": "98304:w001OmCbfUNjX5hJPQkJdt20PGZyDX+R:w0eBCAByqBG8Ts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782094055, "uuid": "34227dbc-dad7-4380-a7c9-2b1d4fb36a71", "value": 6487552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782094055, "uuid": "c81bbd25-63e0-4d84-aeda-76c8b242161f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782094055, "uuid": "331d8720-775c-4647-a26e-c832a23f7174", "value": "YimMenuV2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e93f263-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782115281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115281, "uuid": "2a3a39fa-72c1-45bc-a2d0-563169f7ad8f", "comment": "Malware payload (ValleyRAT)", "value": "b06380cb28347af4fc2c5e294fc779c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115281, "uuid": "0c9d124b-c412-429c-8d65-3d5793170773", "comment": "Malware payload (ValleyRAT)", "value": "96e5117b89a7f3b20cea680ebd4fe453715f4022a2cdca394b5a2c23aabe2361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115281, "uuid": "28d6fa02-98f9-432d-8739-be5181a8f285", "comment": "Malware payload (ValleyRAT)", "value": "0ea50e2b1161e55bbed355b12283f268da1021ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115281, "uuid": "582156a2-b024-4b76-98f2-19ffaa560d8b", "comment": "Malware payload (ValleyRAT)", "value": "95172639a194eb403e70840c049b43e9ab45793371172d0b6cda35320c02ecd8faff6b72f7051e144660d2b382c8189d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115281, "uuid": "c66330a1-97d9-466e-a60c-74fef107bcee", "value": "T16E769A24E6A15E7E1F176BEDE04E98EF6A8FCDE306C9002527F197D2C960394840ED6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115281, "uuid": "57af3221-0459-40f2-b30c-410e2d49f4e6", "value": "372a8bd3ba4968b455522de45accd556", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115281, "uuid": "d39f375c-9ed3-4b32-9114-4dd411fb6927", "value": "98304:Lw8gCHziv/32yH31nDd0FikzXoT+GI6zxN8C8nTZ0BidK69c8lVJjZRDVDARH1LL:Lwx2yX1nDyFiohgNl8U4K6G8L5xoVLO0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115281, "uuid": "616f6ebd-4c38-43e3-8b5f-52161ccff7f9", "value": 7355392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115281, "uuid": "5de201e7-ec75-41a2-a936-1e91c592d8b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115281, "uuid": "f91342e5-6db9-46aa-b2b4-6b40d87a16a1", "value": "StallStepe0.7.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a570439c-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141948, "uuid": "02210930-8621-483e-b3c5-f0e6217f3579", "comment": "Malware payload (AgentTesla)", "value": "93d5f0eb2c8e7883b081396ddaa26375", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141948, "uuid": "7e18096f-856d-4a7d-8a22-ff115b9a4cda", "comment": "Malware payload (AgentTesla)", "value": "9743d3cf43fd03b0249cd957ccaf46850f0e9ba27eaea0c80b55ae1710904b7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141948, "uuid": "164a97fb-7697-4a61-b6d2-c5f25fdb4684", "comment": "Malware payload (AgentTesla)", "value": "fa684ae6834c1457856952cad4f080d2390e7afc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141948, "uuid": "1d226548-7a42-4b1d-8b66-b5036f84e0e4", "comment": "Malware payload (AgentTesla)", "value": "e7f573576343570ec515882a4e14d1822b3e58d2035fe796b87501af3f237c0987306b403a1ab94bb3e5fd98a1dff225", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141948, "uuid": "c9722054-2265-41c4-b4ec-b20e7535aa3c", "value": "T1D7064B8185F0A24F64E8CB6AA54B9FFC854E5407DA34DDC43B1BD76C8C0DE8E22A51E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141948, "uuid": "bf1384f8-ee6f-499a-ab47-e1e44765f921", "value": "98304:dsib/qjuzbPi0BNdEA7k3eHUrIPyf3ZHHYsQH9OtRzv94bgqh+4DuJ:6GGyEAg+EIPyxnj49OttVvqbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141948, "uuid": "7559a497-63ee-43fc-8775-6fc877b75ecc", "value": 3781576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141948, "uuid": "cd2509c3-6056-4e2f-8975-18ffd31ea235", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141948, "uuid": "ae308f61-a3c7-4f35-ac4e-6c97ad8e4ef1", "value": "DHL_456865.PDF.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9854eb8e-6e53-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782144074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782144074, "uuid": "6fae7035-a8ee-45d4-ad28-fcd7d5675739", "comment": "Malware payload (Mirai)", "value": "08bd7596b26dc2c94f96083e3c218810", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782144074, "uuid": "3970807c-f57e-4202-bf16-67a5f7f67082", "comment": "Malware payload (Mirai)", "value": "976b5dc013d829be68c2e7964bf0e28e0c7fd167292982a09217a5b0a08723ff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782144074, "uuid": "6ef70b82-aa34-4eb6-afe3-3b4c12cf940e", "comment": "Malware payload (Mirai)", "value": "b9dc4d72bb3de996b64c600de609d654bc810058", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782144074, "uuid": "fab25512-97fc-4d98-bdc7-1e4b9e36365d", "comment": "Malware payload (Mirai)", "value": "71fc9445e6ff2671ac18cb65ab6ba00e6559cc1259dc34aac7a9198214226eab2216a6f78989213ce9b30744835c4c85", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782144074, "uuid": "e79960c1-9180-4542-a672-fc0a4cbdc716", "value": "T105B229A2CC7A6E18D25882F4B4704F795B23E855E64B1EFB051AC279D043E8DF50A7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782144074, "uuid": "4c3e4b4a-22d8-4dbf-baa1-9700d5d95747", "value": "384:RaY/7240eHSsJAOUQDqCR+xknY79qJtNDvlo23+/5qBqJCn7da:RaFeSQeCdo23G5FCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782144074, "uuid": "dff953b0-0932-4ce4-9ed7-53c15bd9f5da", "value": 23696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782144074, "uuid": "31da3248-4c42-4f6d-8bee-a93a08c51a78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782144074, "uuid": "6728f54b-0407-455f-93bc-5144ca8b2e86", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9315f1b-6e48-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782139485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139485, "uuid": "7d861138-40e2-4f49-a272-82703501e642", "comment": "Malware payload", "value": "1f122145a516407b9d7899ef9d98a7ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139485, "uuid": "3c672cdf-4bd3-4188-9173-47a323e5df38", "comment": "Malware payload", "value": "97d52f54dfdbe3f2fc2171b54afa8b97647a1bc88d2bf2e387fe8f78b55c85aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139485, "uuid": "62dc42aa-6d22-4ea5-acab-52e30275a5e3", "comment": "Malware payload", "value": "1ea7701f291d8feba331c8b5105358492ace1d77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139485, "uuid": "0bdeee55-be88-4c9f-893e-ee0f82ff9d0d", "comment": "Malware payload", "value": "6c91c5daf65d50532a716ac77ab163563c2b94949a867273a2e67c7cb6067de9505a38adb9b7d61ae1579c73c093d18f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139485, "uuid": "0fc54a5a-f39a-4af2-a756-f461bce8cbfe", "value": "T1E8444946B66994F5D4B2D23AC942297AF6B17C058371D7DF03903927AF33AE0C9393A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139485, "uuid": "0993d116-8877-4dd9-b73b-2aadc0e57832", "value": "c21f7e17d1d746619c809b3ce642d7e8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139485, "uuid": "f92d2ddf-1ede-42db-a491-bae2e77848cc", "value": "3072:CbwWE5nqVsRiV3nGNeGviwYap+JbdaWnnFB4Yv/X3QrVyE+gCr:AGnqasVGlMxdHNf3Q0eCr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782139485, "uuid": "60b2eb4f-4d31-4697-9ff5-873fd58f630a", "value": 255488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782139485, "uuid": "e3220074-44ea-4284-9145-067702455afd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139485, "uuid": "0886ffde-5e1d-48f1-96fe-256e18d28f66", "value": "undetek-v10.37.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39ef5c5-6e12-11f1-ae13-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1782116229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782116229, "uuid": "9efb2551-ec27-4d19-82ed-1b6b58a617c1", "comment": "Malware payload (GuLoader)", "value": "a9b33292b46c7536a34f812d16aae9fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782116229, "uuid": "e9abfee5-258f-48ca-88b0-dc827e4b2f40", "comment": "Malware payload (GuLoader)", "value": "97e7c70270a2522d212ad556382d97477dba6730dccd421230a9f36cb97aa9ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782116229, "uuid": "a9e01218-94a8-4f8f-8c86-867dbf98a978", "comment": "Malware payload (GuLoader)", "value": "d5d9cf48338890823f4897aa4db4a2e246f1ffad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782116229, "uuid": "17afa64a-d913-4864-b276-6b09e5e99df2", "comment": "Malware payload (GuLoader)", "value": "fbe91b7b5d94dd580104e6374e4ffb1aa21d87a1fb34216a600b75cd60823e9c7e8cb36593b12c944b61d9b10139814d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782116229, "uuid": "0fcdd8b3-6124-4cba-ab45-10e5e35e9e69", "value": "T13FA47D41F8185CE2F8395672A87F9DB609D17D3B46E4196E2ADFF73A14F2212001BE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782116229, "uuid": "1cb53c36-65c6-4623-93e5-9a4a828b63ad", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782116229, "uuid": "55840a84-1994-48e8-a105-74448efa55f6", "value": "6144:PXsKoGShOkrI7LtxQ+/fIMqDhkeHBqh2cV747dCKV4:PXOefIBhLUo2U7wu4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782116229, "uuid": "c184a79a-49c7-422a-bf74-4885cad9e075", "value": 468536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782116229, "uuid": "aff89e0c-feb8-49cb-b87d-4a5474c9ced2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782116229, "uuid": "d6592de0-6589-4841-8d0a-0045881ace89", "value": "July #595.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2a5b82-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141741, "uuid": "199fee52-cdb7-4b5f-9bed-68955e328036", "comment": "Malware payload", "value": "6cdf9b6f252151d6104a4972d9afe7b3", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141741, "uuid": "52953502-5331-49cf-92f8-a95b14c1a54a", "comment": "Malware payload", "value": "9838677f1f5b1c19202d43c46504978c4e1d0de0c191d2ec693d0c6808afb12b", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141741, "uuid": "45049179-e88f-4cd2-97a6-7b5d6133a88e", "comment": "Malware payload", "value": "843f9dc51d09d254a81d63a08ca05ecca5eecaa6", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141741, "uuid": "837c1013-7d91-464a-af46-6fa1a92feaa6", "comment": "Malware payload", "value": "0f468edd9dbf00b2dd632293695c1df3da0967c402c082a1d0aa83f316e1beedd926a01e89677ae62003390000a358c7", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141741, "uuid": "bb9bc0e3-8253-4bec-ae8b-aa2b473cc882", "value": "T10941DF5067FD4619E6730E3B1C79A2608673F985EA66CF7D0144844D6CA5700ED35F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141741, "uuid": "60965f06-31a0-4dcf-a1f8-90abd30b4940", "value": "24:8s7qJlmaXcuIWrtYUxArUPRR+0K59Rf5TmCgbCwaNAXN2lD+/E4I0aKOFqWyfm:8BmXurC0RSDRhSvaNAdIDAI4bV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141741, "uuid": "01d2b0ef-fa8a-4930-8def-824e17b71e71", "value": 2107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141741, "uuid": "10c2e188-a0b6-4102-b391-a2e441857d8a", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141741, "uuid": "7255d505-2c06-4d32-9c57-ed076572b7d5", "value": "RE-2026-4099120.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc7e1b11-6e95-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782172508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172508, "uuid": "a7b38d6e-9bf6-42ad-92cd-c90777c484be", "comment": "Malware payload", "value": "f824adf9b0ff97e64425d5d1488ca2d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172508, "uuid": "6ab733d0-db71-4583-a702-d1007eed2d50", "comment": "Malware payload", "value": "989b055516ad13b8f28ce06db256e45db0135e19b91980fae419514ea4abf8b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172508, "uuid": "527cc1a0-16f8-4de4-a2cf-cf8ad35ef312", "comment": "Malware payload", "value": "1f702e4225e3fdc5f23b3d63d87e2b4281192a59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172508, "uuid": "a9ea17d7-aec0-4ada-9b54-81373ab03e2a", "comment": "Malware payload", "value": "b57abe3ae551e4a3fe1633582c204789d1ce03d34ac8215ab6dd26d4d15d648956ee12f51ab0c93752ea5ec6458732d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172508, "uuid": "71885ebf-8979-4557-9449-d8ab225381d6", "value": "T19DC30A09BB601DBBD81FCC3749E8164235CC5A5762993B753678DB1CBB0B90B4AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172508, "uuid": "30411256-6d0c-4375-8279-c0cce99f65db", "value": "1536:KAXFkQZtZrXIqaEMDkws4hm+6Dt5I/8g2UcJGrqnhk07cQdzAa:KckCtZrX85w8/wUehlnzAa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782172508, "uuid": "3fedce48-cd5e-409d-a622-9410fdb43665", "value": 122120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782172508, "uuid": "792bfea4-e9a4-48a8-803d-ab0cce87eaf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172508, "uuid": "cd7abd57-076b-4d9c-8c7f-48cc2917ebe7", "value": "Nwk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366ba7af-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141332, "uuid": "9403adc3-59e1-4cf8-91ed-74538229b6e2", "comment": "Malware payload (RemcosRAT)", "value": "5e5ace1f35b03c7da87f903b4de6667e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141332, "uuid": "c14593e7-23e8-47df-901d-71b4b76b27a9", "comment": "Malware payload (RemcosRAT)", "value": "98d16c461d163348984b87df772e19af72ae133de38b0c97bf03838d995c9071", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141332, "uuid": "3e24bbea-b08a-411e-8907-9512ac3120c3", "comment": "Malware payload (RemcosRAT)", "value": "a2b6e07aa0a3462df23ee341f49895e36f2a0c6e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141332, "uuid": "12d24e05-42ab-4494-9021-b2331ae6613f", "comment": "Malware payload (RemcosRAT)", "value": "e1043d98680f6306e496d5fe48dc82e3250e8649a0abc274bec0db9ed94d8ee796cc1a7691850f03080b6f6a0c6061a0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141332, "uuid": "0cc9e9dc-b647-48f0-8c97-8102e7e88bb7", "value": "T1CFF46B20DE34067A4F471BA9FCA50B62CABDC609462650F1F6DA070D61069FCE3FE769", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141332, "uuid": "6a12b1e0-b361-459a-b158-9a6c4bc921db", "value": "12288:7zhD37W8XHU06KfUMZ+40tau3/y0qRdCi2AFLKZM1Kro+7ei2/:17W30d50tau9I4i2AVwfro+7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141332, "uuid": "92d6b3b7-c3db-4ce1-92c8-519fd37cfdd1", "value": 759713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141332, "uuid": "f765d072-0b27-4340-9fec-327edfbf645b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141332, "uuid": "ea313f37-0591-49ca-9e37-1cdeb15ba61d", "value": "PI0023013311_document_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d50054-6e7c-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782161845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782161845, "uuid": "6a260021-aa1d-4d82-a152-069d1fafd0c4", "comment": "Malware payload", "value": "778133df814e31efa4464748bf6a6d98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782161845, "uuid": "882cedb8-d368-4264-881d-4ab0325c7324", "comment": "Malware payload", "value": "98fd89333643151176007ebc7896e0fa844e700d7a9bb9a8ac170ddb4a5afce7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782161845, "uuid": "193e1466-96cc-4d00-8eb8-352f565ff86a", "comment": "Malware payload", "value": "8d538d005ee045015d12f8d41bfd04372b467de3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782161845, "uuid": "74c57d18-6064-4281-abb5-481832a2685d", "comment": "Malware payload", "value": "05b51ff1c4b6cc1d88dcff2c1a785f6374f885e6491d600e3db62cbe34343d5fcff86b222e6a5d982c40eef72230a116", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782161845, "uuid": "c68c4a74-7909-4a61-9be3-c01567192ca6", "value": "T167E633A9B7C109BBE8F3413C5860D961E2B175922F95D1FF0BA04A162E3B7E14E3C791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782161845, "uuid": "ae7a22fb-b8ae-48fd-94cc-f40df476e93c", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782161845, "uuid": "9753ad21-9ff4-4ad6-88b9-2242841b285a", "value": "393216:aZqm0LDOXEAphVtnIUQSg+9/iZYatUPvZ79LplF:OqzfORphDto+piZPtUvZ7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782161845, "uuid": "5c32c031-ac32-417f-8306-a2148c4f8fcc", "value": 15037946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782161845, "uuid": "fd5792b9-b4db-4329-9329-37925a16f51a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782161845, "uuid": "935bb53f-4561-4d9d-b04f-f9fd1b047485", "value": "Ethical.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b47d03b1-6e4a-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782140255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140255, "uuid": "319eedf7-08b5-4480-a789-5f23d2c70f25", "comment": "Malware payload (RemcosRAT)", "value": "22c64ea564c04e44c54779a9ebb83407", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140255, "uuid": "53f72a4f-f24b-4170-b7cf-37ac37fd57e6", "comment": "Malware payload (RemcosRAT)", "value": "99a218e5ef6b32d486a6fddfdea72a37a58f0681cf8ff4913a704b020831077b", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140255, "uuid": "f28a5621-c7fa-48e7-aa8a-741f414cab49", "comment": "Malware payload (RemcosRAT)", "value": "dd949eb805b3f13c863371f0cb2d828d129a20c3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140255, "uuid": "a4fa95f5-bb1d-4d2e-8a33-9275a4ba7cf9", "comment": "Malware payload (RemcosRAT)", "value": "17fe34833d00a567da29a27864510fe70c37ad8f45d82d364d668f491f4c55a2c239744e4f69f45d685010c432b458a0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140255, "uuid": "038f00db-c5bf-4ae8-a9cb-1d468c7f0160", "value": "T1F6F42250FB91BBB6C047F53E89D031C9601D9C2CAF1AE00F619AB75E33767A9059E28D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140255, "uuid": "9631bcd5-c997-4dad-8f83-b01fd13a7332", "value": "12288:IEcwekXheveGoJYK4UVAEcwekXheveGoJYK4UVr114jxMxGFMedzr3hY:IHt0JAUOHt0JAUh1A2xgMeLY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782140255, "uuid": "c2cc37e5-632b-4a15-b4d4-5a8cb5daf602", "value": 771072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782140255, "uuid": "873a99c0-32bd-4aec-bbfc-c1d1a4799910", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140255, "uuid": "d04b0752-1665-4b0b-83c3-594fcc9ef392", "value": "Sat\u0131nalma Sipari\u015fi Q62026-V5560001.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630288ef-6e34-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782130670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782130670, "uuid": "c6a2d48c-8340-4f58-8907-49d62277b809", "comment": "Malware payload (AgentTesla)", "value": "50f80b086aac1820defd105200518c2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782130670, "uuid": "442cf2a5-7b07-4bf1-a1a6-213b69999013", "comment": "Malware payload (AgentTesla)", "value": "99bee9c7498d8bbf660140795ad31220000a408d8234f58bed07939779ce0ed4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782130670, "uuid": "04439fad-0c0c-4d2f-9298-b745d02ca8ca", "comment": "Malware payload (AgentTesla)", "value": "b66cd7c24d5867bc26ad615d33c0123fdc0c634a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782130670, "uuid": "75b4ccef-c9d2-4f11-ba1c-e7bf6d006390", "comment": "Malware payload (AgentTesla)", "value": "26b29fc5722bc5e089e44f5fa9707ffe1695d6d68bfe444164ccadbf851271a2aaf54baf5ec3ac7b52224020a1478376", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782130670, "uuid": "54fdff60-7316-46f5-8189-b01f4c46b608", "value": "T1683501251D463B48CA7E0FB8C122145873F0D89783A6D72A2FFD51F59EA3B84CC6B952", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782130670, "uuid": "e8984ddb-184f-4e47-85e3-5e2eae1d9f1c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782130670, "uuid": "ead6d8d7-ca91-48ad-80d8-8f045c7d8f17", "value": "24576:xb2c6hIECGQ+H/JTL6CfpVobmRi/M9RTQ:xbPQiM/6CxqbmRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782130670, "uuid": "da575b05-e4ba-44b5-b2b3-33f0be3190d3", "value": 1120768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782130670, "uuid": "415417e5-d4a2-42b1-99db-37ec8b262e02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782130670, "uuid": "e9f5f667-2af1-444d-b098-1730e55e64f0", "value": "Quote-034600_500 KB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec4e732-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141669, "uuid": "65652bb6-f19c-4819-939a-7561ab98f816", "comment": "Malware payload (RemcosRAT)", "value": "b8c2c17fcd7306447c93b1af8a0fdce2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141669, "uuid": "121ad845-79fc-4c66-afcf-826402a64a1e", "comment": "Malware payload (RemcosRAT)", "value": "9a599385c43311035af6070258be344f7aa74097cfe66137c0deb50100aab5a6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141669, "uuid": "1a34b236-7477-4a98-be06-c826f9729ed6", "comment": "Malware payload (RemcosRAT)", "value": "5f43297bb8a9df032fcb3ae86c890987aa693672", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141669, "uuid": "fe95c845-3bfa-44a0-9bcb-b01500b0dd8a", "comment": "Malware payload (RemcosRAT)", "value": "1cbed006b218e8cd1099c0e5ef944e6fdaede87c280ac7d455d13bdda6d5e1ad943645b1d6ba5bbcd341706cdfce30d3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141669, "uuid": "fe3e38b9-be7f-409a-8275-257df0cad0e4", "value": "T171734A60DA5105B34F83BB9CBCA90260CAADD321953349B1F6DAC70E910D9ECE77D25B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141669, "uuid": "c37ee677-7718-4d27-95ff-c70a0962496d", "value": "1536:hGeS559dcXkAmqxAcV0PzC0unMsXpgkFXtP36+X5fOdic:hGeSD9WUAxJV0rhun7XpgstP3tXNOsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141669, "uuid": "439bfd17-f31b-4ccf-b517-d52c7057a121", "value": 76976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141669, "uuid": "daa58064-dfb8-4b6a-aecb-13b3b6bd9d87", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141669, "uuid": "2a418f13-f0e5-4974-8005-ca080bc3b026", "value": "Purchase_Order_docs(1).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afb8216b-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782141965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141965, "uuid": "fde2d7b9-3f9b-49b4-81f1-53842dca6d9e", "comment": "Malware payload (Formbook)", "value": "a57153dc425e3aedb735673f3c531305", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141965, "uuid": "c46927c1-cf60-4ba7-b05e-57b6ef6d7e12", "comment": "Malware payload (Formbook)", "value": "9a5aa62c26a2d64b18dd1b22927bc6094591e852931e71752a49e3ecad4cdb5f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141965, "uuid": "4ea3a1b2-e60c-4728-b137-181c93d0c9c4", "comment": "Malware payload (Formbook)", "value": "9be7dc29b5e34f16c6793af0597dd5bdf41c091b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141965, "uuid": "45ea2e90-a8e1-411e-9f11-4923beb08422", "comment": "Malware payload (Formbook)", "value": "ccad66a1074fdbacaa2bfa3016cd55cd9f08f531f05e9d9816424da13480e0905fb9e163b49280ec1960e80f580a0061", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141965, "uuid": "61c0335f-11c3-4dc3-8668-cc1077ed9182", "value": "T1F5164B7047246974662EC73DE037AF70584E200B167CEF2D392A9618BDA6F5B178E0E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141965, "uuid": "3c4a9df2-2d0c-4023-b709-4d2bc724b9b0", "value": "98304:ywtl+d3veKhg5h3iriGyXiEcyDzFTkeZCBAZkCgFgb2hyopNm4iKKZAQ4F0KHls1:ZtlR5hyMcUAA9b2hyopN5iKKjAoVSGvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141965, "uuid": "dcc99acf-634f-4102-8ae5-ec8a0f50c06d", "value": 4112981, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141965, "uuid": "66f4e315-2222-42da-ab99-aa1158b889a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141965, "uuid": "1fc869f8-057d-4503-8c46-6a2fb76ec282", "value": "QT LVFX RTX _ pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21cda5e4-6de5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782096630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096630, "uuid": "ac7d8622-ad4a-4bd3-8207-f7ad34139dca", "comment": "Malware payload (Mirai)", "value": "340c04ab6937d66e9147488c236183ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096630, "uuid": "d65a934c-3179-44cc-ae09-a47862362e77", "comment": "Malware payload (Mirai)", "value": "9a73e54c5aaf4ae3291fd4ae23059c5a9bfbebd4abbf794d1840362a81bfb9ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096630, "uuid": "d1a109c4-5a5e-45c0-9afd-b4bf0b509bd9", "comment": "Malware payload (Mirai)", "value": "46dc3a8244b871c3b11f19f676bb3688d335ae1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096630, "uuid": "726fc9d3-95f4-4685-a1b9-26f2a6cd00de", "comment": "Malware payload (Mirai)", "value": "7d2e7deaad1c5db22110bcfcfc9b789bb6831454df65e742fbc39d96573aac9f12e9aef74db47469999368479c7be5a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096630, "uuid": "205141e7-3f64-482f-89b9-968eb0bce83c", "value": "T170F3860A6F228F7EF269877047B78A31E75977D616E1C680F1ACD5041E602CE641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096630, "uuid": "9087f3af-ffa1-43e1-b288-dead8f227e92", "value": "3072:XATkUaFPDUSyOh6ZXfQZOi98l7M3neKCeCGfg3:QTkUMwSyOsV8Oiu6nJ1fC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782096630, "uuid": "7e4f719c-8d0a-4719-99cc-a564a6c82927", "value": 170456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782096630, "uuid": "23d42739-eaca-4da8-94f0-e97d923f916d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096630, "uuid": "7d58f2f1-2878-455e-a8a4-edef7a1b1fde", "value": "data_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3677e324-6e16-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782117710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782117710, "uuid": "6b4159ab-96b7-41b7-bb04-38805d641fab", "comment": "Malware payload (CoinMiner)", "value": "482dbba4f2559fa2ee3666e4d35e9d67", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782117710, "uuid": "e6869f75-6e55-4e09-b9b1-b8731725d9a4", "comment": "Malware payload (CoinMiner)", "value": "9b0fb92deed4eca6da96d3a1c99c2a806c47865c08ed36ea361e9d5361c09a66", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782117710, "uuid": "4f45162e-5f11-43e6-92cd-b58eb3abe0fb", "comment": "Malware payload (CoinMiner)", "value": "22d4462061e98ebe85f0815ebf11925fcd3c631c", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782117710, "uuid": "53e496a3-32d7-4d44-95a7-1689e1fe12c3", "comment": "Malware payload (CoinMiner)", "value": "e22e53641b48800934d12b02ae7debfef6a4b4f3b1e36b7b4b1bdb4d6243a54c65f9ce435844cbc9994a670e3484685c", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782117710, "uuid": "ec56b53d-d207-4218-988d-ee83c19dc8a4", "value": "T1F944F603D35744F9D86AC675CAA6D233A521B8599534BA3E2B84DF223F21F10F72DB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782117710, "uuid": "ee1a59d8-282c-42db-8a5a-66923f9289f1", "value": "8762b7d30a5eea5cd266f2a6fcc62f43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782117710, "uuid": "098ce929-455a-4c55-9cb6-27a89ef19b45", "value": "3072:9Urwe1T/9hWkwxsA1OqJLeA/SsgBmXvrVx77JQMR2/wFYcRhTI9ERy+5xSzd8waq:9gJGtdLe4vBoMR2/yuERyfSmyhfwQzC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782117710, "uuid": "847bc1e8-7e63-45f9-a2db-066cd3c56fee", "value": 274595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782117710, "uuid": "c4ff94b2-cdf9-4bc1-a674-596b750d476d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782117710, "uuid": "c7e6f57b-fd6c-4505-a8de-c62cf790c568", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1e6de9-6de4-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782096190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096190, "uuid": "c869c797-8ae1-40f4-a1f7-9d148dcdd7e8", "comment": "Malware payload (Mirai)", "value": "a8aaa95c71829fa18af3cd9799954962", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096190, "uuid": "41b63be8-5a02-4970-bdcf-7afb0c1aefca", "comment": "Malware payload (Mirai)", "value": "9bbed06deb57b262ed1a74cdb6d17ca21161163cbada6538267b6afd00e61cb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096190, "uuid": "b07d4fe9-2495-4b20-9027-4090a1eb7e3a", "comment": "Malware payload (Mirai)", "value": "2d0fe4b80d5064ed72dad730e4c26e60506517f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096190, "uuid": "3143bc5d-7873-4666-8fd0-a5c5a02c9c0d", "comment": "Malware payload (Mirai)", "value": "d65abdf0c21f67183fb026742b585d60c8f138d0e4313bbd21c86c62af16aa6aed7d75b6510e9b7c7fbed90b962629c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096190, "uuid": "28490cc7-f779-4523-bc72-c9285c50313c", "value": "T115D32A02770D0F43D1232CF02B7B5BE18799BDE119F5E584A51DBECA52B4EB22182ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096190, "uuid": "22b62317-fd5d-43c6-8b2a-e874e430cdb7", "value": "3072:h2hagMAZpx89Vzo0+P8WLQJWIn0b57+VUT:h2h1ZpxiLe8QMWIn017GUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782096190, "uuid": "7ed09bd6-e2e5-4314-a767-5bb87e599a33", "value": 133396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782096190, "uuid": "d040fb94-1a42-4bd0-95a0-dc1687bda480", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096190, "uuid": "0e3f049b-2313-4a9b-a6c1-31a3ebf79ed8", "value": "data_powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8144628f-6e52-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782143606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143606, "uuid": "12a04e2c-5a0e-4fb4-bf98-4264736a4a2e", "comment": "Malware payload", "value": "ad7087b1de9f433fa0a1c0f53cc6e741", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143606, "uuid": "62cebe52-327c-4ecc-b73d-10e091c5a32b", "comment": "Malware payload", "value": "9c64349579f754fb1878efce6c642632f65982ab255cc155e8189bdbd4071132", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143606, "uuid": "a839d8e4-fea7-461e-bfca-58b05a7dd038", "comment": "Malware payload", "value": "abe3dfa94baba469fef8a8c3e54be47b72871809", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143606, "uuid": "205d0338-d015-4d27-b266-a737b6f93d81", "comment": "Malware payload", "value": "b5b03ca4d2e84e794e2b48b075ae9aa09ff651d711e1a57871e7c06a10694ad60405552eb67b707e472dcbae880847d8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143606, "uuid": "06f16966-b6f7-4cd6-a38a-e4abba3cb306", "value": "T19AE07DD6600CC037340ACE5E33428122E4DB71A504203FE86C0BB010FA0BC9F345C54A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143606, "uuid": "78a5a91a-06dc-4711-8c88-7c92959421be", "value": "6:HWaHMi0//w4WkdOowujkKg1imQinCbRyimmimzcim5rMP/JLtcM7:HUJHwJkdOQjkdbCbnttH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782143606, "uuid": "3cffd7db-fdcb-423c-93b6-af665f642706", "value": 326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782143606, "uuid": "4457dc60-106c-48e6-9e54-dd160e38da56", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143606, "uuid": "bd8bab4f-9b51-4632-85b9-9ff77a8c0973", "value": "b.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d62516-6e25-11f1-ae13-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782124090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782124090, "uuid": "a746579b-a272-4b9c-891f-09c214615875", "comment": "Malware payload (Formbook)", "value": "12b7a66e1314a078c3ff4e6b486b1cbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782124090, "uuid": "55418f11-5382-4e6a-b548-51715be18f94", "comment": "Malware payload (Formbook)", "value": "9d16b4e2e2852fde0a55f2075f9d0a40618eaff06634d947668d5b6f586d5293", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782124090, "uuid": "d0acae50-773f-42a3-a7b1-a2fc07dd5ffb", "comment": "Malware payload (Formbook)", "value": "f006c1d8c4aa04be2bf05e8f4487f497f1ab2d20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782124090, "uuid": "a91a5728-4c4c-4f5b-be3a-99cb7368f31d", "comment": "Malware payload (Formbook)", "value": "72cf87319d367b98cb957953d7f587a65c800fe54315401d005108f06b1841a6813acc2b33cbd89afba9453757f83f47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782124090, "uuid": "2f706e9f-455a-430e-89b5-39b2aa080537", "value": "T1CE35F1586249DF02DDD60FB2C834E2F513B56DC9E812C2974EEABDDB7975B012E402A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782124090, "uuid": "f1caafa5-a2fc-4237-8698-bc1df5db0349", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782124090, "uuid": "8d77d77c-0aa1-40e1-8ea7-c3715eb6d720", "value": "24576:scjAiVoG3RBkQselU4T9j/cyKvtD17BcY6i+M5Od+kVt1wt4:VR6G3/ZsQU4T9jU1XtcJM5Ozz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782124090, "uuid": "383272e2-2cb4-4ca2-900b-55fce7e5c6a4", "value": 1127936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782124090, "uuid": "6a858315-f451-4ae4-96ff-32ad192648fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782124090, "uuid": "eb3821ec-8b44-490b-96bf-a55dfa5a37a2", "value": "Letter of Intent(LOI) Document.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0fa365-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141313, "uuid": "ad11b993-dc2f-4b53-b614-9556ff009883", "comment": "Malware payload (RemcosRAT)", "value": "f49ba26c70ee3cbfa2f07642fbcafbe2", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141313, "uuid": "3ded87e4-5f70-43ce-91a2-529530d3a7ba", "comment": "Malware payload (RemcosRAT)", "value": "9d6bcb61cb8340e7a90550120b633650370f990f67bddd191b36713d7ebca7e4", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141313, "uuid": "f2359f89-d0da-4d40-be73-21c3c8410c2e", "comment": "Malware payload (RemcosRAT)", "value": "39936edc6fa31eba38f6da275de6f06db67953f0", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141313, "uuid": "e832528a-b49c-4269-8d43-39db11aec8d4", "comment": "Malware payload (RemcosRAT)", "value": "b6c2d14bc259387f4896b89f8ab61a712fa29f1b6a78b8539eba3f3bd060ef7d9ec3b2f080558209b3ea942b92c62f37", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141313, "uuid": "83e6e400-972b-4b06-9201-dcd7198acd5e", "value": "T1C8934A30DE6407694E471BAEFC965A61C9BC8629413210F4FEEE130D500A9BCF7BE66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141313, "uuid": "a196296c-ca18-4256-9bd9-2471602f95d7", "value": "1536:ByA7aL5hqnFOK1Tl4QnQB/sAzhvxHGdhZlecvrY0URVGJUvobwB2F:Bt7aL5EOoipZzhvxHqTleyrY0URoUvoB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141313, "uuid": "936a0822-b7f9-4e21-9857-765b78ca949b", "value": 96606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141313, "uuid": "384372cb-04f1-47bd-b0d8-f55f282ffe24", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141313, "uuid": "14064f5e-5e35-4bc3-9890-79747ce9973c", "value": "Arrival Notice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be1f3f9f-6dea-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782099040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782099040, "uuid": "95f0c115-02eb-44cc-93c6-11279f72e706", "comment": "Malware payload (Mirai)", "value": "e70f8cd6f50650e5ba55e3ef22ddf504", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782099040, "uuid": "416e3e81-d38b-4ca5-908b-ef9312242770", "comment": "Malware payload (Mirai)", "value": "9d88938e65802ec240969c1a290e493fe8381c225375082785877da2b1244198", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782099040, "uuid": "030caf6f-a0c5-4c9d-b897-05a3b0b599ed", "comment": "Malware payload (Mirai)", "value": "7c7857e2deb01968fe634aa2085a820d7663e3ce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782099040, "uuid": "b6532a4a-a22d-4401-b1bb-cbc937dece29", "comment": "Malware payload (Mirai)", "value": "6e0ea9c59b53276029466168069f2e8ecdf8ca3347a0f6c42dc6ee1423206a9e987dbd510129e74f87e69ef7a919b9d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782099040, "uuid": "4efbf4b0-e290-4a67-b5c7-fc74a482aa8e", "value": "T181D2D1ADE4B441C5ED8E1C7A80DC3FA14E56E681231BDB9673218C895B33C57F16A4B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782099040, "uuid": "b9d14001-0015-4835-a05a-aaa904de2ad6", "value": "384:h8pVWtmRsLYEpB6V8S628FuRUuNJG9whQ3Cfbo6w+K95orjez0kgRWGVCz0Nvx:uMYHb62x4ahQ3CfdwLjhYWQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782099040, "uuid": "0bbc43eb-d386-4ffa-9e68-255a2b26adb0", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782099040, "uuid": "9cdb7235-4f1a-4177-9d23-913a1f9e0b13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782099040, "uuid": "84523532-4113-46ae-8a0c-0449eaa20fab", "value": "sora.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d633518f-6e80-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782163505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782163505, "uuid": "e67d0a82-5e53-4df2-89b0-6c110e211057", "comment": "Malware payload (Mirai)", "value": "e5ba60cd5bff5a07d63cba7aa5a6e894", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782163505, "uuid": "d91c7e92-0191-49b1-9404-ac3be6ef04c8", "comment": "Malware payload (Mirai)", "value": "9da6852cea10df7f4df6de996e414468501234e53eb89af1c2a238687fa62db3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782163505, "uuid": "95985ec9-4f41-4898-a43a-87cc70a76517", "comment": "Malware payload (Mirai)", "value": "1136888aa04a212880e89568a95c7c6fd080dbb1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782163505, "uuid": "41ffb4ff-8548-49a0-9dce-ff375cf87c3e", "comment": "Malware payload (Mirai)", "value": "afedba6407c1ef4727e9a6b976046968b347b57b2d9c2b8b85c1c10030a81bb1e5f2df3908b0d43704ec0c3c1b2e8979", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782163505, "uuid": "6acfa65a-47af-4d57-8447-7bba4d0b656f", "value": "T1A631A6DF41059E3E1213CDEE73A73548B10D85EB584BCBA0CD5C5DAA9A881ECB262BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782163505, "uuid": "fe4b903d-6ec8-478f-b215-91a4d6886ac2", "value": "12:Us56s77dNlqL6lqxoMO0V6/wWEm6Euy2lhg6h3SreGNai6NaP8GcATWNy6NqvVHo:dVXd7lgWz2lHD6Uj0AJU5cS5Z1q5Ys", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782163505, "uuid": "586d7dac-6a4b-4a2e-ab2d-2871ac9103c9", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782163505, "uuid": "7edb48c6-46ff-427c-8231-5bee1f8dd46a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782163505, "uuid": "7ffab2d6-21f0-43d0-bfac-94612b35c70b", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24491ed8-6e03-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782109519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109519, "uuid": "29de3d98-5fe1-4db7-91d5-b2f58100b20d", "comment": "Malware payload", "value": "7dca0f3fbdd4d81fa9798005ad551d19", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109519, "uuid": "31a4a243-2052-4786-9234-fd862372be63", "comment": "Malware payload", "value": "a12e4f17cedfcfa3d3beda12f30044c3572cd77f1c8d666d0aee3ce566cb3fbd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109519, "uuid": "d9cd498e-8678-43f6-85ea-d4c37cd9f158", "comment": "Malware payload", "value": "47d0f66da1cec34066ebdfc20ee45ca18bc838cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109519, "uuid": "b599b521-b30e-4ce4-aa1f-a00b31cc475b", "comment": "Malware payload", "value": "aef6daf8977bf63148f2d0c147835d16c89474a544ce140b9ab51fe6407cba113cbcfe82bc805033d88eec31d4fea103", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109519, "uuid": "a8eb99f0-d5bb-48ed-adf5-b453853636f5", "value": "T1F77533F5A0B95690E4BC9F6FD9B37231B937573A3C69F19B02D9819841E38701EB81E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109519, "uuid": "635f19bd-ea20-4c28-b7db-328cd209fbc8", "value": "24576:HofWKcn8AT3R8YHeqiEGElR7l2SluYuUOonh0lo+iXUFKFytd0GRSVn/rWA9njY5:Hing8IR8YHfZhlFuUOohS+kAywGUt6AS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782109519, "uuid": "8d52648c-a33e-4082-a53a-e24788d8e748", "value": 1561920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782109519, "uuid": "159dfa34-e45b-4516-9630-9b4f0d067951", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109519, "uuid": "fb798204-4089-4b40-92e4-f1fd856af824", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43483a7-6e4c-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141114, "uuid": "8a9e21e1-28a9-44c9-9c4a-ad8f4d72c07a", "comment": "Malware payload", "value": "7c1511dbc2a4d360eaa3c5281f545002", "object_relation": "md5", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "66-63-170-33", "colour": "#F283ED", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141114, "uuid": "0906f3f0-596c-4adf-a197-a48753b6e4ee", "comment": "Malware payload", "value": "a1485417b5d2c77993d32a2e90d2a824f6dc5c8fb0c86d51ee7f967831a72b15", "object_relation": "sha256", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "66-63-170-33", "colour": "#F283ED", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141114, "uuid": "63d59647-5ad2-48d5-9020-ac4d54b034f3", "comment": "Malware payload", "value": "75a9f31dfab73ce97b0b986fee877df187f5cd65", "object_relation": "sha1", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "66-63-170-33", "colour": "#F283ED", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141114, "uuid": "71a550b0-0133-404b-8c82-6b7790d05505", "comment": "Malware payload", "value": "2960b24c09fdf4c6d27f427d961aea66988c9bddb06839a74b7eceb0ae9d19826c63a61745c4a342a4a116e29cac8c1a", "object_relation": "sha3-384", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "66-63-170-33", "colour": "#F283ED", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141114, "uuid": "26cc7072-32bb-4734-9e13-3530a04159cd", "value": "T1AF12BF573ECDC929FDFA946096D1D8227D10BAA3E8E2136B5C82447B406E200AF43F33", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141114, "uuid": "cf356c60-fb67-4cac-ad14-4698051036f8", "value": "192:mMIAdIGWj2A1lYeXqBJQGI5551hjM1jJngC8eh3r4qRbFtKcVAxsWg6YP:8IZWKQqTQdVT2VnD30qxNV8sKm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141114, "uuid": "f708f69d-b23b-4054-bd08-37bc36659d49", "value": 9186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141114, "uuid": "4fdefdfa-0d5c-4459-8b46-efd1583efcc6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141114, "uuid": "7b8d17c3-55de-4061-b161-967a4598676f", "value": "New_Booking_Group_0031_pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c573047e-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782142002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142002, "uuid": "7bf509a0-39af-4acf-8a90-cf8309e20e43", "comment": "Malware payload (AgentTesla)", "value": "52283334b1ad69f0a390de4c107dacc3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142002, "uuid": "1d7075bb-8513-4bcf-a96f-41cbc1cd7bcc", "comment": "Malware payload (AgentTesla)", "value": "a16287ca396038136cc63470d0e86edf10f8f2d4946fdb84fb03c6bd978735b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142002, "uuid": "5fe2b09f-881e-494c-9cf0-baac119ecb2a", "comment": "Malware payload (AgentTesla)", "value": "a33701a2db06030b7384d7ed21fbf420cf191fa2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142002, "uuid": "75d84e59-a8d1-4712-b381-f4d5f1e6ce8a", "comment": "Malware payload (AgentTesla)", "value": "9c4873e6a342726fad883a96da4b332bfd568b1ca445afdddb27d5a3a63195c7b72359fffd7ca435838b7ee712f67ea3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142002, "uuid": "c7d01e4d-c3f9-4b63-b523-b47e25442db3", "value": "T1D8062A409B209175E66DCB3DE037DFB0494E202355ABCF4E3429D318794AF8B17AA9E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142002, "uuid": "4362e53a-8ed9-4ba2-b762-44b25dfc443f", "value": "98304:MjFYF4r7z37eD6a15Dy2Vu9SUJhbXqQavfUiK96S+E4rSRbLeulZSl3ziFJ1HiA:t63my50duE8CA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782142002, "uuid": "8b2e80be-749b-4634-86f5-838f7c5312f5", "value": 3779760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782142002, "uuid": "df91efec-c3e0-4b71-b8fb-0f7cfbbc79a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142002, "uuid": "1075dd11-049b-48a1-9ade-d74120cd6ea3", "value": "doc000621026006.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00f509c-6ddc-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782093057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782093057, "uuid": "f68637e4-4cae-4311-9cc6-6dd6b16aab44", "comment": "Malware payload", "value": "cdec09e16d03e834d877346f8ebebb8a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782093057, "uuid": "bcff4aac-85a6-4665-97da-eb716e3af4f3", "comment": "Malware payload", "value": "a1c6e89e932a2d62b1b2bd848b96e8873d78f324dbfaaca5a2f93d218b47d12f", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782093057, "uuid": "dfe8d275-8358-41da-868d-e419b20d637d", "comment": "Malware payload", "value": "e94268390a6afe537614d59f86e8c95b7b459051", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782093057, "uuid": "0886986b-06b8-4204-b48c-1a35be733ab1", "comment": "Malware payload", "value": "055bf13c0906fecf8c229c593a5e76ce7d72294e021fcae2466c7f4ee903367815b793f6382c6a4d882a9cb91bb5c263", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782093057, "uuid": "b1091ee3-fd36-4b6f-9c42-2415089ea74d", "value": "T17031230F12E4C019D6D247B64E3939847DAFC2C78730D9C6322EF1298E5A4938EF65D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782093057, "uuid": "4cee250d-e3fc-423d-9eb0-bed741c88392", "value": "48:F88X7k9mD7w47xpO+1S2DqTD5+1y2D5dX:F88X7kWc4j2fmzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782093057, "uuid": "abf6dfc5-f8cb-4bc2-a8d8-87a7a7dceaa6", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782093057, "uuid": "99c18862-9376-4358-a67c-d45e8eb53d00", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782093057, "uuid": "bbbdbab3-acaa-4df9-b4be-89dd66247da6", "value": "Setup.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353bcaaf-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1782141330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141330, "uuid": "c0e6eca6-3c01-43dc-afa2-baf4fb2dfc6d", "comment": "Malware payload (PhantomStealer)", "value": "a5ab4b95d2971f43d04cee8c1883ce02", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141330, "uuid": "cd057c40-7155-48b4-863c-2a4cb43c1e87", "comment": "Malware payload (PhantomStealer)", "value": "a262e8a7186a294967030959d0a1debd5e34d4ab20046abeaaefaa9696567df3", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141330, "uuid": "8fff1c8f-8472-46b0-878f-d7435ca7f22c", "comment": "Malware payload (PhantomStealer)", "value": "a0f603345d05f4f35bc3c094384b60253839f5a9", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141330, "uuid": "9bf45611-f466-4434-9389-4990693a6ccc", "comment": "Malware payload (PhantomStealer)", "value": "4953771a3963464e91c11248cd9e75ee8020daee1129511e14453eaa68a05cf84ac1337a0e8c5a2cabe15cc0a5aa53ec", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141330, "uuid": "3ab835b6-a5a0-4f55-8a74-60761b0a9fa5", "value": "T14263744562E0FC8D43F75BFB362F71D5F4DA08DA6984880BE601F8A4F5A5A09EED1630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141330, "uuid": "49658058-a022-4f0e-82bd-910f97e9db2f", "value": "1536:4qmw1DE+lleSNIpx/kalFLDJt77ndL/CT9:4qmw1DE+lcnt9NO9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141330, "uuid": "e10ffe15-5573-4bf0-b88b-d950152369bb", "value": 73025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141330, "uuid": "3819f394-3d25-4ede-a032-97a6242b7971", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141330, "uuid": "0e8d14bd-0b7a-47fc-9b96-3736c0350f0e", "value": "TLP-AC\u0130L RULMAN TEKL\u0130F FORMU HK..xls.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e66e4e2-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141400, "uuid": "6409a0a8-a044-4a75-9c27-962a6a480048", "comment": "Malware payload (RemcosRAT)", "value": "78cf155370dc240fdb3329d86bdd6dd6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141400, "uuid": "3c1702cf-f85f-47bd-ad5b-81614344f180", "comment": "Malware payload (RemcosRAT)", "value": "a287e0ef9c97ea4ec7bb033c2c52076bd370270ae51288924b751ecbf7dd29ba", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141400, "uuid": "1db1cf1f-f90d-42d2-892d-1de4dceb5303", "comment": "Malware payload (RemcosRAT)", "value": "aab4af6fd626f537980b50a063d8e669ddc644c0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141400, "uuid": "eacb3a88-aa4a-4b23-8390-17cd9ccc253c", "comment": "Malware payload (RemcosRAT)", "value": "b4c3238c648bdfee1e6e786c6218ad0074d4d91808b7f1ce68680f69491d4880b7e957d8b68c1f605861fd9dbd2cc3b3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141400, "uuid": "630541cc-bdfa-4a82-b3c6-bd033a56a56a", "value": "T118C5121765E72D888DA07F886D64C1C4CFA84B0F9BCB9307767EE181AAB5C05CA5DF24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141400, "uuid": "26e267b1-0762-43c7-9c1a-e046613ac076", "value": "3072:8tcDDiKHvqNCoHN13A4W5pSQ+njTSd8kzQwCk6jhdxEJp50Xy9uK1ig/r:3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141400, "uuid": "b18223d4-d8f2-4269-b302-07707352bf3a", "value": 2601814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141400, "uuid": "c41a98d1-c6e0-455e-b079-7e85cd7fdb79", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141400, "uuid": "69af1b88-2187-45ea-b182-3942d35f33c1", "value": "BOQ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9588d0ac-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782115293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115293, "uuid": "107263e9-4da0-4e2b-b8be-16c7b45db51b", "comment": "Malware payload (RemusStealer)", "value": "6a00edc93f4bd49d200b2fc49e4f63d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115293, "uuid": "3f15729a-6051-465b-b6e1-02ad418fb4a6", "comment": "Malware payload (RemusStealer)", "value": "a2df0c26bf1a5292ce5d4a2f2a41397478090da65f80d10902be6ef2c6b50faf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115293, "uuid": "2cf07a05-080b-4a75-b60e-9e585d02f752", "comment": "Malware payload (RemusStealer)", "value": "a5409cda948810edc3535521c0edb51bbffa1823", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115293, "uuid": "2b5dfc39-f5f2-46f7-bb25-5758cac1ff7e", "comment": "Malware payload (RemusStealer)", "value": "376c9eb5d579e4a1b58c59e94e6436cae5d443c684a70e46dfdc3df39cd9b5bb04a529c1fc6e23c6f0b911786df65e72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115293, "uuid": "b9584320-f6a4-455c-9e3e-4dc1ac9ff9db", "value": "T1C7C55A07FC9109EAC09AA33189B29296BB35BC491F3223D73E90B7782E776D05D39754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115293, "uuid": "97103ed2-1634-4827-810c-6928764c42c6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115293, "uuid": "7005f5fc-0ce6-44eb-b994-4e9ea231839c", "value": "24576:xgpFcMX+j6rr0eZmwAtIRUmSVlrADYubAIC++2ewGbyvA2Bele5IK2mlaceDczSg:xgpCcm6zZJA+RWFB78j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115293, "uuid": "b96ea9fa-0999-418a-be13-e08279770e9f", "value": 2585960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115293, "uuid": "38ca85da-d4df-4cad-b09a-a718c9f7f5fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115293, "uuid": "6f9a454e-7372-4f72-9e30-e4b6d52ba02a", "value": "6a00edc93f4bd49d200b2fc49e4f63d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb33d46-6e47-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782138739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138739, "uuid": "12dc3804-7d6a-4ee6-9209-5c70c86e4ba5", "comment": "Malware payload", "value": "0b2deab99584acf6fecf1dbdc3dcae8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138739, "uuid": "14e10e70-6dfe-4a4c-9424-b13d34eb9d31", "comment": "Malware payload", "value": "a30e92239077cdd1e016ecb91c682a92c59a22c8d18836cc3d3761ee4e0279f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138739, "uuid": "87b343c6-f620-4919-bdbf-0a24f37ce9a2", "comment": "Malware payload", "value": "7d92885fea4a89902d31039ffa0f31c558413393", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138739, "uuid": "f9544b31-c3af-480f-861a-db66de8337d4", "comment": "Malware payload", "value": "6f369e3257942e1571be300ac3df8bdf07943754c03c395cf489e49c0fd9e9435f7b646c92f3ecd889d7383fd782f431", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138739, "uuid": "d01794d8-859d-4279-938b-bb4bd3f63274", "value": "T1B725099C3F91DC69FB6708BAEF9E5055046F2FD80E2F54CB9A903B98C274EC95C11A12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138739, "uuid": "7b629a37-fcac-4f62-83c9-d6ea4c198bb8", "value": "fba9a06cd911d183f0aec1159c439b07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138739, "uuid": "d90e7727-96b1-45a0-bb66-2ab67b420718", "value": "12288:Bd5xfkuu74Nhsiq3hr5wL+cXYnb8jFEt3X:074nsB3hW+vboFM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782138739, "uuid": "1e07e6fe-6d23-4c46-bf03-169bc1a1b0ff", "value": 998264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782138739, "uuid": "74728804-33f7-4d99-8cb7-c0abf28a9a22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138739, "uuid": "51f31e50-1d01-4683-9a51-cfe205e336b9", "value": "ParalivesTrainer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4136a1de-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782141351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141351, "uuid": "14ff3d45-1537-4946-8c4d-2717c1d69165", "comment": "Malware payload (Vidar)", "value": "c0f539f5c7b3b42359d1c56d864bfe7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141351, "uuid": "24d039ee-86a9-4b00-a469-ce8eefcac87c", "comment": "Malware payload (Vidar)", "value": "a38e30fc95d2a59e32e381c5c36d7f3a8e874e53fb3f5c6e6ba5ea09fa0fe2a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141351, "uuid": "283660ff-fea2-4142-86d4-103cb252b172", "comment": "Malware payload (Vidar)", "value": "390c2fd4ff2ffa07cab321eecf9623ec0625b00f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141351, "uuid": "09f1d79b-c4ab-417c-8b77-ed8891ab9bfb", "comment": "Malware payload (Vidar)", "value": "952da9242ab046ab64b7c4639ad0e0f5d4e7457de52a0729dfca2ec48b3602a58657068c210d00b18bb5ba2a99b0e522", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141351, "uuid": "b6f4c6a6-7d0b-45d4-b66e-d0a07a87c910", "value": "T1AFF58D07FCD506E9C05AA23288B79285B775BC081B3167DB2AA0B7792F737D06D36724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141351, "uuid": "e676d888-4eac-4dac-88ec-11f07a59be96", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141351, "uuid": "4b33e77a-35c3-4cdd-b9df-995cdde4d71c", "value": "49152:ltuPDBYu5mzKznz0SCohH7j6wkw04SVWqZE+j:lCFISb9j2DWqPj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141351, "uuid": "96e7ce67-0829-4022-83a3-98dd1857573b", "value": 3398000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141351, "uuid": "afcc80d5-992c-4c1e-82fd-9635d2f7ffbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141351, "uuid": "976fa6df-a9b8-4daa-9725-2ea663b69bd9", "value": "fps boost fix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e068898-6de4-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782096329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096329, "uuid": "20f62b6a-b631-4f8d-9525-56e519bf4a8f", "comment": "Malware payload (Mirai)", "value": "a4f2c59ced19e9a2ae4868be4aabc945", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096329, "uuid": "2ddd09f9-6091-45ae-b750-d0de960e4ffe", "comment": "Malware payload (Mirai)", "value": "a3cb43a29e0f181f1145426e70fccdce8e04ce82c667ab0861426f31670e75a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096329, "uuid": "e3c776ee-e01c-45b9-a7b1-fa70bf67e059", "comment": "Malware payload (Mirai)", "value": "6ba0f101b6bc7293221ad9cce2eac1ecbc627ffa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096329, "uuid": "b2491a84-6365-48b5-a775-6a0836f911ca", "comment": "Malware payload (Mirai)", "value": "3b62e766f79f4587c0b9d6413429a9011f6e63d6d1d1f1d8e1a7c232b5312db2a4f72e460172c41f64e844638f7f9b5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096329, "uuid": "34802957-a8a1-4804-9b7e-d94255f66b05", "value": "T1D6242C4377324FA0D326D2724BB38F5A59EB11D12EE288D5935CCB143A207A9685FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096329, "uuid": "8b567e1b-34b0-4ec1-97e4-ec8034d9f0b4", "value": "3072:bktAgn6ojH+ZfFpcE7YX7Oj5/tVth0zbm374xKsyT9lEKYIhpDZAg:AHJD+ZfLN/zth0/e44h93YI7ZAg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782096329, "uuid": "95928111-f432-4bb5-8182-c5738679c4ed", "value": 213316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782096329, "uuid": "f15a7825-380d-4776-8f5b-93e4b2252beb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096329, "uuid": "f340d74e-286b-472a-a826-a02596c8c603", "value": "data_mips-uclibc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab21d57d-6e7d-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782162144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782162144, "uuid": "4cff2883-e299-465d-b061-77ba45d51331", "comment": "Malware payload", "value": "880507028ea06e65a1389029501f96bd", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782162144, "uuid": "88a78916-5a97-4046-9a0f-38fb894b37c3", "comment": "Malware payload", "value": "a40f66c543f340408cee4383df78c27c8f0160b00e676684cf9e01b720115729", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782162144, "uuid": "e170dbcd-f65c-4c69-869b-390d1ec61f12", "comment": "Malware payload", "value": "316168dd6bf82f48656d85dbcfa510cc324a7f9d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782162144, "uuid": "a44591c9-573c-42aa-bbab-a62c473e51ca", "comment": "Malware payload", "value": "74211265eddd4b6929387c7e77f4e8547de093133f6883007ffe9b485d9a6ab9911078c1eddb118f9d9433133cd62585", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782162144, "uuid": "2bc40fc8-39b5-4efc-8122-b538067565df", "value": "T106E533427FCE7CB94FAA972872EB7E5C0AB12D50F44E9DDB46E171C34A24B80435E909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782162144, "uuid": "386673f6-a1a7-48c2-b247-15357a38eabe", "value": "49152:0RsCLfA+4tk3eMlkHbsqhQw5gl6RZRhA6cpBmKK:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782162144, "uuid": "91c49c16-a0fa-4655-a6f0-67c209ac0176", "value": 3173640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782162144, "uuid": "32e1e854-beac-4269-a17c-b442277f5e3d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782162144, "uuid": "8cb040ec-db12-4ecb-b1f1-c542b0618e8e", "value": "ps_N7VRhJMzBHGc_1782142116447.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b43ef1-6e0c-11f1-ae13-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782113706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113706, "uuid": "05f46894-0b48-4ae3-9288-2822509f1cce", "comment": "Malware payload (NanoCore)", "value": "4b9dda8347383b785cbedba3c0a78e09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113706, "uuid": "cbac19ca-e2f7-40a5-a3fd-b45ae885e26a", "comment": "Malware payload (NanoCore)", "value": "a41acf294032b38643e10298f66ef056bdcc41f02545f4e71ec20463450d9def", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113706, "uuid": "3cb7842c-545b-49ce-962c-0300d4d9aa26", "comment": "Malware payload (NanoCore)", "value": "7294118a8bb12b512948399c7478109d9c7373cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113706, "uuid": "5798e2c4-da00-4d06-b33c-ab0c84526aa7", "comment": "Malware payload (NanoCore)", "value": "a31721724b8e74c8ae933d3d7691746432237a5dd13f6c1efaca5837571529f8cfbc69e6ce60f3e1020497466ba48aa5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113706, "uuid": "1b8c6e8a-141b-464a-9ad5-0ed10d90f798", "value": "T10D14CF167BB84A3EE2DE8679612202179378C2E3EDC3F3DA68D454B75B267E406071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113706, "uuid": "be2a2199-2349-475c-9862-903f9f69aa6e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113706, "uuid": "72abb710-dbfc-43cb-a897-83cf5e132718", "value": "6144:MLV6Bta6dtJmakIM5ZplNzULgm7SB7e+/D:MLV6Btpmkezcb87eyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782113706, "uuid": "c9857c9d-8adb-4d73-9500-95cc1db71138", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782113706, "uuid": "96588cb7-e413-4a91-b391-2c373a45775f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113706, "uuid": "f1cc9684-6898-4086-afff-25d6ab4cdff3", "value": "kem.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "894ec79a-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782115272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115272, "uuid": "a3827040-21e6-4b2a-8207-fdb7a17ad611", "comment": "Malware payload (RemusStealer)", "value": "50d5cbf38b67eab98eca1e7cdc81b72e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115272, "uuid": "73bae1e4-5b9e-4b2e-8f54-179f8220d892", "comment": "Malware payload (RemusStealer)", "value": "a44ec3a4e3c5a2076d2bcf75bebd01f2e596bdca44dbfec85ebfb933b7a8d865", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115272, "uuid": "aca36cb7-ebe9-4ce8-9c68-b8027731589f", "comment": "Malware payload (RemusStealer)", "value": "0250f7c5d1938db42b4b0424c90da0bb4aa2a046", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115272, "uuid": "eccc21b6-e744-477f-ad10-b3658ceafbf1", "comment": "Malware payload (RemusStealer)", "value": "c7ddcbd9bc038123916d6093c8f70a17bc4b4ad833ab0ea0793ed674adbba567964c10418df054ed07083f55920aa173", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115272, "uuid": "fa949bab-da3f-4c9c-b787-ac9645962f77", "value": "T19DC54A03ECA209E9C0AA633189B79296BB35BC491F3223D72E90B7782F767D05D35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115272, "uuid": "d125cf57-4445-4c41-b828-174ebd9d1baf", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115272, "uuid": "215b2407-0d58-4054-b7f1-9bf02a9c2af5", "value": "24576:GcSRpdqGHTWoMqZK+0WdAwls629LU4aqz3YeRvA2Bele5IK2ml4rdDJ+iSdfuunQ:GcSRjryoMx+JeZ7fz3a8isiH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115272, "uuid": "500a8a90-4b5e-41c3-b78b-6d1fdb224e8e", "value": 2566536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115272, "uuid": "5dcef80d-ecf4-491e-9e1c-82ef1b054866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115272, "uuid": "0a3caa0a-09c4-4c8d-90ea-5226dd16508b", "value": "50d5cbf38b67eab98eca1e7cdc81b72e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50de91d-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141599, "uuid": "65c6f662-8ef9-4200-b7ed-dc46aa8760af", "comment": "Malware payload", "value": "772b6e97fd281ac5cbebb7d17290749a", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141599, "uuid": "6ddc5763-24d0-4097-b660-25a533e7c2a3", "comment": "Malware payload", "value": "a45d0404cd63fced58f58996a2c87c47ef367ffc9a31de0d55c44d05efb017c5", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141599, "uuid": "325209a9-5433-4a86-b025-6e14d04e562e", "comment": "Malware payload", "value": "ca245d8e40f4b7e55634504560cb5e0a99705fbe", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141599, "uuid": "c1c0bde8-2273-438d-8ba8-e83847414645", "comment": "Malware payload", "value": "c489ed7285fed861dd02cd96a4fbacfec5d02f3e82523ca8937c013292ca4f6cabaf7aedb040ad1a78e1b5e4a45a63ca", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141599, "uuid": "b8da9a77-e2c2-4a96-9e5f-1ba60df96cdf", "value": "T1BDF55D405B18A4B07A2ED73CD537BFB4458E20072198DF2E79795258B792E1B2B8E4F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141599, "uuid": "a5c9d819-380c-44d3-9cc4-7f73ce7e0807", "value": "98304:JvDihHnuRLIKWo4Act4Ya1qjZPBqDpGAAlD5QKwH5HRp4oF4:JLEH0LAow+YdjLqIn4NpJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141599, "uuid": "26d391cf-14b7-4e22-bbbf-3c847010d83f", "value": 3461945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141599, "uuid": "bcba4599-5336-4916-84b3-72f6ed78e984", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141599, "uuid": "49301a18-4904-40d6-9571-9c64877873ba", "value": "copia de transferencia.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c28ff1-6e08-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782111691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111691, "uuid": "efe794dc-9f63-4353-9bbd-2d282ba307fd", "comment": "Malware payload", "value": "67a9057b37933be5abce9c8e6e693501", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111691, "uuid": "f0f92b2d-9504-423d-bd87-7f60698a1724", "comment": "Malware payload", "value": "a4c5bf5fb69305f74d40eef41f9ecad3edb94501556fad8e27426b43e300f71d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111691, "uuid": "2cc76f13-6863-4c51-84cb-cff5c5c42762", "comment": "Malware payload", "value": "b36adb2fad72270aad88d30aae1565dee1409648", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111691, "uuid": "d10ef54c-2eaa-420f-ba91-69a5d800d092", "comment": "Malware payload", "value": "3a3b8bd56acedaec753c79e53c17a4c8648f4177b071c3009561a5cc9476869409d89eab6b283aa6610d493a874483d0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111691, "uuid": "49bca53b-9a9c-4856-85eb-d2c35053404c", "value": "T187318D9B15002A395617CACE73B33149A05CD1EF1DABD794EC4C4EEA828E5CC7662FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111691, "uuid": "48b54031-6c46-4c3f-b3f5-77277e7afb66", "value": "12:UF6oiuGLXjs1L6s1OVbj0Db6c0N76NZflcI6ccHEK7X63Q6ZC8/aZx6Z5pBSZSaA:Uu8BysckVycHBSZSaSMl5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782111691, "uuid": "a1239df5-9144-45a7-8100-714c243a25f0", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782111691, "uuid": "0b0e0a7d-232b-4da9-af36-ac693544ba3f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111691, "uuid": "d663f76e-24c4-4d8c-bcf4-01b8f49b0d56", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750aaf34-6df5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782103642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103642, "uuid": "9bf52df4-ac3c-4005-bb65-78fae6d88d31", "comment": "Malware payload (Mirai)", "value": "d7f59ae704fb7ac9118024b31ebc5309", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103642, "uuid": "66dd1a8d-03ab-4281-ab34-b88d70cd3c31", "comment": "Malware payload (Mirai)", "value": "a4e9e03516d572e9b0f3238e7693b2fe69358f4b7cbe545adbe56f0397726df4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103642, "uuid": "72683284-6880-4f9a-9995-1d5018b020d2", "comment": "Malware payload (Mirai)", "value": "b0995dd30c44aa4f54c631b8f089616d9ade0893", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103642, "uuid": "74fe529e-a03a-4dd4-91e2-794bb6bb05b8", "comment": "Malware payload (Mirai)", "value": "8ec86873659ad5a7568987b522c335f00c011ac15d3815f45bbdd6c915abd3e9f22797089e62d68d6e1ecd1be5ad8167", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103642, "uuid": "08e55e07-8f6c-46e2-8756-748888602850", "value": "T1CBD32A46B9425A12D5D732FAFAAE408933137F79E3FA7102DD205F5023C9A9B0E77612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103642, "uuid": "2ea715fc-0f63-4d47-a80e-d2d3634da9c9", "value": "3072:U0+3mS15aqVxO4nnPfGxKKEd/gUBzaVYScU04lElEfMKV0KebCoC:3S1RbnPexKKEhg+zaVYScU/ElEr0XeoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782103642, "uuid": "78668f8c-5c71-49db-adf7-d4adb103d9a8", "value": 135524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782103642, "uuid": "05dc4a97-e91d-4749-aa75-14394d5427a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103642, "uuid": "7bad014d-8389-4cec-a9f8-69c9867c7734", "value": "nerv.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b562d2dd-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141975, "uuid": "e6180947-7795-4e96-9e8c-85630353b243", "comment": "Malware payload", "value": "37a655a89c5144c83a4bdda9a7099d7d", "object_relation": "md5", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "66-63-170-33", "colour": "#F283ED", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141975, "uuid": "ceeae39b-010f-481d-82cb-0bf088ef8652", "comment": "Malware payload", "value": "a52c39a1d9cfe2838b8a817cbcbe34cd710c26f9a37bed95cfa567c152a88a3b", "object_relation": "sha256", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "66-63-170-33", "colour": "#F283ED", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141975, "uuid": "ccd41905-5b40-4e2f-bcb1-07f9ba2f565d", "comment": "Malware payload", "value": "5b6f8107574ff29c6caaaa5161c21a93de6757ba", "object_relation": "sha1", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "66-63-170-33", "colour": "#F283ED", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141975, "uuid": "c61f7f6c-78b9-4add-b855-8d26b676a55b", "comment": "Malware payload", "value": "46ce73dbe682fdaac84cd2bf84cf8e395118cdbe6e2e6f85b612130a9b397a78e2df1a2f9445bdeadbb7356f193d053a", "object_relation": "sha3-384", "Tag": [ { "name": "216-9-224-48", "colour": "#E0A4E8", "exportable": true, "hide_tag": false }, { "name": "66-63-170-33", "colour": "#F283ED", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "stego", "colour": "#5A8280", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141975, "uuid": "d10f72d8-c1db-4150-bc4c-9fe0e6f3ac5b", "value": "T1AA263343C93AA8D6ECBE269392436DC81916539A6B25F95F0CD8F78178216F47B3D330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141975, "uuid": "99b19454-d9e4-4ce1-8439-0198cf5d5f2d", "value": "98304:gUh4I/PQVZv/WLOmsjOjh5hM2hTZ8IYr02NN845HAXAVb:/4I3s6AOjhI2h+YSDb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141975, "uuid": "c926a58c-2d35-4cb5-9763-a29b6c67733d", "value": 4647870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141975, "uuid": "f6c04f7c-c529-4eed-b89e-6d996df4b65b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141975, "uuid": "1d62ee88-e237-4629-8242-9830219e8230", "value": "1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0360bb7-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141993, "uuid": "31a8dc24-d7e7-4d91-a9f2-76611cf61ae4", "comment": "Malware payload (AgentTesla)", "value": "236f505f9c2a9a3f779a87da93ddc0b4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141993, "uuid": "9fe539a0-6645-4eca-8425-894b1610e09c", "comment": "Malware payload (AgentTesla)", "value": "a52d3a7d53a18ad4a2330e0116fc6f6de453b6d210d6aaeae809a4dc1f73add1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141993, "uuid": "f6fe508f-a2d1-44cc-a047-18272cfb4fae", "comment": "Malware payload (AgentTesla)", "value": "cc69490ec1ccbe87a96c7a17912f3653b2fe1c88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141993, "uuid": "bbae0e94-7ec7-40a6-8916-a0b1bc35bd7a", "comment": "Malware payload (AgentTesla)", "value": "67eaae9cfa2574caf8eed71c4c640148079e50a59ff761a61e1a9dd2e4b86c29d84156cb5e66356e40de468ab6ea4bbc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DEU", "colour": "#5920A4", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141993, "uuid": "0e8f4edb-568e-490c-9a28-27220b2fdbf5", "value": "T17DF55C509428A8B4BD3EC33CE0377FA0465E350B2119EE2E36795658A6D3F472A9D4F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141993, "uuid": "c3b370e8-88f4-464e-b0cb-16bc54af63e2", "value": "98304:gBD1mGuJvQdq57MhAdRhWgxgjhMm9mtIJH1mO+PbcOuu9I:gBD1jXUeFgQOuui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141993, "uuid": "7bdffb41-e665-4aec-9b79-9c068ad2398a", "value": 3321761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141993, "uuid": "b193182e-8c3a-4a1d-a64b-639cf6cddd3c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141993, "uuid": "e186cbec-baff-4ad5-a820-933b763f8022", "value": "Zahlungsnachweis.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11c8790e-6de6-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782097033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097033, "uuid": "1e61b0e0-2925-4508-815e-8f4d1f35a22d", "comment": "Malware payload (Mirai)", "value": "d825cbe08ea10150385fe97f1e95779b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097033, "uuid": "00e75661-b604-4760-9ad5-413d6221391b", "comment": "Malware payload (Mirai)", "value": "a558714eb3c35a8f99c7991292f45b3edf3af2e08c151b6f74afb0691c189851", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097033, "uuid": "c4fbf0d3-c77d-4b51-a0b7-ea2cc6f71752", "comment": "Malware payload (Mirai)", "value": "8d7f1ad5f017d81502cc7afa8d0e1b4b92b90494", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097033, "uuid": "4553ca4f-1af2-442f-958b-c20466b84a13", "comment": "Malware payload (Mirai)", "value": "51b94386efc6376961e370ad7bf0eff8915bd642a43a5156b0bd92572ed0bd4184c4fea2dad71ba3de46a313288b3866", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097033, "uuid": "6985da09-413e-4eb4-a76a-6e23c3b915b2", "value": "T14C844A92F1A22CFCD952C930825D6223E63434594311AEFB27C8EF753956AD0AF3EB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097033, "uuid": "b79e6d3b-dc7e-452e-a3c2-0b9cb1ec4ba9", "value": "12288:3Dr/gekdnXYMKVNywDZQY0sHLOMI4PHfQX:f/gvEFiY0sXhHfQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782097033, "uuid": "79e5791f-8c1a-4ea0-a09f-bce7ecc598dc", "value": 404384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782097033, "uuid": "6eeffc0f-b98d-4e39-bf0c-57be31f9d26c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097033, "uuid": "d889c91a-d013-4646-b906-6d6a6b91f31b", "value": "data_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d562353-6e48-11f1-ae13-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1782139116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139116, "uuid": "51ca8afc-8f1f-4510-9dac-9c56f447d0c0", "comment": "Malware payload (AsyncRAT)", "value": "38028d442b37bb94fc3465818404a629", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139116, "uuid": "8d45e3bc-80d4-4d6c-99f7-83c3809b0bba", "comment": "Malware payload (AsyncRAT)", "value": "a61c493ca9a11e4e5144137f975f39f72e15adf73e8e010fdd9b56964ada0b3f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139116, "uuid": "6ff35a71-4345-4ac2-8a8a-0a7fedaa6684", "comment": "Malware payload (AsyncRAT)", "value": "9ee309a1191fa60dc2abb889f893156b7d104153", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139116, "uuid": "e9a5eb09-75c8-473d-8b6f-3ac7b7882334", "comment": "Malware payload (AsyncRAT)", "value": "d1ecc0a53270f97889dd4f24a10450935cc5badf9efb4ee818988619385160c4cdb2c88de48ea74ebc1f2c2582a0540c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139116, "uuid": "9cf5a566-b55b-49c9-a883-6d904dc30940", "value": "T19784D0212FC07980478B563E7A7B72DAF5550C8EB984084AE722FC41FAB5B05ED9F670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139116, "uuid": "4d7fd0ed-ab96-4333-90e2-1602d376f49f", "value": "12288:y/ugPBLtCvig/QK9QiAmuwcAxcmrdpqjW4JHp:y/TMiKJOVASmr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782139116, "uuid": "d365b02a-3d68-4a7d-9353-2a0d7ed6a11a", "value": 397939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782139116, "uuid": "d9a07907-6a87-4e3e-b9e1-29dd3f46060d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139116, "uuid": "8f494f63-10e3-461c-891b-7cf076b0b24d", "value": "Yeni Talep Duco_Nq.DD.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c10631-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141734, "uuid": "a96efdb5-c14b-4e30-beb4-c596348813c7", "comment": "Malware payload", "value": "783b850bb684b0299f98d72b8ce8f528", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141734, "uuid": "bf2b7481-536a-47db-9a73-b89bbe3292be", "comment": "Malware payload", "value": "a685f5dfd7be0e49e9289fd7d80db57b2f7731bfe43f51258f320ee80c100b51", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141734, "uuid": "9a13152b-c93d-4031-a76a-ccae3902a3a6", "comment": "Malware payload", "value": "b8eafcf3d0b488918201c179fd58a3edd3fd6d19", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141734, "uuid": "692ba7a4-aaf4-4380-8a35-7ac211cbb4d2", "comment": "Malware payload", "value": "125ca7d1f88763d75acf10cdb6ba6816a6db509923f768756f7faa0da876a55b2b389caf6b36713d657c59384158d6b1", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141734, "uuid": "eac9bfc3-62ac-40ef-ae09-29d97c3bda00", "value": "T1D0515B147FF61321F3B2AEB998B95351A8777996EE318B0D006107491463F41DD72F2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141734, "uuid": "4b2b02c4-bb5c-4562-bfa7-b3ebe2d12a21", "value": "48:8NxoZFM4oKElU3izfjoyJ+NzYoPQJe2qdUkZm:8NxgFMcH3izVJ6zdQJes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141734, "uuid": "f3651d62-3cfa-41a8-9d62-3d0783f1f17c", "value": 2954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141734, "uuid": "34c3405b-9b90-43a9-a6d9-7c45acb16703", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141734, "uuid": "897192dd-1acf-4b31-8541-0a22fd631b80", "value": "ProfitInvext_CRM_API_Credentials.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de9a0e1c-6e85-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782165666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165666, "uuid": "3eaf1fa4-0ba7-4354-9e33-5a2df8b996b1", "comment": "Malware payload (Mirai)", "value": "fbe8baac207279f18fd87b391219c05f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165666, "uuid": "24318b19-ad79-4864-9c44-f49e968d92c7", "comment": "Malware payload (Mirai)", "value": "a7c6915d8d515508a0c4910ef12a8a2ef28eca88063f1beaf5e8013c44c9b60b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165666, "uuid": "f6b6b703-f4fb-4f52-81ff-cc676dafc820", "comment": "Malware payload (Mirai)", "value": "0178ab8a76b51b08fbcda3f3cafe7e98705a492c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165666, "uuid": "b4bc628b-a143-498f-8b0a-3dd288ffec5c", "comment": "Malware payload (Mirai)", "value": "fbcbf4dd0d1c88a2748ad71185767b370a50908cf292142a970f86a3af346ced14c8dfd8765c066a1c22dab3b879340e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782165666, "uuid": "1b0381b4-b905-4192-afc9-b2c38c5296ac", "value": "T14CF31985FD915B16C6C622BBFB5E42CD372717B8D2EA32038E255B24378B86B0E37541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782165666, "uuid": "eec717ab-92e8-4720-b09c-30b48d2a3a55", "value": "3072:lS75TJfvSCU+8UEjWflP9sWTlU4onutEYOoHfxo:075TJfvSE8UEqfjzRU4outROqxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782165666, "uuid": "52bcdb10-739d-42f0-a44e-f0ba3384b7d5", "value": 162604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782165666, "uuid": "fe649bda-bc46-4478-b3a6-36742adc1dd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782165666, "uuid": "765701aa-523a-4948-8c9a-bf4f232f6fd9", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69ba2fdb-6e59-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782146573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782146573, "uuid": "aafc1e80-86f2-4c80-80ef-d4ec9d8b4de5", "comment": "Malware payload", "value": "8f12cafeed3f1eea8e39a699a5cb43dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782146573, "uuid": "c3181606-40bc-4f44-b3ca-4e7e170f56b1", "comment": "Malware payload", "value": "a8b584bb71515a2bcfc2994018f3c291ec59132e2fa747a070f6699dac94edb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782146573, "uuid": "15102558-8e3a-4a8b-be15-2ee2902586de", "comment": "Malware payload", "value": "0753ebba812e4de16ed4e4bd56be0aaeb3a19c56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782146573, "uuid": "b7bb43d8-db8f-41ef-b7d7-4256890f6cd7", "comment": "Malware payload", "value": "b49c3aae07f3b1e77ce0f67d45e042084c1fc85e6fa04fb902a5c15fa82c61ea73dd4499b245da3e8e92ff1df03281a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782146573, "uuid": "b293ca8a-efb0-4047-b744-f74b68e6351a", "value": "T169E462AA419A0B94FC6F3176C03DBB3DBBDF699DA5D000DF871D1250E568806BE36236", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782146573, "uuid": "82adfc8b-86aa-4d8c-94f6-c6377e9b7238", "value": "12288:y2kcA7oSUBZydsUB8d1N5faVFRxkLtX5oeRzgEqUr6BoqJrNJYcHwh1uMEsso7xl:y2kcA7oSUBZydsUB8d1N5faVFRxkLtXL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782146573, "uuid": "59a4f74e-7f7e-4720-8575-8e427fdcc11b", "value": 665816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782146573, "uuid": "d434b1ef-90f0-4c82-a1a9-9f5e7656a059", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782146573, "uuid": "1d105362-81b8-4520-b921-eaf7c684606f", "value": "SecuriteInfo.com.Trojan.DownLoader49.52953.3562.29469", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5640bc3c-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141815, "uuid": "62846521-162f-4c8e-9784-f462c3076515", "comment": "Malware payload (AgentTesla)", "value": "71914216d90228db536c7bd28cf3eb94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141815, "uuid": "4e712916-2e94-4dc8-81d6-e301a82ce29e", "comment": "Malware payload (AgentTesla)", "value": "aa074f6fbba3f59dee6a35e693b85e1958aa95325e8833e897fdc12d807e1023", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141815, "uuid": "6911b729-df0a-41ee-8c7f-78e0d6005c05", "comment": "Malware payload (AgentTesla)", "value": "f63b78a9224a837ea16d06b6ba9e7592068f7145", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141815, "uuid": "19b93e9f-1516-4bed-a5c6-bbe6030b6064", "comment": "Malware payload (AgentTesla)", "value": "0deaf24f91ce8185509f2a1b91b77d8323bd27152c9585f32c0ca3b9a30c5f56dd6781b563d827d229203a20330814b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141815, "uuid": "50c7f89c-c1b0-475e-b4d3-77a0a1d67444", "value": "T13BE519915794A2327720E7ED9236DE30990F641314DACF21302EE328795CD8BA79DAF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141815, "uuid": "529839ec-9341-4687-ac54-bbbb3c24292e", "value": "98304:sY0apuSol3LDbifMXtDEgsLEPiV3gwFgiIKbdx:sQolvbiMtcEPiVQw+Qbz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141815, "uuid": "7966dc67-1589-4569-8766-5c4d323c5869", "value": 3318121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141815, "uuid": "29084879-4d4f-4f48-a8cf-9aef28e3eb57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141815, "uuid": "39744fc4-f4ce-4fa5-8604-da677f3b26e4", "value": "Request for Quotation FPG SDN RFQ260619.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1889d3-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141639, "uuid": "78344cac-8858-46ae-b8ff-aba14c6290b3", "comment": "Malware payload (RemcosRAT)", "value": "e0f680813b96938ed97d09eb130c0dc0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141639, "uuid": "9dcb67a4-1f41-4e34-8730-cc9611026118", "comment": "Malware payload (RemcosRAT)", "value": "aa5091fb1b6623d8318336e4ad4c290b7b7847767a017b4da94b570fe38e4e3e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141639, "uuid": "5c3924cd-12b5-40c2-af31-92c2a7a0bf2c", "comment": "Malware payload (RemcosRAT)", "value": "65898cd84406a78f7a70780eef56c90119e84874", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141639, "uuid": "055db4ed-b855-45fb-a811-a9fe6eb3761c", "comment": "Malware payload (RemcosRAT)", "value": "b0a019dd76cfde77dec75088170ebd3a97b02d4b3e85908fd61640ed55795c1cb700086e113b8f03b7a3233391854ab6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141639, "uuid": "29ed78ab-c944-45ba-a79a-5e2de27c45df", "value": "T1D2D5155203851BBDF6CD0EC9C94B255B20F2D4677D291298EBB36EE7BC3B9849430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141639, "uuid": "00fea47b-2b1c-4c0d-a7bb-376afb9e629a", "value": "1536:PjjoGdC6piCuzoGrjVcO17oVnTzPvJrMim9fFhwnLY9vfF/JlI7m7QH08mt2XxrJ:3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141639, "uuid": "a8416c70-9764-4efd-8af4-91e47deceb9d", "value": 2951857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141639, "uuid": "81531092-d0c8-4cff-aeb5-8aa179fd1d89", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141639, "uuid": "56d7fb3d-39d2-4eb9-9555-68c8fa6811b5", "value": "Materials Required HSN Code 998876.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8c03ca1-6e07-11f1-ae13-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1782111460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111460, "uuid": "606814ed-b75e-44f5-a383-9164cfa55b51", "comment": "Malware payload (MassLogger)", "value": "31fb1582154914d838ea250060b69fd4", "object_relation": "md5", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111460, "uuid": "e263be83-37b2-454d-b4b0-7008a9a3d7f0", "comment": "Malware payload (MassLogger)", "value": "ab347c440065310d18af04c57dc81bc3c6b488c11623e3da2254ea5c45dbd76a", "object_relation": "sha256", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111460, "uuid": "f64a6438-0d9e-418b-8af3-f443280edf53", "comment": "Malware payload (MassLogger)", "value": "8211c93c43a775960a893d30f9a5dd63029955e3", "object_relation": "sha1", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111460, "uuid": "ff5ab387-cd1b-4284-9637-c79bd99e1019", "comment": "Malware payload (MassLogger)", "value": "496124badee413490700d0b6ea28363a59c93a56aebf22835a9ab2cfbad1bc4b099c5c1603cb596f469a5f5db9566450", "object_relation": "sha3-384", "Tag": [ { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111460, "uuid": "56d6c01d-807a-472f-8cbe-1d311b222607", "value": "T1AC850A34ADFA512B71B3EE6A8FD679A7E91FB663370E941D109203460623943EDC123D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111460, "uuid": "546c0882-11f2-49c1-a2df-4c62772cc7db", "value": "24576:YaXeiq5cl1Oni/Q7oAoK5zZeajiWGA+Sv7G3F5XEy:U/6ONvBmEjkx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782111460, "uuid": "cff85e26-1c39-4d5f-ae8e-d30cd78827ce", "value": 1821582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782111460, "uuid": "4ee466fe-fd63-43b8-afa2-84ee5d0df987", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111460, "uuid": "a8b1e265-2475-48ef-99c7-ac9305c38c88", "value": "orden.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df6413f-6e89-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782167061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167061, "uuid": "32ba843a-2eb7-4b3b-a236-6395c74bef1f", "comment": "Malware payload", "value": "6da30ad8677b058fad4d3d3031a428ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostShell", "colour": "#768394", "exportable": true, "hide_tag": false }, { "name": "MB-0009", "colour": "#E8335D", "exportable": true, "hide_tag": false }, { "name": "UAV", "colour": "#F3B08A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167061, "uuid": "d32ae6ab-4d86-4883-a6cc-7b4bc8df4d05", "comment": "Malware payload", "value": "ab5681266f70af7df24383f15de876e411fc18e35cb6f24603b12f580b05ccb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostShell", "colour": "#768394", "exportable": true, "hide_tag": false }, { "name": "MB-0009", "colour": "#E8335D", "exportable": true, "hide_tag": false }, { "name": "UAV", "colour": "#F3B08A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167061, "uuid": "4e24c20b-f2e4-4234-96ff-a7fd10056185", "comment": "Malware payload", "value": "52a1b02e4fe0998069c777bec37eb394781e8fda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostShell", "colour": "#768394", "exportable": true, "hide_tag": false }, { "name": "MB-0009", "colour": "#E8335D", "exportable": true, "hide_tag": false }, { "name": "UAV", "colour": "#F3B08A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167061, "uuid": "feb1600f-eba3-4060-95cc-d45f20c2ea0a", "comment": "Malware payload", "value": "806b48074795d1d5273ef104c1b7f09b21940091cae427cfaec032c65ecef2b5cdccee5cb083f4c641cb74c3cf0dbea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostShell", "colour": "#768394", "exportable": true, "hide_tag": false }, { "name": "MB-0009", "colour": "#E8335D", "exportable": true, "hide_tag": false }, { "name": "UAV", "colour": "#F3B08A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167061, "uuid": "2b0d2985-b8c4-4ea6-9746-35df78f71026", "value": "T133548BFE61517AEEF77AC434716591BD5F6EAC3B1A007B8B0AB0058C0EA95B41D38F60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167061, "uuid": "b12b55b2-31dd-44a8-91de-aa3aed85cb3e", "value": "e465eb80f752d3db94457ba259dc46cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167061, "uuid": "d592fa12-5c1d-4c99-af2b-9a9b77e81556", "value": "6144:mYeLGXzmQdUQv3++++IiMHpJDTQ0X6nIngvn5kma4j5A6j5NCLtqboZW:peqzBZvQJDcvSt4jm6jotxZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782167061, "uuid": "fe7e9bf4-dd13-48bb-aa00-486ae0451a91", "value": 301068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782167061, "uuid": "4a445550-998e-41fc-961f-4c8acb665a27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167061, "uuid": "42b7673f-dbae-44cc-8595-760b874337a9", "value": "122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cebeb092-6e4a-11f1-ae13-42010a9c0009", "comment": "Malware payload (ZigClipper)", "timestamp": 1782140300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140300, "uuid": "80451807-14cd-4bb1-b6fa-c91172cb945f", "comment": "Malware payload (ZigClipper)", "value": "cb9ff4d0795d8248ae73f252acdca705", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140300, "uuid": "ed186d69-4b75-443a-94a8-4639ea35eb35", "comment": "Malware payload (ZigClipper)", "value": "abb567030783490103cd3b5b5e075aaf5a4bb35379188fe8389317a5a514a9af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140300, "uuid": "3a901669-0109-42a1-b99d-3d0c3afc0b12", "comment": "Malware payload (ZigClipper)", "value": "28fe622e40c2ba89b9f57b3242b6d9e7565216c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140300, "uuid": "09421a8d-cac6-4b3e-8275-e59b03db52e3", "comment": "Malware payload (ZigClipper)", "value": "741c2ed90c0f63ae827db01f77014027947a22bdb9d1665a3cf7a0378101c48005158a62c4623fd988fed7570f7200e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140300, "uuid": "fbcee9bd-7d73-4269-8772-0028b4a7426e", "value": "T150A5332123D80729CC393B3459F655E7D938FC1E99244A0B27BB26DE19F2A858D34B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140300, "uuid": "17b09a09-a60e-4daa-aeb0-eb57bff21e59", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140300, "uuid": "987251d1-e62d-4167-a28c-a3ea01c7b72a", "value": "49152:y0shoacHWx6iFiw+de8+6YlaASBfKZia0oOHAS8fSlmm24:Jlxy6878+6YlHSpKZiaXOHASHll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782140300, "uuid": "33adca55-164d-4692-a56f-4c05f7a041b0", "value": 2174464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782140300, "uuid": "ef1d5534-40e9-4e6d-8c0b-831e763230a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140300, "uuid": "2d522611-2f32-43ff-bbe8-f6ff2aaee571", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60dc5e88-6e1a-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782119499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782119499, "uuid": "f8874034-b9f2-4e2f-89f2-85104411344c", "comment": "Malware payload", "value": "c6409e078bad9094ab4b26dad5219f6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782119499, "uuid": "050c1356-f1d7-4877-9f3a-0c49bde0efb5", "comment": "Malware payload", "value": "abfac8026d1974220871568caf9344cbffed19a184ff098c0912ffbb4f1e42d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782119499, "uuid": "05c3884d-7339-47c2-a500-d5e95289504f", "comment": "Malware payload", "value": "f372511e07d474f2b4488603cc0a6fd4c780cd7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782119499, "uuid": "45093089-fae4-40cb-9cf2-1d67aefc1f53", "comment": "Malware payload", "value": "fd4c4d8076afffdbf23ab1beed8213ca256277be812b200561329a06de5b1960d4d58bd57d9a4c95ad6ceedb54c0bb06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782119499, "uuid": "3b6c7c73-8029-4c70-9cad-0f32481c8b16", "value": "T14F47C0CD484DA326D892DD2510ED2E2E275C24BBC94A2FB4ECBB3621D70D1D7DA234D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782119499, "uuid": "3aeecfa9-4daa-4d4f-884b-d816b94b8220", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782119499, "uuid": "4a579c48-0f7a-4a25-be3c-75424a8068a7", "value": "12288:vgeLTQTFTFTtTQTFTFTgTQTFTFTgTQTFTFTgTQTFTFTtTQTFTFTgTQTFTFTgTQT3:vPjxg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782119499, "uuid": "ae11faf8-f3f7-4272-b223-c3c32dc52d94", "value": 26743808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782119499, "uuid": "30cadf4f-5280-4081-9271-dcab817e7ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782119499, "uuid": "414f1336-e7bb-4382-a9a4-959c9df79cf1", "value": "abfac8026d1974220871568caf9344cbffed19a184ff098c0912ffbb4f1e42d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f693777-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1782141401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141401, "uuid": "cb54e3d3-3414-416a-99f6-71840c5ab4da", "comment": "Malware payload (GuLoader)", "value": "bf73254b0e554922cedb795d9ab2a52c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141401, "uuid": "7be00ac7-6ac1-4012-9ed1-2dccff3bae81", "comment": "Malware payload (GuLoader)", "value": "ac8b6860de1dd6a7be3f5781ee701bbbc8713e2c23d28083bd29291c880a3822", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141401, "uuid": "83eb744b-9040-4eb4-9c59-4fe064d6dd29", "comment": "Malware payload (GuLoader)", "value": "f23aebd33e9e33b9bfa558677670a395491c55a3", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141401, "uuid": "2b4eb0f6-b005-422d-a110-1a06f0a8fed1", "comment": "Malware payload (GuLoader)", "value": "b2bc5edd5d49d23a22de2aa03496eabff41ff93f2b47a74ae51ac54cd802b5c25e6dcc340253cb6adf222e880b91c65c", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141401, "uuid": "9e3bc676-6f6c-4d58-af31-333475b1af6c", "value": "T15C734B60DA2105B74F43BB98BCA90261CABDD321853305A1F6DAC70D910DDECE77D6AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141401, "uuid": "e72c87e1-d0bb-4fbd-9cff-d221d1d8d313", "value": "1536:hRbx9LcXHAVNX1tVF3zjRqnMtX2g/J/XtP36+X5f/j:hRbx9wXwXXVFD9qnCX2g/RtP3tXtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141401, "uuid": "dfa06a1e-e3ba-4016-a063-e6efd16db16e", "value": 76677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141401, "uuid": "acf31f10-18f3-4ead-b50a-0e48e064e562", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141401, "uuid": "bdd98aff-5320-4dde-bbc3-ff62cd7c8268", "value": "PO7283706222026_RFQ_SPECIFICATIONS_DRAWINGS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7277029-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141629, "uuid": "461861b3-631c-48c0-bf03-32b27bdc0de6", "comment": "Malware payload (AgentTesla)", "value": "1909ccc34255f44115138422c7d1b00e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141629, "uuid": "27ad3692-3997-4f16-88d5-fe1081e7eafc", "comment": "Malware payload (AgentTesla)", "value": "acdf019b7899b10a1ac3c46dbe8ddb3e38f976e517a794651786c5e07e1eadae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141629, "uuid": "022370f8-20bc-4248-a9a1-03512d65c49a", "comment": "Malware payload (AgentTesla)", "value": "2e6415f19ad9bdf113d7f57f423f69b67bd9ab6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141629, "uuid": "a6b68bc6-165a-4f24-aed3-b76449e2ac8c", "comment": "Malware payload (AgentTesla)", "value": "4c3a9e42e0e32ccb406f2764c05ad0a1b86efc9b3c9ccc8720b80f88f480d0ad86763ff38d45bc435e2ceb055a792cb3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141629, "uuid": "7ca1d204-e037-4857-b40e-c11e3bea9530", "value": "T12DF518811BA0A17B3721E7ED993ADE30940F901358DACF10315EEB28791CD8B6759AF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141629, "uuid": "78965654-be88-4e95-8ee4-4841fc7a9b5d", "value": "98304:LUp65FOoD6kd5Z82G3pF9y6VkJNI+WuGPl0dkiY7fhnKkxrbYX4aZY:ow576kdMf3pDy6V+NI+zGPlmkiYjprie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141629, "uuid": "58cbc569-1449-41bf-bde5-874fecf99799", "value": 3321761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141629, "uuid": "26f5741d-4828-4558-b22d-53bb354dbbec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141629, "uuid": "08011f60-9ade-4962-9cf9-79c53229ce41", "value": "PAGO FACTURA.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5b36cb-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782115251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115251, "uuid": "0094ea80-428b-49a8-b36b-c09f5a91b055", "comment": "Malware payload (Mirai)", "value": "71ccfeefe757a8418782383c41b1e22b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115251, "uuid": "fb0bd409-a43c-423d-9924-3c700991d46f", "comment": "Malware payload (Mirai)", "value": "ad787aa0d274b313360dc58ddfa4f9d22834eb98a8d16cb17684ac8fdb3c2357", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115251, "uuid": "3e5d48ff-db29-4934-a907-18de302d4dfb", "comment": "Malware payload (Mirai)", "value": "fa56e9319b26ce610098578a64eea3fb7021ff81", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115251, "uuid": "62225600-45f9-4abc-af33-8ad79ccc0b65", "comment": "Malware payload (Mirai)", "value": "1ca73aea0a118d3a6fb2bff29a23a16e389ad7a3ae14ea3d7693b1f18ef02b182b27cb09f387adcae0b0dca00ca3e0fe", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115251, "uuid": "dd83a49c-dc92-42fa-a2d0-c8853ed1474a", "value": "T179016BCA8610A910451A9B5E229751A0B421C3CF564A4F78BF9C5F3DFB98604F07BFD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115251, "uuid": "ba68c178-5d35-411e-9928-8c63e4833dd5", "value": "24:kXCKysE2hi0ziQvZohaCX31xLfKFi7Aey7:e9Qp+Msi31xLfKFiM17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115251, "uuid": "d5b7c0c6-ddf8-49f9-941f-721abecbffd6", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115251, "uuid": "b78e1082-29fb-4f9f-9a2a-656a29c2691e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115251, "uuid": "5b712ef9-69af-4cc1-ada4-7a6f96062d1a", "value": "p", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a104e373-6e71-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782156973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782156973, "uuid": "19c95eac-0e14-478d-8dce-7abbbd497384", "comment": "Malware payload", "value": "82041a4e36d7ecc42243d1a2a49e9d72", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782156973, "uuid": "5dd6d7ee-7d89-4f47-8161-83005454e603", "comment": "Malware payload", "value": "add2e8d41a8454cd8879ff25e32a6728008a41edfcd04c8475e93fe72539f953", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782156973, "uuid": "d7f708db-d519-4e9d-92da-a3ccb2678235", "comment": "Malware payload", "value": "02ddd2ff9be6fbb0553d44a53f7e189bb09d8adf", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782156973, "uuid": "140ad14c-e53e-4f38-b8b3-3a8a19e83a15", "comment": "Malware payload", "value": "a7a02f9189ca8f2caa86264e0b8a93a99e693ef788ce5911185ca59efd7039e8ff4e2719e7a252db0c813c1fe973b819", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782156973, "uuid": "1c23f808-383d-4f90-8ab7-7339bdfa8d3f", "value": "T1311833249F948CD6F55231399A906644E3E2BA6417B08FAF0FC06B211E375FBEC79361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782156973, "uuid": "2f861409-0bac-489f-a53c-b89c5932ec16", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782156973, "uuid": "5c1bd129-3f87-4393-b503-2f4f71ab157d", "value": "1572864:uAYyyxBU7rUFpYHHK8o8iLxMtQ6ZMo/STJ6ppJ2FNwW5wF:ufxgk9Uc4R/U6pXoQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782156973, "uuid": "3a34198e-e34a-4040-b837-51d37ca73756", "value": 85019566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782156973, "uuid": "fe3b6d1a-beaa-4eeb-9b00-97ef9dcb50f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782156973, "uuid": "b0cb5537-4066-4a92-9f5d-778f594a6d90", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32dc9461-6e57-11f1-ae13-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1782145621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145621, "uuid": "ee54d496-9abe-4b85-a70a-e1da1c4b67ef", "comment": "Malware payload (AsyncRAT)", "value": "280e08dca611106cf9cabdc6a8f87602", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145621, "uuid": "bbc9ff3f-927e-4b79-ab58-cefff5f4aa16", "comment": "Malware payload (AsyncRAT)", "value": "ae04b5b3bab04e62af5c9328ff4f5a6a319510f9ab3119d89abf2d367c736203", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145621, "uuid": "79febdc1-c816-47cc-b1a6-6e62db960ba9", "comment": "Malware payload (AsyncRAT)", "value": "cce2c433a22c38f6a96be9c784a025665cf5f78f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782145621, "uuid": "16b2efd1-dad7-415a-b228-444298753f7b", "comment": "Malware payload (AsyncRAT)", "value": "1c65dd75ce0bb8e2b31e3c4c33b01b0a36849ef42cf2701945b749dfc9bc8b9c9a0d7905cb478fa99324866ee8900686", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145621, "uuid": "83ea64a0-63ed-4cc8-b98c-49599cca8b77", "value": "T18C3412FA214DBC6DFBAAC6242427BA21C41F9F480D06E2D936F82D848D396F5724F581", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145621, "uuid": "232f196a-d3e8-4f0a-abb4-b1398668eb20", "value": "6144:0Zd3h9/SrkyFl3V6jNLFa3/hwfhCSetVQIQQddjv:0t96wWF6pLFa3FSeTtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782145621, "uuid": "c3b716d3-8b7f-4b0a-bbf7-29ad5c54c99a", "value": 237330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782145621, "uuid": "a6a9d5f9-5f2c-40f4-883a-d12ff9f36268", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782145621, "uuid": "ea61e4de-fa74-4fba-8605-3eec16272f05", "value": "ps_k8X6D7UxFj5X_1782139186490.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc42417-6e3b-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782133745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133745, "uuid": "fdca9ca6-f248-407a-8007-a1a87ccebd4e", "comment": "Malware payload (Mirai)", "value": "c0e605da6577ec8920ff1274533508f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133745, "uuid": "d1cd7563-7fef-449f-8be1-13c6c1b60716", "comment": "Malware payload (Mirai)", "value": "ae35395697d6777aa82e7dfde627f16f4417215c83a14e183f85b717e1daf0e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133745, "uuid": "641cb96e-a346-4cba-ba89-eba41675ff22", "comment": "Malware payload (Mirai)", "value": "a82418bef3dbe5d700c90425d9ead62f6e6ed3d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133745, "uuid": "cefbd1c7-5b3e-455f-8439-75f414aa5a78", "comment": "Malware payload (Mirai)", "value": "f2a9cca74a4f7dca9157ffcf5ccacb693619c794c20d66685b6abd5156f6035d193144324e11a3c0ba1e1e0c8f4e8538", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133745, "uuid": "efd0f8a5-43d9-4bf6-bffd-c167f3d53c5f", "value": "T1A2D2E1A7D16BD678F0965AF180A94392F86BB545CE140F870A783EFCD8AFE480825E50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133745, "uuid": "3a578d88-5e3f-4956-b45b-87fd6247f4ca", "value": "384:hZGmK8vQuAbrAjLTgY0SCSvdsqK7jswdjcI4Eyb3OKqUuF4Hls+RHmnnUxaVXALD:a/OcSRvg74qA4ycUuuHW5cx0ev", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782133745, "uuid": "1e006bb4-93af-4295-80a6-43a303a86a5a", "value": 30296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782133745, "uuid": "725ff57d-9b6b-4ef3-8967-74425abef64b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133745, "uuid": "b313cdb6-bfa2-4391-9e5c-0fe91c290cc2", "value": "ae35395697d6777aa82e7dfde627f16f4417215c83a14e183f85b717e1daf0e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1deb83d-6e08-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782111985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111985, "uuid": "cc7b21ec-1124-43cc-96c7-a97ed1d4ff50", "comment": "Malware payload (Mirai)", "value": "b379ff0ecb09bf5f58f6c5d589c7f26c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111985, "uuid": "4c84d66b-3ff5-46a5-a80f-45a5ad37b51a", "comment": "Malware payload (Mirai)", "value": "aeec4aa5e19c65dae73bd98a14be512d22fac4ae28210099698bb09637b6303e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111985, "uuid": "79fb491c-3548-4c4c-8108-bc0dcf6d611c", "comment": "Malware payload (Mirai)", "value": "d99da11bdd37bce416108cff397e9d40235a4705", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111985, "uuid": "b3939934-7ef4-425a-8e17-4d7662ef805f", "comment": "Malware payload (Mirai)", "value": "4abc812167beaaf5d03df0a001f65e62d2da36883e663dca9a6c8c37f8a6796489cfe813e9cc320c65ca067ecce32df4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111985, "uuid": "b97c39d8-b090-4cb3-a2ac-0f7b26450d64", "value": "T1F684D723C8154995D1614CF22267338ABD0787BF8AE732D3DE2A59B0BF6051F52BADC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111985, "uuid": "1f45af85-b0ff-4025-9fcf-894aabac7e40", "value": "6144:9gGa7PfdNnhKJy2XwjoA6fcRM/9GemvDwlG750Nu:uGa7PfdNn3MwjvPW/EemvDkG750Nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782111985, "uuid": "902e6c45-388b-43a6-bdcd-300e2b1ecc2b", "value": 407371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782111985, "uuid": "51bda659-3199-49b7-84d5-1b87c70212be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111985, "uuid": "9f2e7c17-5512-4edf-821e-1dd88045bf17", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6d91ea-6e3a-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782133321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133321, "uuid": "7b39dcc4-12ce-43de-a0ce-84f6133a914a", "comment": "Malware payload (Vidar)", "value": "eb42e023cad8abcdd43a65d49846d15b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133321, "uuid": "ac73ad95-7867-4c8c-b782-6a7497d88c79", "comment": "Malware payload (Vidar)", "value": "af7d2b9b203041d11f70996168610b8b277fb6b0c06ef245d1db38dd81958095", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133321, "uuid": "a457399d-91c6-47e5-a3e2-a03b8f2d9b5a", "comment": "Malware payload (Vidar)", "value": "93db4f4cbb3d7dca6ca1d3d8dca16b653929eb42", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133321, "uuid": "ed0ddf52-ffb2-4432-a931-514aa652283c", "comment": "Malware payload (Vidar)", "value": "d096e9284cb353fe3d892cc50871c985149124bdd675e6aae884e3f6a57a91a09b7c6a0f9f4c7ad6e2230ee503e45e61", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133321, "uuid": "2dfcef91-ac44-48ca-bf63-b5e6963cb948", "value": "T19FF59F07ED9508E6C5A9D331C8B65281B7B5BC092B3267D72E50B7782FB63E05C3A724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133321, "uuid": "fe6d1fe4-417e-41fb-a122-61e5a42c4fda", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133321, "uuid": "0ea8adcd-79c4-4a2a-9e40-74ec213814dd", "value": "49152:GZS2GxPdS7+UpkIfW70s9DcvnEXQKxZGSL:GcgtWos9DcvnExFL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782133321, "uuid": "b3174f5f-dfa0-4ffa-aae1-e644de87fdf8", "value": 3392864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782133321, "uuid": "736c3453-6ab5-4580-9e02-8b75e6b2dcc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133321, "uuid": "4e0455a7-af81-467d-a7dd-0ab20eb9428b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982c8dae-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141496, "uuid": "2774da4e-5e41-4080-a642-857c2ad55fa4", "comment": "Malware payload", "value": "61f07213f2e54c54ec379714fd211c73", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141496, "uuid": "adc0fee6-5c34-4199-8ec2-6d94ebbaafc2", "comment": "Malware payload", "value": "b11ef9f11c9bb6228582f38a61f4c04dc7160939d8c5b7ee4e467ffde6317f02", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141496, "uuid": "6830fa97-84f1-4176-9317-6e71569c78b4", "comment": "Malware payload", "value": "d7a2361877b9cd1f4b6ef56f59fb7adec72cc945", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141496, "uuid": "8698c945-b5c9-4c89-bc5b-bf63e4a4b01e", "comment": "Malware payload", "value": "046a296722c3f1ca9515fb635e0ee75f38d537d35e49aee049099e58dbb1d041193336289eb9b91f1ed5c4df1cc23c0a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141496, "uuid": "f485b3fa-9f76-44ca-a040-0237795b9f7c", "value": "T1C7F534A30351176BE2C109E69188312765F6DD273C6D20AEFB83A8E7FC7D9868478771", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141496, "uuid": "17bdf7cc-8c6e-4f08-82c5-3aafbf356947", "value": "1536:q9JvTzvmtoPynl1yZsHScMDyDifFQmoMpicsW0LuWVQEyOeaA+npzyyC63C7BFlX:y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141496, "uuid": "1d2208e4-0f7b-4631-8c3e-31e874c7d36c", "value": 3385086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141496, "uuid": "0789c5e3-db1c-4e5f-a18a-0e4dc8483f2d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141496, "uuid": "d659ec80-556f-4688-9106-0f969cc26715", "value": "Fattura-2819889242.pfd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee2a1440-6e88-11f1-ae13-42010a9c0009", "comment": "Malware payload (Cobalt Strike)", "timestamp": 1782166981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782166981, "uuid": "d3fcebb8-86cf-4ffe-aa5e-8bd93fdb1386", "comment": "Malware payload (Cobalt Strike)", "value": "16a59e1fece21ca5394a8ec9ea596fec", "object_relation": "md5", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostShell", "colour": "#768394", "exportable": true, "hide_tag": false }, { "name": "MB-0009", "colour": "#E8335D", "exportable": true, "hide_tag": false }, { "name": "UAV", "colour": "#F3B08A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782166981, "uuid": "b4da5267-3115-4e5e-98ac-a28fddd2f903", "comment": "Malware payload (Cobalt Strike)", "value": "b1834634820ae696f0514ca2b6723061f115857232306e573f4d115bc6ead012", "object_relation": "sha256", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostShell", "colour": "#768394", "exportable": true, "hide_tag": false }, { "name": "MB-0009", "colour": "#E8335D", "exportable": true, "hide_tag": false }, { "name": "UAV", "colour": "#F3B08A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782166981, "uuid": "7ccab84b-f509-4e4d-9243-04bdb86ca9d4", "comment": "Malware payload (Cobalt Strike)", "value": "4b5f407f5966f49f8c1005a94a822c83b20fa325", "object_relation": "sha1", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostShell", "colour": "#768394", "exportable": true, "hide_tag": false }, { "name": "MB-0009", "colour": "#E8335D", "exportable": true, "hide_tag": false }, { "name": "UAV", "colour": "#F3B08A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782166981, "uuid": "6c4d096c-16b1-4b0c-84c7-a153d8779ead", "comment": "Malware payload (Cobalt Strike)", "value": "9be3c1bd8df7679b5a57ab524611b5efde5f00db85ed5273daacc3027dbcb0db42cea9ee0f2080a5acd7de52ac66bcb7", "object_relation": "sha3-384", "Tag": [ { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostShell", "colour": "#768394", "exportable": true, "hide_tag": false }, { "name": "MB-0009", "colour": "#E8335D", "exportable": true, "hide_tag": false }, { "name": "UAV", "colour": "#F3B08A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782166981, "uuid": "f2a01ee9-60c2-46db-854d-0729842b2072", "value": "T1E1B22B9EB39610FECD6FD0B8C5FA4B75B1B7B84151656F1E19A0D3252F31BD09A2CA00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782166981, "uuid": "b9a62241-1b30-43b7-8a70-4a9bbd8ef151", "value": "e91b821060e0f0c551e269326b0d5065", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782166981, "uuid": "d7c16be2-ae9d-48db-89a1-690e80bdd7ca", "value": "384:8eypKGePfzRqirEG2RrVVlRW1kaqZ044m18kDvFFrWMaW:7yaEirEG2UkaI51nDvFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782166981, "uuid": "2204e714-a3cb-4c26-afe6-91deebd48b88", "value": 23552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782166981, "uuid": "84b17a35-bc40-4c9c-a713-244dece87b1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782166981, "uuid": "cee5dcdf-0ffa-4e69-8184-4de5075c6b5b", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ddda4c1-6e85-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782165424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165424, "uuid": "81b6eaf8-a40c-4fdc-8707-bc5d1719e6e8", "comment": "Malware payload (CoinMiner)", "value": "7801c52b75141aa7375dfba4a176d3a0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165424, "uuid": "27fe2d76-ba8c-4ff5-8609-83842be0a061", "comment": "Malware payload (CoinMiner)", "value": "b2042a3d582987297d3e21e4ec35813e608d2c2b18db409edb36c1173f0b5520", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165424, "uuid": "fe5f2e67-5734-478b-80d1-2ecd1201ee49", "comment": "Malware payload (CoinMiner)", "value": "1ff598cfb2b81dffa10863a9416ecab5354a6ffd", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782165424, "uuid": "59d01a49-f007-4df1-a8bc-87d2e082984f", "comment": "Malware payload (CoinMiner)", "value": "b4c3fa24f9545251f0506d5b57fbf603324b1d0b1353232c81464f747271057bc36c6fe13fb1663b178803ba2b978b33", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782165424, "uuid": "4401a6f7-a27e-40c1-8018-b63af37c3aee", "value": "T196F533DA430921F8D2D9C8B0872F2B15211A79261FA7F8E72256F8607D73BD12F39953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782165424, "uuid": "2f0177d4-2cbe-4871-ac1c-db524097143b", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782165424, "uuid": "f9cd81da-886c-4152-98dc-5f1f72fee2a7", "value": "49152:X5LVvc5fyEyJ6+pYLZ4UKyJKsFlLH8xRWWrIAfKm:p2Bp3O0Jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782165424, "uuid": "4a4d7633-9aa3-4c2a-bc54-6c00e9af404f", "value": 3446248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782165424, "uuid": "7ccde638-e8cc-46dd-b35d-3781f7969ecc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782165424, "uuid": "55f9801f-5649-4b97-91a1-1b230e1ee3f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141d4a9c-6e0b-11f1-ae13-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1782112928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782112928, "uuid": "5695446f-b806-4c29-8f52-d7d042dec903", "comment": "Malware payload (ConnectWise)", "value": "46fdb16aea52628752ab73367ea02e7b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782112928, "uuid": "65ea8063-00ee-46ee-801d-7b37e92a2d19", "comment": "Malware payload (ConnectWise)", "value": "b2315b4ad93131afad8bc924a386a5d50d65877c89078a3c700af044f217e8f7", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782112928, "uuid": "98c01f1b-9a51-4334-b3b2-3a61775a5a60", "comment": "Malware payload (ConnectWise)", "value": "cb25fcc86b147f1324f37256efebf1200844f131", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782112928, "uuid": "1c7e89ec-7aaf-4d23-8a5c-b4a985d304c4", "comment": "Malware payload (ConnectWise)", "value": "4a10f84080be99a34a186d201b554c7f1e600c184704dd91bed48d1ade12d1fb465b1a92f536010688ce7a08e220550b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782112928, "uuid": "91292757-9a39-48e5-89be-1fab830d546c", "value": "T158A623116BF8D278F1B22A39D876A0B1A5367D119E23D12E2324791E2C75EC0CA73777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782112928, "uuid": "ca165b2a-6a82-4236-8e05-7abac8fd763a", "value": "196608:fHxcp9ym3nltDUJVGHxcp9ym3oHxcp9ym3NHxcp9ym31Hxcp9ym3:pGplp1Gp2Gp/GpnGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782112928, "uuid": "ea404e84-bbb3-4dc5-85e6-3314f0993d71", "value": 9961472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782112928, "uuid": "5e59442e-ed55-47c3-9da3-de5d55a667bb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782112928, "uuid": "933efb5c-ef2b-4eb2-beb3-f9976f28a27e", "value": "mullvad vpn.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba290f2-6e91-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782170520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782170520, "uuid": "a3dd44a8-8f6a-44b9-ab98-ea356dd824f7", "comment": "Malware payload (Mirai)", "value": "47714e54709bf64b637386d5d45e7cbe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782170520, "uuid": "6c8c4ed5-4a64-441f-8b39-e7f5ee2f7128", "comment": "Malware payload (Mirai)", "value": "b26b5776815642e60bf82947881f3593460565a8ab684cd0b2f7ec3438702deb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782170520, "uuid": "3f307c9b-db17-4c76-bbbf-e1b5b187cb63", "comment": "Malware payload (Mirai)", "value": "6283e245dd6caddfd6294325564b54100d9aaf5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782170520, "uuid": "31a63c07-9f33-496a-9336-82598a973876", "comment": "Malware payload (Mirai)", "value": "1102dd78af48b7fe0f18edecd02d7c62d61a9065ab15a41b27f2f940aa91f7723901f64986a4f397cb5eb6cd47e3cd34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782170520, "uuid": "0b07eeb8-6c26-4015-9edd-c42e9a0e9387", "value": "T19024D809AB610FFBD8AFDE3702E91B0129CC551726A93B393674D928F54A50F19E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782170520, "uuid": "88657156-2654-4ae6-84ed-cb550b16e5cf", "value": "3072:32YQFVogN9twj+Ar2crgEVZeRTVgD9j3jQfBkGFBos35vHT:32YgVoU9th/cUE2RTqz0fBNBh3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782170520, "uuid": "ca51b92e-d0a4-48d0-8eac-128e04cb650d", "value": 216576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782170520, "uuid": "c0b4cebe-5fd6-4a95-81c5-e01b109f7f41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782170520, "uuid": "8c67a93a-dfd3-41b7-b30a-29cfca545c43", "value": "lmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656d5d82-6df7-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vjw0rm)", "timestamp": 1782104475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782104475, "uuid": "13cf6b63-f899-4bd1-8935-88a0c27ee1fd", "comment": "Malware payload (Vjw0rm)", "value": "40ac4f5981a284239f2ebea2ed2584c1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782104475, "uuid": "f3e4fa5d-bc6b-409a-bf7a-97d930a32419", "comment": "Malware payload (Vjw0rm)", "value": "b26fb4df0dced5245969f72924d7aa27de5e9c7c526365fd0545dca7bd79e5fa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782104475, "uuid": "3f43ae1c-928b-4098-bd73-8900ed5c7301", "comment": "Malware payload (Vjw0rm)", "value": "9da279b4fd55277b4bd2e81f34515717643c7d00", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782104475, "uuid": "64fa8c7b-8d20-4673-a7e1-f33b9b1f2da1", "comment": "Malware payload (Vjw0rm)", "value": "b301646a643f88011cbbb4177a2b5832ae851069c559ac32717b6ca9a8785b0d6d9b36da97ba11869a1f03b159fcf71c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782104475, "uuid": "9242d4f5-d4ad-4400-b97d-e85bee7489a5", "value": "T13842A5784C07E314C795E7C06E0B8A9A7E6E97635366604FB548E1C03BB0C98E15DBF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782104475, "uuid": "5f79f4ea-ad58-470e-adf3-0ab466eeb021", "value": "192:cbx96AfiuTeweFAJOFskwf94RCA2C73d5Yvq4i6vLdI9lUcOOIGr1EhUu:W9625TeweFAJ5kwf+0S73dbRn9RIGrmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782104475, "uuid": "4df53ce7-e7db-46ca-bcf7-b0e09c33ec6e", "value": 12117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782104475, "uuid": "c9e7fc7d-0054-434a-b4a1-a326d1aeed81", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782104475, "uuid": "5a157002-aafd-4387-88c4-3a15cb0d84cd", "value": "ePRzHXrdth.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d3a7db-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1782141969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141969, "uuid": "e2c62b90-8f37-4ba0-84ec-5a8daf4e2a75", "comment": "Malware payload (XWorm)", "value": "d4d527f704af41adedfa6d4322417a9f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141969, "uuid": "4b16f2e8-f5f4-4cdf-8da2-1cb2a692092d", "comment": "Malware payload (XWorm)", "value": "b271d12f4da306da079d7592f4611ffbd1f4c0a10f62031fc1d96a259728f96d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141969, "uuid": "a62fc9b5-6bd5-48f3-9dc2-12b066ff14fa", "comment": "Malware payload (XWorm)", "value": "856cba394efac37e781213fa1d22480b163db58f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141969, "uuid": "4f9ad29c-7c05-4e69-ae7c-d36f206352b9", "comment": "Malware payload (XWorm)", "value": "045da544e6b2c8ad38ff5a70526200f36954dc364392d1efd819142cfc95304443c4683738b2c364fb0cd6c7a2c81e1d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141969, "uuid": "e1b5d9d7-d141-4a32-b507-258fb5bb70c0", "value": "T161C55C488960F38AD5A8CBB19C0F6FF4560E940BED24DD03361B966A8F84FC736546E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141969, "uuid": "a21611c4-0019-4e62-9acc-b577e33bd83f", "value": "49152:YJEJsodWowV7PwJA6L0ahqq4FDuiLWAR8/5hhUOdDWQoy:wEJsodXwrwJA6LPhqq4xlLfR8/5hhUOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141969, "uuid": "85aca6aa-410f-40f6-b421-5a62a7816ff7", "value": 2579017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141969, "uuid": "ec0e7e3c-cabb-4008-941e-43be4fb5ab77", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141969, "uuid": "e2357b99-2fa3-45c0-bbea-fd7947850937", "value": "WGT1546.Pdf.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6446edb-6e3c-11f1-ae13-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1782134272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782134272, "uuid": "23c110e0-710b-4c22-8798-ac372df64a18", "comment": "Malware payload (WannaCry)", "value": "37c07aa4965f5f1bd40600ea762a040f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782134272, "uuid": "a44444b3-c399-489e-ba6c-bb11a2ad273e", "comment": "Malware payload (WannaCry)", "value": "b2db241fa6eb5c63c67d9768b20d401b19fb526ff3e65a0ca7992183ff70e095", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782134272, "uuid": "cf85424c-6120-4c46-ade1-79d090449bc0", "comment": "Malware payload (WannaCry)", "value": "690db2be6d6feb9bbc1ce79c7911d0830ebb2f63", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782134272, "uuid": "ca768702-d401-4e92-b948-a42c066f05ab", "comment": "Malware payload (WannaCry)", "value": "423211828e338a8e8a58005b85a6d5df5332fb77982799f0e84791a2b9571382a99c8ec06030121ae1888faec5d4bb89", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782134272, "uuid": "1ef18944-9f17-4a74-925c-901d2f11e472", "value": "T10036236630A8C074C103657444ABCA62F6B67C3A17BA694FBFD04E7E2F63765E710B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782134272, "uuid": "2539b5a9-fa33-4a18-a283-4f42fb9f1f3b", "value": "2e5708ae5fed0403e8117c645fb23e5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782134272, "uuid": "d9e77d38-f9d7-4f78-8a39-04fb7d0d9fef", "value": "49152:RnpEjbcBVQej31INRx+TSqTdd1HkQo6SAA:1pUoBhT1aRxcSUZk36SA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782134272, "uuid": "22c67468-3a0b-4f6f-8a92-1d6a6f87ceca", "value": 5267459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782134272, "uuid": "2fb61728-2cc5-4191-b114-87486722b886", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782134272, "uuid": "87082f7f-f27e-4100-87e3-7efb3adca115", "value": "37c07aa4965f5f1bd40600ea762a040f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1502061-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (SiriusRAT)", "timestamp": 1782141512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141512, "uuid": "e38acbac-5cd9-4cbf-b021-19fd385654ac", "comment": "Malware payload (SiriusRAT)", "value": "c25c51b95bb512175743e1a50c1237d1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141512, "uuid": "246d83be-3a7d-4fa7-86b9-3cc79c13e470", "comment": "Malware payload (SiriusRAT)", "value": "b34f4d6348e400a235867e9104125278e07914ec071b8cabf8c3982e70e1918e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141512, "uuid": "1bf8daba-9517-4db3-a606-b6ae2d674d3d", "comment": "Malware payload (SiriusRAT)", "value": "1f824102040047ac57963a5538dbe9af0363129a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141512, "uuid": "7b7fdd49-a29e-4f69-b106-2567b392b582", "comment": "Malware payload (SiriusRAT)", "value": "eba532c9a573561088b10316c6d2ba144045acec910a51026dfc82bc3c578743c511107e472e79e5752d1cacc669af6d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141512, "uuid": "8cb27c61-11a4-4a1b-ae3b-6925a85e6125", "value": "T18C951A3883F941DF7479A6925AC7A640986CDA3553CBC1C7B0B10FDC9B129E72CB2636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141512, "uuid": "f5404b1f-1aa0-42ce-a8ac-0a5c9283d92c", "value": "3072:LY1IpK9t6qLuGgZ3tmHQQ1ReZMsBn0jg325Lrw/FLVHWl/jGxXJ4Z7Z5iPL8iZrx:7AWLYjp45W8y/mOEJ4O9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141512, "uuid": "d7e77c4a-8335-4997-a239-9df787e8bb49", "value": 1878222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141512, "uuid": "852a8761-bfa7-45d5-85c3-86c2c7d6705c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141512, "uuid": "339a4a4e-73d8-4cf2-8f78-2f9e561c3a68", "value": "DAS HOLDING - PURCHASE ORDER.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e18fbe3-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782115253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115253, "uuid": "9e91640e-257d-4ae3-be9d-4bb9c9378671", "comment": "Malware payload (Vidar)", "value": "23a0877a9493286fda03edf640df32f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115253, "uuid": "dd632fed-cce6-451d-9654-2c3ffe535232", "comment": "Malware payload (Vidar)", "value": "b460a840b07530fec4e32c46b6d945def5e9d6afa3b1e2004463272d7b25c3a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115253, "uuid": "b14e74c2-04d5-4727-8b3e-d4533bf0e0ad", "comment": "Malware payload (Vidar)", "value": "0ae1a89c865f28cdcfebea962aa7deeba2845176", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115253, "uuid": "643d33ae-289e-4506-b000-86f634242699", "comment": "Malware payload (Vidar)", "value": "3821796a8aa9d19d0a3624a7d105ef48fe84f320a3226e73942947b84db60b4e73f795e09f81bbc8505d51a3bfea085c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115253, "uuid": "b7a689ca-7d4b-46cd-bd56-da0579e9bd8e", "value": "T12752E8CBF1D7B0F8D1A9C379CA491677C665308517362F7F0AECC0607AD2101B2AC666", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115253, "uuid": "756b0c9b-b765-4947-bf67-c9a4b384bcdc", "value": "3cd30e07f035c1fc246213a28be447cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115253, "uuid": "d5cb9fe0-86c7-477d-bddb-41ae1041a1c4", "value": "192:O/o0ziLIJlLvpjyhhKuxaRgNfrI+Qz5lmoq3uMWAhQIUPcr3Vx:O/oAOIXpjrqNfrI+OvmTEIsQlx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115253, "uuid": "b73b64d1-a731-4784-9a13-3320442845a8", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115253, "uuid": "cb3d8707-1b1d-4e12-a8a5-a7c4362c327e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115253, "uuid": "6374777f-c7b2-4268-a8fd-e99fc1c9b5d8", "value": "23a0877a9493286fda03edf640df32f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb06c7a-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1782141878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141878, "uuid": "1669457f-7ea3-41fc-b3bd-53d55de0559a", "comment": "Malware payload (PureLogsStealer)", "value": "a7087ccf46c74f5f9f97cb96ba48248f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141878, "uuid": "9ddccdc3-7de0-42c2-b4ce-5a8e7c5d8e51", "comment": "Malware payload (PureLogsStealer)", "value": "b4a92c16dc941c5a22a0d619bbd893930a7138d9437f5af145b73051589d0a9c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141878, "uuid": "59b72534-9bd7-41e7-b3bf-7a4299babef9", "comment": "Malware payload (PureLogsStealer)", "value": "adbbb110ac2098ed1f2842a8fb8bfeb084813917", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141878, "uuid": "02609752-a399-444a-97d8-4ee671d4074d", "comment": "Malware payload (PureLogsStealer)", "value": "b4513b7771137a44481d1ccc582dc8730c67563414b5f2ac7e11ae6070a95a27afb292896e20c8210b5aec2ea2b59a0d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141878, "uuid": "6a3e782a-3359-4bdb-a900-638f6f31cb85", "value": "T16575A366E9167D36A3B3CE4780C5164FBB8F7663390CFC0D60A64F3D2267596DEA0218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141878, "uuid": "a5351022-2694-4622-a18b-199c522de6f6", "value": "12288:+zZPBtzMWk3OaXq0ZvvfyxZyg0QPAznpVDwOh97ng+:h7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141878, "uuid": "c9da7f64-77c7-4a40-b2a6-6aa989acd339", "value": 1570412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141878, "uuid": "988f1d1f-a061-42b4-95be-ca9678d43edc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141878, "uuid": "170db66a-ab4a-42ed-8c24-8a7f3cd8b9ef", "value": "Payment Advice Comfirmation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "306f420e-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141322, "uuid": "de5fac15-5f2b-4f7a-9bd2-ad49afe38e54", "comment": "Malware payload (RemcosRAT)", "value": "29a2dadb4f6741bb7ea676afbc75010e", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141322, "uuid": "ca22902c-c24b-4ba0-a888-e760f2552552", "comment": "Malware payload (RemcosRAT)", "value": "b4c879cb84c835ef64d9f45b78a69b9f08700ab35498f06d802c72af7428223e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141322, "uuid": "b0c33324-ebd7-44b9-ab87-73732ffd02b0", "comment": "Malware payload (RemcosRAT)", "value": "45ccb345f78c49508e259e6d17ab0266873aac23", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141322, "uuid": "67566be3-9f6b-44be-8c4f-6a4dbfd75c6f", "comment": "Malware payload (RemcosRAT)", "value": "c31797091fbce1122410ddea69827a299676218e73b2630545201fd07eab1d025451df73407e36d125c2bd622f177c30", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141322, "uuid": "7fcc2f17-8c21-490d-83ab-27105428b324", "value": "T1D3A35A30CE6407694E4B2BA9FC912A61C9BDC629423250F4FEE9170D50059BCF7BE6AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141322, "uuid": "c432f0e1-1936-4337-917c-55ca025e6317", "value": "1536:mPe0A7it5VqnFO+4OWMlvERzdKQMnmByFZywleZTqc/IZb6rJUzd3xTbogU:mG7it5QOGW5/mmoFZyK2TqWIZGUhRo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141322, "uuid": "d6eeba91-5ece-45da-a3a3-909b855cb4d3", "value": 97722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141322, "uuid": "da1b38df-962b-4e6a-8242-f324381f4d4f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141322, "uuid": "6702547e-7cf2-4500-bdb8-3ce10af117ab", "value": "PO_PXN012034.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a94b9160-6e95-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782172449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172449, "uuid": "afcdf9b0-47e1-47c7-a561-51a92ddc169c", "comment": "Malware payload", "value": "d8b9b01f63d06aece15428e5c95d285d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172449, "uuid": "a35a1891-e08a-4ba8-b14d-c3ce4563bce2", "comment": "Malware payload", "value": "b67f4541aa89e84cd5df5c7d4b3dbaaf86808bfabc3047488abf91c15e7a62a2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172449, "uuid": "7a83e528-d142-4132-a624-37c380f63cf0", "comment": "Malware payload", "value": "8e884f7a107ed3bd6f15d4ccc395bbfa8e2605a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172449, "uuid": "d6bbf0df-0103-41a9-aef3-226d9ed77fa1", "comment": "Malware payload", "value": "1e1babb613564f22e25bc509190b481f1bda3991d44dd6aa2c309ff6e745107d420e15a472a50b61e20b0ad6724b4604", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172449, "uuid": "ffc6f1be-e048-4b2e-ac50-da1c98b7399d", "value": "T1B5B32859B8806F01D9C6147AFE1E134933532BACE3EE7212FE145B2C778B91B4F2A546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172449, "uuid": "6853489c-aa0b-4a2b-8f28-4575cd843d24", "value": "3072:Oj4wE12O7WJjCVRVtmDTJazd4dIaJTfsZvRlp:OMwu2UWBCV7tmDTJaR4dIamF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782172449, "uuid": "e8342b15-109f-47ee-8dd6-caea4a7cef9b", "value": 108628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782172449, "uuid": "668cd419-0baa-469f-9558-1de20add1ae3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172449, "uuid": "55bc569d-e4f2-499a-a21e-f1c985ba1ea9", "value": "QIC", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ade803a-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141796, "uuid": "dfd25baa-d752-43a7-80ca-82d534776269", "comment": "Malware payload (RemcosRAT)", "value": "06e106b7840704838fa2e03d0e98f003", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141796, "uuid": "fe8d02a1-b0ab-481f-9f02-f543a79040b3", "comment": "Malware payload (RemcosRAT)", "value": "b6d4bfdebc63cb786be6937ebd3b6b902c55249a9079b6772733a58e2e16aa56", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141796, "uuid": "cdcb64a0-e9e1-467a-987b-5699bd51b90b", "comment": "Malware payload (RemcosRAT)", "value": "9aec9db599611d47fd7e6c1cfb9db17f9b40dfe6", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141796, "uuid": "14495308-fbdb-4a2b-9eae-d90d353fd399", "comment": "Malware payload (RemcosRAT)", "value": "0364ceedf31c4d084e17a80beaf4efbb82283f6ccbfab407b13751e13ffa86dd2a2cee05adf1ca3ce2b33910b758f881", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141796, "uuid": "7f463a58-0e25-4090-9131-297116465dd6", "value": "T1EEE2EC06A46E30044C7A6DEFD535081BA6D9EC7F702968537858B335A6BF23B10BDDAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141796, "uuid": "438a3ee0-290e-45e3-a1c7-165e6a14571f", "value": "192:FpL5oCNJTBvebntAkJZHLmGiy4g9hIm5O1pOw5DL:Fr5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141796, "uuid": "cdcc5748-734a-43f1-814c-f3186428d920", "value": 33359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141796, "uuid": "2add7fd0-b400-442f-845c-4d9ff3ba6722", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141796, "uuid": "3fd6bf9a-0109-46b1-8a09-da9f208b9dd7", "value": "shipment Docs_PO#RFQ109302.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d263389-6e6c-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782154792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782154792, "uuid": "1bf98bb2-82e6-4c0d-8b3c-ffe0a4ea666d", "comment": "Malware payload", "value": "a3dc3ee464737dd74c20ec771deaac4d", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782154792, "uuid": "885d85c4-fa0c-45a6-afbb-1e2eebd6d4de", "comment": "Malware payload", "value": "b738c03fef5e3d26419e4aab1818a0a7ad206c67fb3eeedcdfb3ef1ee07eb620", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782154792, "uuid": "891bad29-d9b0-4c01-95f8-defcfba14abf", "comment": "Malware payload", "value": "5a68ece20d05c755d20975b4e1794d0f531d2c19", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782154792, "uuid": "7f5327c9-e28b-4548-b3aa-f70dce83cd40", "comment": "Malware payload", "value": "e7cc5dd4224e6a950053005429615d9cd38901644f2d00d779249589ae3b6c8b604e9d182f165766d1e5e34532677371", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782154792, "uuid": "1d4d999d-6080-4711-bfad-6606a9d950f9", "value": "T183F46E36EA6800FCE077C279CA664D13F7B2B84603716ADB07909AA61F176D45F3EB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782154792, "uuid": "d6766e76-e753-4090-b6d9-2f7c9d47616b", "value": "a1473d612f2a3526dd38dd97cf1d1992", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782154792, "uuid": "3a0e9662-c8e7-4ec3-b353-61303c4c1094", "value": "12288:R43c3JDEcd2nlZNG8Qy8cJyQNSUeMJ0e7nARq2qPeori8:q3car0FiJf9nGq2qPeori", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782154792, "uuid": "6f18df52-ec01-42fa-99a3-cda55ba30920", "value": 788480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782154792, "uuid": "00559dc4-5ade-4cdf-800c-18b0981357b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782154792, "uuid": "f1862cde-59d2-4f43-bce6-58c68ead0c0b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b3d9c7-6e1b-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782120036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120036, "uuid": "118c0971-903b-4e2d-9748-6b4cd67bb27f", "comment": "Malware payload (RemcosRAT)", "value": "ae57d785794bb2f50d651c2101203040", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120036, "uuid": "3ce57904-2371-4b66-94c2-d878deaa32a4", "comment": "Malware payload (RemcosRAT)", "value": "b7d13fa425c5087f1bf1aa84edd0c5d870b3eb553920e2f404809b632e92530b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120036, "uuid": "45c0d8e4-58cc-423d-938c-62f70e4d2352", "comment": "Malware payload (RemcosRAT)", "value": "fbcab8a49494c52b377863291204e7b351cec41a", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120036, "uuid": "23b964fd-d673-4a33-9b73-d22d8f1e548e", "comment": "Malware payload (RemcosRAT)", "value": "5f04a42e497fab54da63eef4194d999802b49e91c3b63951715d5b16f21c5d809aebe9a39ad68b5f60565c2601db774b", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782120036, "uuid": "2c025fbf-e626-4006-ac10-778748552237", "value": "T19CA5333268824F592759137AFE9F439BC60D7AB913B5A6D62398D0305FF5C79BC02328", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782120036, "uuid": "4c59de37-822f-41bb-b90c-aa5df22b59b1", "value": "49152:e0WN2/q+cXD2OKeiol0hCwcNxVsG+vUcgQLgpxjzYNabPabfz:2Nj+6yO224UKYxg0Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782120036, "uuid": "4bd5e8e6-b176-4320-9fa1-d975a5644114", "value": 2205808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782120036, "uuid": "f7124f32-2a92-4fdd-8179-ba5921785ea1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782120036, "uuid": "4185b9a9-c7b8-48aa-9d3a-d8510d89166c", "value": "Quotation-11343224532 RFQ LF12234263 22-06-2026.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2555be03-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141304, "uuid": "a5b5f63c-15c9-48da-9d8f-f9aaf8bfd729", "comment": "Malware payload (RemcosRAT)", "value": "28dc2797d8053720e0a5c98418450230", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141304, "uuid": "e6d1754c-f3af-46b6-bd42-51901f7d29b1", "comment": "Malware payload (RemcosRAT)", "value": "b7e0919a3e4a677539dab51753807c1a58362513ad7229f0c565e55023e76183", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141304, "uuid": "1720cefa-a8bf-4073-a742-f62c83bc1b81", "comment": "Malware payload (RemcosRAT)", "value": "0a9529e0544159f5f862dfb98d9c4f77adfb1d0b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141304, "uuid": "b2c90acc-f3fb-4f97-bc36-cdfa2e3b4676", "comment": "Malware payload (RemcosRAT)", "value": "da97b2addca1ca8e07a3fb397089af97165ec1ee1f04d5289da147dcc1bfdffbea1f117631486e2c4226989e2d9275d1", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141304, "uuid": "41a93fd1-ba42-4df5-8fa9-97b4d8bf7a66", "value": "T177934930CEA407694E4B1BA9FC951A61C9BCC669413300F5FEE9170D500A9BCF7BEA6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141304, "uuid": "c87eeb3f-2c48-4160-a475-fa2d9e9a4806", "value": "1536:LEA7Gt5PqnFOmm6q2lTG6T9ashRjVYLWOH9Z51cZ0VyeJU5THe:Ln7Gt5iOCqC/XhRjVYLWqn51c0VVU5T+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141304, "uuid": "f56b9a3c-9909-4215-9dc7-98facb0ced0a", "value": 96637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141304, "uuid": "0bb5c308-975f-4993-81f1-2f114673f537", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141304, "uuid": "b244db07-9402-4532-a8a4-fea0885543c9", "value": "Surrogacy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64efa21-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141574, "uuid": "535ae27a-4c17-41e1-8c02-aa677a65fc7b", "comment": "Malware payload (AgentTesla)", "value": "ffff29eeb5fbb6f2a9a99efdd513eb99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141574, "uuid": "d5564114-646b-40bb-ba36-33a60229f1b4", "comment": "Malware payload (AgentTesla)", "value": "b89249511d088ee5c90345689d4c8a85056a319a3bbf56c0394a4adaf0545147", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141574, "uuid": "e8595d96-5d8c-44be-a638-b97bb59e0240", "comment": "Malware payload (AgentTesla)", "value": "9adeb1acb6bc2b0b159d73b316f949feb216865c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141574, "uuid": "bbef543e-390a-4749-b427-540514c85387", "comment": "Malware payload (AgentTesla)", "value": "0f2019ad4035c8b7a845500a3cd710083560c81cf1c70f48b6e61281110575f5046fafb4102f7f854df1e5e85ce5e7e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141574, "uuid": "cdfb5a13-7abb-4588-8b70-8386686d4d4b", "value": "T1CAF5179167A0E1377720E79D953BEF30980F641328DACF11301EE218791DD9BA399AE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141574, "uuid": "4c1fdfa7-6b5a-4a53-98c0-aa3dd735a44d", "value": "98304:Mg5nNx08faFTtIS7MFo+vHq/Y416FVOag7PaAvpLt+u5H7JOFqAkB:Mg3xLfqIS7oBjXfg7CWpF7cFmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141574, "uuid": "03eef3d9-513b-41f6-8f32-fb367754682b", "value": 3321761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141574, "uuid": "8a646448-2132-4add-a3bc-fcdad93df9af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141574, "uuid": "a38d1542-7e36-4ee5-8da7-13a0368a0d30", "value": "Estado de cuenta de reembolso de pago.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea421e00-6e94-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782172128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172128, "uuid": "62844b33-b976-4407-8e08-6d0ef3fd1a70", "comment": "Malware payload (Vidar)", "value": "ac938258329b4ac7fc9f7988dd025ed9", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172128, "uuid": "68f069f7-cee8-46a2-9f25-0fdce4a8aa64", "comment": "Malware payload (Vidar)", "value": "b89e34ff377948f84ab19a843981e900ded66fa89e2235951958413e6e6034fa", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172128, "uuid": "3f0b6142-a3ec-4f00-89cd-951e580796a0", "comment": "Malware payload (Vidar)", "value": "f5c116acceb0ded779844d76443ffde6e7363d68", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172128, "uuid": "625c29da-723b-49f3-96c6-93096865cafb", "comment": "Malware payload (Vidar)", "value": "9da61cffa920301f37bf2ee7c05b11342c8c0b3e25612a69234eee53685bd1cf028c860de3bb70ba7adfefb734a44ad5", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172128, "uuid": "e0b5549b-5680-4561-a6da-d058f8d92acc", "value": "T129D5338A25CF9ED489638D31034AB8A24E37590E451D5CF278A0AE45ADFF4C824DFFB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172128, "uuid": "b8ff0899-dc4f-4ad7-a801-9b5589415071", "value": "49152:euZekoOBaT1D/htxTrSw4hlOARUKR8dTMZcNwWVNJzgdjfpNI7aieaMnDaieX:H8FT1D/hvrSwM0ARqtMZcNwWIjfpm7m6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782172128, "uuid": "50b19458-70cb-4a11-bdf2-c0b66f9302d5", "value": 2851050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782172128, "uuid": "f11664de-ac62-4da8-a4d0-f574717c11a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172128, "uuid": "02252083-2942-4dfe-89f0-0d85b037e4c3", "value": "\u041d\u0441tln\u0425.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1996be9-6de5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782096952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096952, "uuid": "ee28270f-29f2-4c44-85cb-f61f43d05c02", "comment": "Malware payload (Mirai)", "value": "4108ab76360876c3d7e863193df66de8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096952, "uuid": "4c8a29bb-15f5-4679-af21-f19174aa6b6b", "comment": "Malware payload (Mirai)", "value": "b92abe3dde271635548f3b6c2e93f24548c2f11611bac731d6e01d835ec95775", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096952, "uuid": "40d55140-110b-4bf1-b6b3-0f317c3fe2c0", "comment": "Malware payload (Mirai)", "value": "f720556c0f788a02121e14efaac69857f1bd8234", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096952, "uuid": "c3361308-ff6b-4437-8a08-be30ec309b0b", "comment": "Malware payload (Mirai)", "value": "f921f40d42f4267ed89b3d933d702a5cbe5fa10c8c08ee6dcb545730b038de033dd9423daf45008408ea9cc2f0f6eee1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096952, "uuid": "91edbf53-2144-4542-ab44-76bf00a9fba7", "value": "T14453F891B8426A3AC2D1577BEDAF548E3314A7D8D1DB3213CD240BA07B8694F1C97F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096952, "uuid": "fa6bd505-7818-4ecd-9ab6-bc5defbc5c99", "value": "1536:dn385gSW19bj2h1XBfpu2ac/ISDMSvhWy5pXS:dn3QxJpRISDMKf5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782096952, "uuid": "5d500417-9f5b-4d18-acbe-3d4c5ac1362a", "value": 61696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782096952, "uuid": "6602ca01-4072-435e-b512-8246c9537ade", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096952, "uuid": "3b7ee267-1edd-41ac-9eec-995f44644637", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3344f859-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141327, "uuid": "a12d7861-e811-456e-ac7e-99975049dbad", "comment": "Malware payload (RemcosRAT)", "value": "fcca5d373d5d941d84ad324d38dd9a7e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141327, "uuid": "c430d1fa-0e8f-430d-beb1-8aae59a9b111", "comment": "Malware payload (RemcosRAT)", "value": "ba08e2d253229e0f2c2766a7415b31f8b0f75f37b6c9277a0c794a10831b3275", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141327, "uuid": "3a4aa79f-57f6-4286-9e99-edfc923d05c0", "comment": "Malware payload (RemcosRAT)", "value": "03ece0ee357d6dbbff86f94b1ec51db7c84f8873", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141327, "uuid": "0bcc41dd-ac1a-4ca1-81d1-fde42bd4f78c", "comment": "Malware payload (RemcosRAT)", "value": "a043927d6720acdae3245fa4416fd67e069c647b12eca0f565ac6a50865100b4946d0c5572a7dc1267fa9763c802c4ec", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141327, "uuid": "532e8033-9700-466b-b2e0-a57f8814e878", "value": "T108851A7B976C5AD9C53C5AE87D1E2C309F81802B9E5FFE7AB03295406F204943A42FB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141327, "uuid": "bd8fcdd3-4268-433d-b4c6-69d11caabb46", "value": "192:i9BtYXPhYhVPP3pPSvCP3rpUMx3+0KzRS8C:6hvsSZz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141327, "uuid": "efc7774e-8ea1-44a4-8ab1-53236c29317b", "value": 1866128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141327, "uuid": "cf2ca4f4-f212-4be0-927b-4116abfb19d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141327, "uuid": "0fe6d31f-3ba2-4346-b83c-af41eeddbe66", "value": "Order for Quote and Business Profile.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7abdf0d-6e07-11f1-ae13-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1782111592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111592, "uuid": "d44a408f-2b3d-4f3b-bfcc-bb821185391b", "comment": "Malware payload (MassLogger)", "value": "7a5b9ba33788d320e2e2a9fdae43f18d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111592, "uuid": "da3222cc-87ff-4a1f-a384-dd94ee23b62d", "comment": "Malware payload (MassLogger)", "value": "bb39bbb7f1300c10ca7fbed5c67ee95686be7a34dd99ce4ca36fc9300439d6e3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111592, "uuid": "30308765-7a7b-4dd0-bac6-6cb8ad071bfc", "comment": "Malware payload (MassLogger)", "value": "af7d4ec1dff8b7f59599fc6d6557eb54790ff985", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111592, "uuid": "33f94b28-dd14-494c-b17e-bfdd1406a27e", "comment": "Malware payload (MassLogger)", "value": "bd049887c63bd68eb9b1dfdea10a50d30dea863e7d957115aad941332ccaff361e0bfebac5390c6e43d477913bec71fd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111592, "uuid": "39f8cc5c-feb4-4d03-a352-c55d62f7d78b", "value": "T1C706073CCC69422EC1B3C52CC88A490FF8926917223DE94BA0D7675B5F57583B79239E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111592, "uuid": "af0cc969-6aa3-40bc-bea1-e9acd79cfd19", "value": "3072:JJLo4jEpCuWheFRoqv4hu38ZF9GY5AEsSABbxaZ9Ka0F6rm5xq8jELhyACuYwVH9:jjEm+qXKnseuV9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782111592, "uuid": "084c9d20-a73b-4bef-82e9-4cae50c102b0", "value": 3884038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782111592, "uuid": "57a043be-dca2-4263-aca8-46f5d95d1f0b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111592, "uuid": "0e35ff02-7720-4785-9752-10fd2c7b4dc7", "value": "TRANSFERENCIA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e2f974-6e78-11f1-ae13-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782160117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782160117, "uuid": "c6418640-d4d8-4295-aff6-35d1bf01bf99", "comment": "Malware payload (ValleyRAT)", "value": "1f3c2e4c7093ecd75911ad8043bf577c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782160117, "uuid": "80636061-98e3-4cf0-a73d-f66c849c617d", "comment": "Malware payload (ValleyRAT)", "value": "bbfcc27dfcbdb84ba4394883089301d90e7ab9523e313f2133ee5bf5e4099ba2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782160117, "uuid": "e0bfb14f-1ef1-4f37-bfa6-325306bb9822", "comment": "Malware payload (ValleyRAT)", "value": "b239d03ff774e29b1131dace1415d20f96c95f00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782160117, "uuid": "be5d201f-5c0e-405e-a5d2-18fa48aa7804", "comment": "Malware payload (ValleyRAT)", "value": "f366354204b1801de10f075b03257cc829816858bd704cc4fe24bc269eb15d85fd1ccad279af95b2a5c2a697d8bddb09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782160117, "uuid": "0e2f34ac-87e3-4e4d-ab18-a0cb459fd1af", "value": "T15195D023B2CBE43EE05E0B3705B2A26494FB6A256523BD1797E4949CCF760601E3E747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782160117, "uuid": "2c186013-bc06-495b-bb04-a5b9dcc40bde", "value": "40ab50289f7ef5fae60801f88d4541fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782160117, "uuid": "18c8b165-738b-4496-a2f5-880ed0bc78a5", "value": "49152:o+MRvHoWzdA67MZ2Z9ftchfudg87dqn7iM5d:orO+MYchXqdnM5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782160117, "uuid": "5bc7ac74-98c1-4c60-9cd0-7b628872248c", "value": 1996590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782160117, "uuid": "3f374342-3cb3-4095-a1fc-22fdc5c94a35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782160117, "uuid": "877bfbdc-c8e5-43ec-897a-f5201781d11d", "value": "Captain s Legacy Wealth Strategy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd5216e4-6e91-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782170818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782170818, "uuid": "5d70b1e6-9d9e-4fc2-988a-f2975966cc32", "comment": "Malware payload", "value": "0580bd76ee62f44f7cdb9a9a36102b91", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782170818, "uuid": "fed4965f-c66f-43a9-91a8-2b0e1f98727f", "comment": "Malware payload", "value": "bcee0470e2203cd0207b119968b5dbf323e82bf8007f37f386a42c63da5e51e2", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782170818, "uuid": "f17d0fbe-5759-46b0-af33-f2f599fd579c", "comment": "Malware payload", "value": "e516984b4a150c9442c1cd45e6c3e8bc2d85a16a", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782170818, "uuid": "2f2321ec-2a96-488c-886e-de4f11f5dea5", "comment": "Malware payload", "value": "57a3f036d004fbbf49630b5d139108d7b9a1f1efb649e6a30209f37fc203854e594ed87498a5504608b3290fcb888a4c", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782170818, "uuid": "6f88b0a0-822d-4e14-8ca5-0ba04a2a6204", "value": "T16E414CD757B6340A78428F261CBE0A63A61A131F381DEC06A1415A5E468FECF5E1143D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782170818, "uuid": "91576856-aa27-47da-ab4c-0c30c8015ae4", "value": "48:ZS7XL9V9FSgKcMcxhCy2GO8ZMpYR/wdir9dVYqCyONnJs0P:ZS3figKcmfJpm/wK9dVY1fDs0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782170818, "uuid": "62ed30f2-e484-47a8-887e-926b610acd1a", "value": 2057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782170818, "uuid": "16c41557-62b6-41a6-af40-55abf9ecf837", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782170818, "uuid": "93107865-158d-4b06-b45f-ebca6f8dadf1", "value": "EUROPEAN ENUIRY E261138 A001 PRODUCTSERVICE SPECIFICATIONS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3253194b-6df5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782103530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103530, "uuid": "cbf52e57-25b7-4b6f-8e1a-c0f98579ca64", "comment": "Malware payload (Mirai)", "value": "578a1fb9ebb26473cef37fbc3cc03140", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103530, "uuid": "1796988a-dc67-4009-86ec-f26173f4312a", "comment": "Malware payload (Mirai)", "value": "bd0d1fab22f6f81ce82f0fbc1831091bbac6311db2cfc8f610fb83fac2fd66d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103530, "uuid": "fa10c015-4a23-4b06-b004-6b742e774220", "comment": "Malware payload (Mirai)", "value": "a6d18d510c57d1daa4f2f9589ca6492e68f212cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103530, "uuid": "9f0b53f0-274b-428f-b58f-5ebf5320ac80", "comment": "Malware payload (Mirai)", "value": "6989d58ae67feadff061124bd9ca66a523c3c02dabf6358274ad21fc02c08479ea4ce1877be51b79f99d9e9b2e10ecaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103530, "uuid": "43f4ab4c-3322-4424-9c1d-90dd13950f48", "value": "T1AFA329C1F68B84F9D54B48304066F33FCE32E5268071C9AEDF99AF36DA37641921629D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103530, "uuid": "a9b90ac7-3b2f-4db4-ae13-85a23520dee3", "value": "3072:ZTdeqPbQ0yhOEckEUI6An128egcTz3E6Sdq0YKc7sEW+QuQFK6P:ZTFPbQ0yhOEckEUI6A12ZHTz96G70jnF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782103530, "uuid": "8fa41cd0-7fce-4931-9206-e6745d515b9f", "value": 99508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782103530, "uuid": "80144384-b7c7-460a-8ac8-3792d181fc31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103530, "uuid": "960b996e-b033-4d31-90a4-a89738539a35", "value": "nerv.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7eeb8b8-6e17-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782118330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782118330, "uuid": "36e2f832-6eb1-4963-968c-3b186863fc41", "comment": "Malware payload", "value": "8917695df7bd21e569c5937b9631dc49", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782118330, "uuid": "05713117-7538-45ef-a4a1-7ccfe90135da", "comment": "Malware payload", "value": "be112a1b5c18eac836e6d5555587ca2e47025a9e586268e728c01208c2a60263", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782118330, "uuid": "e2d02eea-d643-45cb-915b-d653766843cc", "comment": "Malware payload", "value": "47325d40c9706e4c8e4209d273c521648f8cc6a0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782118330, "uuid": "73828b6e-9a88-4651-9449-7acd051ad7b4", "comment": "Malware payload", "value": "fa6ad870d81b7744a9b3b9f9cda68741cc8198273cbc2d49eba066bb400e8dbbcb12c2961c4321f952452d26d755c3e9", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782118330, "uuid": "7b7ef2d2-25ee-4659-b115-fa119fa7dbcb", "value": "T19C318E9F05205D3A5242CECE73B73118644C95EB2D6BC795AC889EAE818898CB2A5FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782118330, "uuid": "18946ec9-5283-4ede-8534-0f8e901ad932", "value": "12:Us6ppSpGH6GORyhFD/6Kgw2c6qTLI6Lgp9ZJ1I6J1IXvti6taqersx6s048kD16i:spSoLEyzXH7QpvSVbiOK3XGYAd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782118330, "uuid": "eaa58622-0b6f-453d-9558-389327a3241b", "value": 1584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782118330, "uuid": "a206fc17-dd40-497c-b72d-f0ae14e42cd7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782118330, "uuid": "204ef4eb-e4b9-40ce-8517-857574637fd8", "value": "ok", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8134e15c-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (GhostPulse)", "timestamp": 1782115259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115259, "uuid": "c5bf2e07-3a0c-4e08-a64d-3e15cc9e0e3c", "comment": "Malware payload (GhostPulse)", "value": "3b2a2777cead3c4981d4b2106c1ec4b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115259, "uuid": "28a915fd-b114-4f85-a708-2654922b62c6", "comment": "Malware payload (GhostPulse)", "value": "be4bb2ea6fc6959cdeb63238018761be56adb2d1e69e7c3d3340272187198b5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115259, "uuid": "bd3632e3-01fc-4d62-94b8-d044397d4b0a", "comment": "Malware payload (GhostPulse)", "value": "ea41ab57edc9a9a1cb1ae258325d6519f5d23571", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115259, "uuid": "2c307457-7ba2-4d5e-b5c4-349a656927d2", "comment": "Malware payload (GhostPulse)", "value": "36b21db1d51fb62df6ddd564da0e99948744387de062baff01ddf6cd070d4066cd4ca27e9f4db8d05b842386557cafe1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115259, "uuid": "07bef8c9-a802-48bf-8477-33840a0dde92", "value": "T1A207330577513170C27D97FB9E1ECB28C6F2EF89A2430D4661666DDE0EE332A46074EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115259, "uuid": "18fdf727-e3fa-472a-959d-3dd7128b0ec2", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115259, "uuid": "148ef313-356e-495e-9c9b-0e83593290a9", "value": "393216:+pzJroD96Ay+3AKzBMPGuifeYFxqVJkiiHjXHcCCPdcn:ezJroDkAyKzauuiDQVpY7HlCPdcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115259, "uuid": "a9badae2-ecf3-4414-b91c-82fbeea5742e", "value": 16977326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115259, "uuid": "29b3f97b-a74e-4b63-9d4f-2862436619f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115259, "uuid": "47864de3-4eaa-453e-8f95-84784576d7d5", "value": "3b2a2777cead3c4981d4b2106c1ec4b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a387b9b-6e3b-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782133742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133742, "uuid": "e198b213-5e48-4ce5-ba7d-4a1a4562eb0a", "comment": "Malware payload (Mirai)", "value": "2a52527f6cb928fafbf4afb353f284a5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133742, "uuid": "bf52a2d7-b34e-4a27-b122-b3d5d4b44141", "comment": "Malware payload (Mirai)", "value": "bed2dc64bf517a17ed16370fdb1f5f35a2e1926f411697ac14a249038a95b57a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133742, "uuid": "286b8ca8-ff06-4f6d-b8f3-403d3f170b06", "comment": "Malware payload (Mirai)", "value": "647c08c05e7aa7040444354b83a564d97707b2b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133742, "uuid": "f8897500-a4d9-4206-b313-dd682b38d92d", "comment": "Malware payload (Mirai)", "value": "433fb37c285290fc072f6651a8c3ddbf9b4918494ba7d102f22f0488dbd8231da32e9ef085005582068ef047a67c81b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133742, "uuid": "f5f03c7a-9bf0-4f63-95a2-8d68b272a81b", "value": "T1C0D2E069B34054FED93B51FB87F66B846FF117A091835C52BFAFE403C94B448784AA88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133742, "uuid": "fcbad502-5aca-436f-8da6-d9600483b6ba", "value": "768:V8FDOFWbbzsGWCrBOx6sKNkip1gDQkVB0LGspJgGlzDpbuR1Jy:V8ZOFWbbYDv6HSk1gckf4VJus", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782133742, "uuid": "2fdf19e0-33d0-4ac8-8700-2f3bd32308ce", "value": 30312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782133742, "uuid": "99942aaa-92a6-408d-aea8-ad63bd594188", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133742, "uuid": "74de0afb-dbb8-4e3f-8cdf-d37aad7fed3e", "value": "bed2dc64bf517a17ed16370fdb1f5f35a2e1926f411697ac14a249038a95b57a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d335654e-6e50-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782142884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142884, "uuid": "999542a5-0af8-4725-8314-e298fbc277f5", "comment": "Malware payload", "value": "3eb789b19a14d7687f2b4e1c75d934e4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142884, "uuid": "ea6345be-8ab8-4dfb-9bbe-4a527300d228", "comment": "Malware payload", "value": "bf102a6261db2e46c1d7b68883740a6e0a6b6a4787fa207f820a1a865b0b9a55", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142884, "uuid": "64d22358-ea78-45d0-bf1a-0a6b00845b38", "comment": "Malware payload", "value": "26e226dd48db814feea9f8a8449faeb927089ae2", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142884, "uuid": "3332e491-1328-46c4-9fbe-2814b6b137d1", "comment": "Malware payload", "value": "2e91ce79f412287ef5f6a902835bc53b6b82c1f4b8d14c07c4dc93cd63460f4d6001db60bcc023d8f4eb358065819b64", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142884, "uuid": "6ffdb313-960d-4397-a632-0120e6b9d8ac", "value": "T1F3057D1BB2F375FDC063C130839BD6B2A932F42556222E7B6584C6303F5AE641B1EB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142884, "uuid": "968f6515-a916-460d-9c68-eed7599197d0", "value": "24576:FnsmF24kuUOkekkJi3TTA7dr+plX4sEz:FnsmF24kuUOkek2i3T0RyT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782142884, "uuid": "7cd304a8-26bf-4114-909b-89eec4c9d0df", "value": 835216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782142884, "uuid": "68f6ad9c-2119-457c-96a8-3818af61a2b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142884, "uuid": "d15ee973-390e-4219-a2a1-ef8d0bed7b90", "value": "c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd7c1b6-6e01-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782108811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782108811, "uuid": "5080afa8-5acf-4c5f-8dd2-fba38c5aae6e", "comment": "Malware payload", "value": "29e33d99848524c1de72ca8cae00e36f", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782108811, "uuid": "fafc3d97-6a2c-4b89-932e-1ac1910e75f8", "comment": "Malware payload", "value": "bf90c692a297eb3237ec700f2660e230cf2a6c3d6f9ff8154ce6051c0b93ed0a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782108811, "uuid": "de57aefb-5bfa-4798-aa0d-ae07c0cf41f4", "comment": "Malware payload", "value": "c28c03751a1152562f569ba3e9f90a46f02e422a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782108811, "uuid": "1daee867-d906-4a02-b4d5-53f1e22c7187", "comment": "Malware payload", "value": "b7fb79b1d8208ed1f25627c405733dc879e3b2ec4b09de86aa16dd08a58f48eb25a6ed515aac00247e0443e1458b18e0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782108811, "uuid": "77ec76f8-6631-4c63-bb0e-3095f3de0242", "value": "T173934A31CE64079A0E471BF9FC961A61C9BCCA1A053210F4FEEA170D51069ACF7BE66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782108811, "uuid": "b0448ce2-8865-411e-acfa-a7de8b2dce0d", "value": "1536:AtA7gc5tqnFOQKvlmffNbOGxSG9p01xhZZ6cl0KrAJU5gzd:AO7gc54O1It9xSG9p0HTZ6g0KsU5gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782108811, "uuid": "ab8aa7a7-b0a4-4c59-ad16-4bd61ecaf2da", "value": 97178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782108811, "uuid": "f4f03ea0-ede9-4de6-ae43-b951652f5360", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782108811, "uuid": "ad0066d2-2cc4-4160-ba86-13c58e3aa335", "value": "Invoices_Records_confirmation_draft_review_06232026_print.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee8b691-6de4-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782096330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096330, "uuid": "562551f7-125c-4cd5-9674-8b84a7d50d64", "comment": "Malware payload (Mirai)", "value": "44e38bcd5b2a92cb32d7e794b3b150ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096330, "uuid": "b6f1f74d-c67a-4740-af2d-f608d716df7f", "comment": "Malware payload (Mirai)", "value": "c03210e941c3de902810021ae1364922f797eb3432f5d4390d3982c495961d36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096330, "uuid": "7d4715e6-5b77-4ee0-94b2-f4158d0a7d13", "comment": "Malware payload (Mirai)", "value": "e0faa89c46071c3d554513ad1f08d07563963ce4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096330, "uuid": "308f05a7-7242-428b-8c50-bd487178669e", "comment": "Malware payload (Mirai)", "value": "dcfa1790a68b4f1324f5d8fb0185ac6e5d0aa64dbd8d9690d98871ccbd252ba90e0267db6e56d38242b001330487d0a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096330, "uuid": "f2debe05-354d-4756-ae2a-388488147033", "value": "T140E31A56B9519F11D5C321FAFB9E918933136FB8E3F93102AD206F60638A99F0E77502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096330, "uuid": "7d944f7c-cd68-44f3-b5d4-3c74084124f8", "value": "3072:qwPFV1semWe8fn/I073ESgXnq0xc4/oaN7cD57mS8hquQiaurvlJDP8swL:qOXNmD8fn/H73b0xxoaN7cD57mS8Tfar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782096330, "uuid": "00e4f9af-efd3-4cf6-8d11-2ba0a24f1f26", "value": 153876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782096330, "uuid": "9c4e8082-fdeb-45a2-b029-9d902b9da4cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096330, "uuid": "202af1b8-fe20-469b-a2d1-d2f6d4f77397", "value": "data_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5a0c9a-6e3b-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782133697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133697, "uuid": "e04240d4-4171-44c3-a853-3b4af567ea71", "comment": "Malware payload", "value": "87974d5d79d9dfc976344c5b19446c19", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133697, "uuid": "c62e2dbb-dcb7-4899-b00b-977b755eadbd", "comment": "Malware payload", "value": "c07f58d0fa6f9678c04dda374a89fb5f003019a38f8e0c146f068fc4f1e2f775", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133697, "uuid": "63488a14-4769-4f2a-9dbe-0feb6c9af2eb", "comment": "Malware payload", "value": "e8c80c2c4381624e6a74fc6445d9aaa090760313", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133697, "uuid": "c1dcdfe9-a127-41dd-912c-9b83cd2cb5eb", "comment": "Malware payload", "value": "8cda4c353d4d351f61918176d90c2d55e6fb86486fe01c2d37a5644cd821f47ac0e344707ce5bf87eb24817038686ad8", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133697, "uuid": "84852218-d5ab-41e7-8851-4627d32fd797", "value": "T11DD18EE0B1E1323C668AD455E391139297801F9F35504DE6F62CA0E0CB9A2378658B7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133697, "uuid": "71ca361e-cd72-45b4-976a-2d077d92486c", "value": "192:ugnviNkcjzqR9BUv8nH20TLm9TLCHzuiFtePO4W885fE:Fv8kgzquOehLCTuiFsx85E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782133697, "uuid": "7c8c7d05-bc79-486e-af3f-1c521e100db3", "value": 6340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782133697, "uuid": "9444d0bd-56c5-4f4f-9492-b0cea67dc9f5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133697, "uuid": "00b927e8-2576-406c-83e5-e7482e21234e", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe14a419-6e11-11f1-ae13-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1782115898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115898, "uuid": "dcf53f14-80c6-4a24-ada9-417b0451521e", "comment": "Malware payload (SalatStealer)", "value": "52655a6db617f3bbf385564a47d783d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115898, "uuid": "220c881d-e171-4ef0-8653-dc56cae707dd", "comment": "Malware payload (SalatStealer)", "value": "c1b8f7f2093c2131b450a051d130c545f2fa5ceb44c6176204ef0b1f474d6c65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115898, "uuid": "eedf1ea4-359d-464d-898f-d8d53608216a", "comment": "Malware payload (SalatStealer)", "value": "514797b3d43ea786d77a25d678be74e17384cf87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115898, "uuid": "652c302f-1682-48c3-959e-8249b6c3ba09", "comment": "Malware payload (SalatStealer)", "value": "4b35954706cfd301ee53856a37bb3cd6d3d7ea5c2cbe07a7b11a16ef76e5457e7410e304e27229a69dbc11cc374c6c61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115898, "uuid": "4be33ade-e433-4a3f-8d50-b2bda796d0ac", "value": "T14BC66B11FADB95F5E903583100ABB37F63315D048B28DB9BEB547B2AF87B6A10C66305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115898, "uuid": "f08d1cce-b6f2-41de-8b0d-eeccf0f97f7d", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115898, "uuid": "65aa1b15-e45f-4848-88e3-2cce4045bacc", "value": "98304:FjNcCgYZpQtCB5NcQiS1IPsYaw4j3HxmcEsO/:MCgZK5h+Px98MsO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115898, "uuid": "1adf77d6-ae47-434a-b9c6-9f72ed990d94", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115898, "uuid": "5b5158eb-0497-4055-8138-757dfc794767", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115898, "uuid": "99381773-5aab-4a7e-b5c5-0878b5283795", "value": "dd9e5a8ef764babeb49e5a4154bea186", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7cd2e18-6e4c-11f1-ae13-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1782141201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141201, "uuid": "3085cb98-c13e-43ef-94bc-7b899322baa5", "comment": "Malware payload (XWorm)", "value": "bd7cfbdde12b8e155e4b174b2bfd0ed0", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141201, "uuid": "2c7c4185-7ca6-4ef1-82fa-e8a4a7a406b3", "comment": "Malware payload (XWorm)", "value": "c2574bcc8a31b914872643598086fd64f78d598ed34f5e225d1828ac9023ef4a", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141201, "uuid": "d7765ce3-1f4b-4315-9617-87f53e2e5a93", "comment": "Malware payload (XWorm)", "value": "6359ecfd39f0d5bb399e796f62847f08d8723c50", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141201, "uuid": "79e716ff-9619-49cb-905b-034fb5f5f4f4", "comment": "Malware payload (XWorm)", "value": "ff6b5b387dbe36dc3898ee47d0038fc2890b28b19d191c9dd00670dee1839869a1dd789767d99ffad15e438967e4a442", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141201, "uuid": "51b6805e-62b6-419b-98b9-2181b8cc51a6", "value": "T177A558B743A50A7180EEC6D8931A26E5E2D754324B429DBEF909752BC830CE711CD6FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141201, "uuid": "0fef257e-3a70-4d86-b7d8-5090ae5f910f", "value": "1536:PSefNgd/FCpzR9y3w9cAE/hNF4Ma+efNnBZnHeqAKw:PSefi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141201, "uuid": "3efe84be-cd8a-41d7-b819-db0d4b30847c", "value": 2117407, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141201, "uuid": "dc309390-73f3-4cc9-a955-6f532ee7acc2", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141201, "uuid": "3fb16e52-936b-408e-a714-244460503a7c", "value": "Orden de compra POF0000095.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0f2ec6-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141315, "uuid": "da4505be-f9e4-40a6-835c-b51a5ce6bb28", "comment": "Malware payload (RemcosRAT)", "value": "a10187dc89fce09242e663503d345c75", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141315, "uuid": "81494d1c-650d-498c-9381-9393131534ea", "comment": "Malware payload (RemcosRAT)", "value": "c25f4fb170e1dab5031e1cccee68da92fd5e80b1358edee914425066dd088827", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141315, "uuid": "90089740-f46c-42bb-8643-8065b89faa2d", "comment": "Malware payload (RemcosRAT)", "value": "db1db043dba12d43f572672630a08f661f260c7b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141315, "uuid": "a06e74fb-cc16-44df-aca1-d0f3ae40ce00", "comment": "Malware payload (RemcosRAT)", "value": "0ede25dffa46527350cb87f3232f0e30596b0558fb2ec07598062c5cb7b49d58f7869819dfbc1d5a583953187ef6fb7c", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141315, "uuid": "2c826899-079c-446b-8346-18e97cea18eb", "value": "T17A935B71DE6406994E471BEAFC912A62C5BCC61A023300F5FEE9134C61069BCF7BE66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141315, "uuid": "b36f50f4-f2c2-43f4-8664-f9b2fdb4a09c", "value": "1536:j1A7Al5GqnFOdGLlh9/Ov632IinKkQfyZqhcb4VvtJUz3QZrO:j27Al5xOUbAQ2IinKkSSqh24VLUz3sO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141315, "uuid": "b80d366d-3495-41d0-a97e-0bafd6ce1d80", "value": 97096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141315, "uuid": "113510aa-9d58-4100-b2e4-f71589e78fe6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141315, "uuid": "9fa11040-fa43-4e78-81fe-63919349427e", "value": "ORDER 246708_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d85fbf-6e5e-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782148742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782148742, "uuid": "914b6ad7-a029-4db2-adb7-89aa31879b01", "comment": "Malware payload", "value": "68c1e9e5754ecf6aef5d75810de2ebb5", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782148742, "uuid": "bdb7dd15-170a-4acd-945f-d4333020ba7f", "comment": "Malware payload", "value": "c2a48c158f3e73ff2d06ccfc31544a8286b795ffce958eca30d9a3a0c93c257e", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782148742, "uuid": "7c2e7287-aeb1-4ed2-b7b7-c66ccbd8a158", "comment": "Malware payload", "value": "7901579008a06197ecd74354a397342a5089f493", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782148742, "uuid": "977a96e1-ef33-42d6-b60b-a8293e623ea3", "comment": "Malware payload", "value": "7bdb671d08ab16b6a1e6549ecbfb7abd024ae64ac884e08b69621656bb49690f1f4e0e88f7290c7354067cdc46cf3f6f", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782148742, "uuid": "d3a25bc9-a49f-41e7-9288-9de44f3f2ceb", "value": "T1801833245F948CD6F56231399A916244E3F3BA6417708FAF0BC06B312E375FAAC79361", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782148742, "uuid": "e5b26ef2-d948-4ece-a425-5485d8017663", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782148742, "uuid": "010694b1-a658-4c53-8c99-b7701f86eb2d", "value": "1572864:4AYyyxBU7rUFpYjHK8o8iLxMtQ6ZMo/STJ6ppJ2FNwW5wF:4fxgknUc4R/U6pXoQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782148742, "uuid": "97cccff4-cd6a-4197-95f2-588c56691f38", "value": 85022075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782148742, "uuid": "1586ba2f-edc1-41fa-80d1-46fe51ce038c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782148742, "uuid": "6b976081-41fc-4dbf-a3fb-4dba5bcb8b84", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49456b6d-6e47-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782138787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138787, "uuid": "ff66d69e-ca73-4bba-89c6-18056da58d22", "comment": "Malware payload", "value": "9bd6df880bbe0fd7a6a610ab49daec0f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138787, "uuid": "e2980700-7519-4594-a103-da79956b9abf", "comment": "Malware payload", "value": "c5bb14bf2a888516c14fe64f769eb0ee5b06a4ddb038f6baabf69c65acaa8345", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138787, "uuid": "e76364e4-6f32-4599-acde-59277950b7d0", "comment": "Malware payload", "value": "fd66356020e73bd36f0963df901e40d38006e133", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138787, "uuid": "f717a041-3cf4-401b-a761-aa5a22c15863", "comment": "Malware payload", "value": "70c14df57a4032ee746e3eb3438cde84aba1f8f368df228b5a57de153f36f760a2f2da9737b6e351ae1a3638dd9dff86", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138787, "uuid": "50b73184-8166-4aff-9b55-5f07a31d9d12", "value": "T1B8577B1DE38417A8D717CA348A515E33D2F2B85607E1A48B0ADBC7071E77A935BFA231", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138787, "uuid": "f7699e82-affa-4cad-842c-80f22227fa39", "value": "9032cb35e0fbf561851a78bc86c51570", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138787, "uuid": "a1a8b894-180a-493d-b343-f0e10f011d77", "value": "49152:IwhlFWrE07CL6bPfcv+yG/HNox+1uzIDcKKQ3vAgdE9pMPQTUYuFc9/0pBlnKz:InWL/T+PQTUYuFc9/0pBlnKz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782138787, "uuid": "81bc4183-ec00-4ae4-ae04-3f61a2e76a33", "value": 28957184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782138787, "uuid": "5b10aee9-5f37-4285-9c6e-532ada4ee8b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138787, "uuid": "85bbb1b5-4a81-43dd-9b15-3f6029668f91", "value": "libwinpthread-1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2872dfb2-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141739, "uuid": "c3a5fdca-81ab-4957-9c6b-72dfee4ab7f4", "comment": "Malware payload", "value": "5b02bb32d68183ab3ae878fe26833ce6", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141739, "uuid": "35f4a419-d66a-4012-b68b-00836680c539", "comment": "Malware payload", "value": "c5dcd9df73a6df47ec811ec12d6aedf91bf76f296efda5448ac6a8079e583aad", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141739, "uuid": "554d90d5-60a9-420f-914b-6efa767cc82c", "comment": "Malware payload", "value": "523fac570c7a2f146abc0f12a39f0f59dce0929d", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141739, "uuid": "25bf8ae3-5bc7-4623-bce5-45df5432dfdd", "comment": "Malware payload", "value": "e8135cb7e5181d9d9b95fd910b16d902328d2af82fd99f725dc0e81b19d689390c31b079a61ab9da29e1124cd145c234", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141739, "uuid": "7a370823-9349-4b9a-8bcd-b741a19256ba", "value": "T19811F4151EAF1B40C15D4A356577B2B2CF237A527207960EC5641C0B2CB5D047F7AB67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141739, "uuid": "ba508f99-6e88-49eb-8a27-e51e036bad40", "value": "24:8sV9vm4xqqKwrARIk0Kk0+np7iCqfmrM:8sVBm4xqqkRIEwnp7itfmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141739, "uuid": "313a3ee2-16ab-48af-9d1d-b3ecc9f4710b", "value": 862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141739, "uuid": "0d298bb6-1133-45d3-ad20-95c16d16fe48", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141739, "uuid": "270f0c05-e1fc-48fa-9c37-28153a0b868b", "value": "FISCALIZED INVOICES.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10aafd01-6e4f-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782142128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142128, "uuid": "0b8f3acb-0520-42ea-82ff-a78698083172", "comment": "Malware payload (Mirai)", "value": "bcef7e79010fe824f59c471d9aa88bd1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142128, "uuid": "cd366a5d-8b09-4735-bb71-3dfc2a9d10dd", "comment": "Malware payload (Mirai)", "value": "c612cf9fdc785d4c089d6afcdec11b67e10abdfb1b9f5326403e52499349147e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142128, "uuid": "0bb109ce-0ea9-4f1d-929c-566f312af955", "comment": "Malware payload (Mirai)", "value": "160ff72683c93404862ed534b792c4243e544bf0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782142128, "uuid": "edeb7b03-c110-4049-8387-902b3bec3464", "comment": "Malware payload (Mirai)", "value": "575853680277744c3ecbc68635705147af8332ea33fe3f9c3dcff7ad0974baa76997e38003cde3ce8c054c1c7bd1369c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142128, "uuid": "35c33b3a-cb6b-492f-9302-34bb5f07902a", "value": "T16092E1A123932558D322CAB93FB8340FC518591371AD1A006D60A64AD95FB240CF9FFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142128, "uuid": "b13346eb-f1f2-4ad3-80a2-5d6c6ab9185d", "value": "384:yb2eX3zAKuiNPZRwwqdvrrduMXbCAk6Y5VvCYQ:/kAKuobq1rduMGAXSEYQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782142128, "uuid": "0691eb8b-9bd2-4203-9d26-9e9afbc8caa0", "value": 21150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782142128, "uuid": "23c0b32a-aa99-42ac-b29a-368fb4fc0294", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782142128, "uuid": "99720bb1-63cd-422f-9587-35c51e3dc53d", "value": ".i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88493f59-6e92-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782171105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782171105, "uuid": "a8d6657d-6c8e-4747-b37c-9828bbd1e6a4", "comment": "Malware payload", "value": "823da109920124f875d62a02349ff497", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782171105, "uuid": "6b9fc386-460a-4965-a0df-6007234e7598", "comment": "Malware payload", "value": "c61ed67b13946031aafde93dac33626ba0089fe467fffd723b4fb982ef79dcf8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782171105, "uuid": "2be36a13-48cb-4f11-8c18-9a913951e68c", "comment": "Malware payload", "value": "6f4cbb45cdb11633a83970855d95560a79e59b10", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782171105, "uuid": "8c121678-0cdb-4ed0-a8f5-76e168c32857", "comment": "Malware payload", "value": "eea8eab8eab5ac31d977ea7a4c44df8b039ca59716518c9d7b70d9cf8f8217913033e1eaadc438e899324207cece4a16", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782171105, "uuid": "cdfc7cdd-4a1f-4852-a5ea-5897f41e5719", "value": "T15A66BBBB6DEC361D3000B0C2F48521F5EA625335EBDE52D9B8F825327BFA49AC419746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782171105, "uuid": "cdab26a5-d7b7-47e4-8f95-793fc4041f88", "value": "6144:G170CygVOAf/rvR5OZ6HCN0PH5jtmjz3FhSU5APryouPdyDhfnmGtWZRVVaSu4xG:GmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782171105, "uuid": "54f9eb98-f2fc-425b-80d9-b53bdba46b20", "value": 6542498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782171105, "uuid": "8aac2305-4bcb-46be-85e8-c3171c492307", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782171105, "uuid": "5905c559-0f0c-4501-9f55-a922bd6ef861", "value": "Update.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf41c48b-6de2-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782095606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095606, "uuid": "5e03492f-33e9-49ac-bfc3-727f64f70838", "comment": "Malware payload", "value": "41dced704c3d94e43df2e751629ac5ac", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095606, "uuid": "471afe73-d749-4db7-a436-bc641499dd9d", "comment": "Malware payload", "value": "c6473b0fc4ebd18ab4ffe6771c77cece197e40299cac3745bbc12c0bea2261bf", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095606, "uuid": "e4a04fe4-d5dd-4e6b-90da-b56844960a56", "comment": "Malware payload", "value": "d4ff06a9937544058e1578e57a4e49fb346b9e80", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095606, "uuid": "b9b3f4d3-cf33-4d0d-9d0c-2cb549c71c11", "comment": "Malware payload", "value": "d904c6abb936d16ce208d83f891dfa9690188e6235669ecf1e4752632ed4253977240d74c4c5ad723d1edbea637a8e8b", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095606, "uuid": "583763f2-90b7-48b1-825a-367295e46636", "value": "T1A055AE6E0DBC9E77E53387FA451307523EFF1007A07221679D4AEFA97909F49828928D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095606, "uuid": "0ce091d9-5b1b-4389-909e-acbc21b975af", "value": "c129097361b8295c6461feaed5b0ddf4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095606, "uuid": "b31f9ccb-51ab-49a4-b1ff-4b7aec378598", "value": "24576:md9eqr39VeX5MWXSd0xX/XNkUO8CtFpQ6ROQTjxPNj37b4qmmX/XngS3q1:md9NNVeX5MC3Ct8STtF7QEg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782095606, "uuid": "7b2ea3ab-53bc-4b0c-9c5b-c673a5f912ae", "value": 1301504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782095606, "uuid": "4f687675-b94a-4683-8b99-527bdc026f06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095606, "uuid": "358e599a-2e11-4efa-aeae-3fa3d1976072", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a9f90a-6e22-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782123153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782123153, "uuid": "ad2cdf5f-7267-4693-90ad-e4e704d8a34a", "comment": "Malware payload (Mirai)", "value": "14a21b69c1f6b65326988f49cf609efa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782123153, "uuid": "f521830b-ce41-491d-a90d-7f079e4da025", "comment": "Malware payload (Mirai)", "value": "c6c610c4a87288ffab02792b90a617b1591dfe8c3e55e6380520fe9e875c7ebb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782123153, "uuid": "f0050723-970f-4a17-80f6-3e66879d84a0", "comment": "Malware payload (Mirai)", "value": "faf248d25e0a76d2cc06dcb1596463e79b56c306", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782123153, "uuid": "6e3c3eff-0b84-4801-aa55-7e5d55d7ee08", "comment": "Malware payload (Mirai)", "value": "b5f6b9ba81c21952c8497cb3da28b426240bd1d339406413606d05c916bea6331f54fdfc07b0c911aceb0b773354070b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782123153, "uuid": "819dddc7-e516-4aac-aa9e-40c533c1c9f8", "value": "T165131A35FA621C2BC5D4A57961E34325F6F5839B10F88F2B3EA10E8CBF64A8031576E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782123153, "uuid": "13f51bfb-0642-48ff-adca-1edac7de58b6", "value": "384:3hD7Y79O/dUpQTgKVxy21JUcprGrlo8qxCwFU+pCtLoRlPUbl5d0hTtc2S8ePSLz:SJkdUpZ6NVHXO+c5zblj01tNIqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782123153, "uuid": "e6875183-4ad0-4776-b099-ff15dc6f85b3", "value": 43256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782123153, "uuid": "8edd6baf-a829-4b2a-9ca1-529abb194d62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782123153, "uuid": "c23d2bea-0573-4beb-bf58-8182915828b3", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78199d28-6df5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782103647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103647, "uuid": "4137228b-695a-485f-9f0d-c084b5d78e4f", "comment": "Malware payload (Mirai)", "value": "2a5e7aefd7fb06de1567879d3244d917", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103647, "uuid": "fc51f046-a937-4012-b635-717b78aa0737", "comment": "Malware payload (Mirai)", "value": "c7d5e21a01ce8ab4083c588d8050b286d375eeb88f41fe68b22ca02cf1bb8f8a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103647, "uuid": "e445df49-e5f6-467d-ae9a-644eed89415f", "comment": "Malware payload (Mirai)", "value": "0cf1ff8eef7876143ffd7b5a4a3ed83724bac64b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103647, "uuid": "cf969342-c02d-4c15-be62-74a2bbf4c5d8", "comment": "Malware payload (Mirai)", "value": "8373ac74bd87f1396e3f5a08cff33c0440e34f7a13ce089262a7bbe942d31b7ab24c1f0c28859f8ab5f8b3a8aa728222", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103647, "uuid": "319daf70-009a-4ca2-8d5e-308702e66122", "value": "T120B32A86AC814A11C5D613BFFA2E118D3313277CE3DE72129D205F2477CA96B0E7BA56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103647, "uuid": "bba93920-1114-48e4-96f1-8087d7946d85", "value": "3072:RfxGIfE1qVXbO4bnOfGZKuafrfLcTVLao66XmfeaMFM6xu9:SIfvlDDOeZKuazLcTpaPImgMmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782103647, "uuid": "ea3c8c6e-f5a2-4277-90dc-1bab7256bdf0", "value": 116104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782103647, "uuid": "931cc29e-2c01-4e17-8e38-a8d196f3d697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103647, "uuid": "78b9c9fa-903e-4888-8114-d5f7bc2d0736", "value": "nerv.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36e16c8b-6e89-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782167103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167103, "uuid": "84506c44-6bc9-4f56-ad09-430c437118d0", "comment": "Malware payload", "value": "dd587c58c02d7cfb41d966d2fe21cecb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostShell", "colour": "#768394", "exportable": true, "hide_tag": false }, { "name": "MB-0009", "colour": "#E8335D", "exportable": true, "hide_tag": false }, { "name": "UAV", "colour": "#F3B08A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167103, "uuid": "eebc836c-a6cb-43d7-9ebb-489197e054c8", "comment": "Malware payload", "value": "c83272741d42a7aa738fbad85e21d0565e50cbf3b72f32b835c225965b3cc207", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostShell", "colour": "#768394", "exportable": true, "hide_tag": false }, { "name": "MB-0009", "colour": "#E8335D", "exportable": true, "hide_tag": false }, { "name": "UAV", "colour": "#F3B08A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167103, "uuid": "7ba86aeb-bda5-44de-bf40-cbab00b66aaf", "comment": "Malware payload", "value": "33f892e7f518efd51d9f658109c0c03935d7dd1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostShell", "colour": "#768394", "exportable": true, "hide_tag": false }, { "name": "MB-0009", "colour": "#E8335D", "exportable": true, "hide_tag": false }, { "name": "UAV", "colour": "#F3B08A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782167103, "uuid": "ead63515-e12f-48d7-aa01-e8b0255d72b1", "comment": "Malware payload", "value": "16511d093fa0f7ff0df7a0c20ef15031947f5b2b75b2b24cf2145f19c64aa1342f16ad0acf2f83b538fe8c3ed2a22c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostShell", "colour": "#768394", "exportable": true, "hide_tag": false }, { "name": "MB-0009", "colour": "#E8335D", "exportable": true, "hide_tag": false }, { "name": "UAV", "colour": "#F3B08A", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167103, "uuid": "fe8b67ec-371f-41e9-a0d2-b179cc2fe3d0", "value": "T12D146B5573E601E9E0B78238C9624612F773781507209AEF07A48779EF27AD0BD3EB52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167103, "uuid": "61efa23f-8958-4bb4-a9f5-201a2434f287", "value": "99aecc3412eac2465d7f730b52110b8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167103, "uuid": "f6fb7a9d-23f6-4811-8735-b547b5d8fa16", "value": "3072:MZz6EtBdckoP/4tWznR7lvVBXKZe2clQMEkdECt39JgAN4z9:EzVBG4tWDtzwZBGtn3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782167103, "uuid": "ae4ea837-088f-412f-a1a4-4f7e9b85ce69", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782167103, "uuid": "50072221-bdd4-4e63-b1a6-3aa1a44a030c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782167103, "uuid": "6c37dd3b-2a6f-4e6f-a183-ea1ef548de8a", "value": "stage2.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153414b3-6e45-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782137841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137841, "uuid": "250b3115-d976-44a1-86cd-221cf9affa87", "comment": "Malware payload (Mirai)", "value": "6c533f0ae1236042ce2ac05e81719feb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137841, "uuid": "0c551b84-0950-459a-88ce-ad5a9aa3c3b5", "comment": "Malware payload (Mirai)", "value": "c8545034cd4fe71eeadb24dacddc5da95c4311c7112c299f1325801f3e06f928", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137841, "uuid": "01ed053a-e6e4-4c28-a531-46d3c58f96d3", "comment": "Malware payload (Mirai)", "value": "7170172f780599e295bf76fbaf8f2dcde28d955e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137841, "uuid": "b76e53d6-18b3-4e86-8cc2-64cfd75d9631", "comment": "Malware payload (Mirai)", "value": "01ad5c5b4e466a2c8d66f44b7c825857fbe7ade778f93479238f16dac448cd6d45512a1fc58b51b4699efc6caf0fc265", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137841, "uuid": "bbe66599-5103-403d-a10e-44f1cadf4448", "value": "T1B2D32A86F68780F6E41B88706067B23FCA32857E8033D65AFF955E71EE2758651323C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137841, "uuid": "9c7dfce4-2237-468f-a87a-d2e1126b6346", "value": "3072:C1HC8MoqKmibjuoJPsXy8bhXKqIWBpLkizyP62MIT:iEi/uoJPsB33IuIT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782137841, "uuid": "92bae9be-d491-4f7c-a709-9e354af12fec", "value": 132596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782137841, "uuid": "0a71de74-d79f-4ca9-8bf7-c8a45309771e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137841, "uuid": "991228be-89b1-44e0-92d5-7b5be05a59d5", "value": "c8545034cd4fe71eeadb24dacddc5da95c4311c7112c299f1325801f3e06f928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d739238-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141881, "uuid": "79441ad5-a33d-4aa5-a353-5dce77f2c1c0", "comment": "Malware payload (AgentTesla)", "value": "738f3a4f810ce80c810ea6afc5b91552", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141881, "uuid": "8f792a43-b629-41d0-b5e0-2cb15feccf00", "comment": "Malware payload (AgentTesla)", "value": "c8783cbbf98e577eb1881e0973c5f7035bb880a8da36d57e0c6edd1e855d0a75", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141881, "uuid": "508fdb37-6141-479a-a21d-6d2917213f8e", "comment": "Malware payload (AgentTesla)", "value": "7d157dd6e45d7a46d200e191cfd29f257967c4b5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141881, "uuid": "d3101888-3075-41d9-b8fc-bc3bd7dab81b", "comment": "Malware payload (AgentTesla)", "value": "7a294c708285bd6bcc361fcd0f2882760897a53fe3383cd046f1b9913a0d9181f478507db1c28c18892271d0ba5ae2e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141881, "uuid": "2da48e73-b57d-417a-a1f3-4970fb83b602", "value": "T198B3434127D8E44C13E36B7A361FB1D6F4AB1CDD6E54854BE200F8D0E4B824AEEE56B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141881, "uuid": "1801d2b2-fdf6-470e-9222-dbc5c65153ec", "value": "3072:CaJK41uVqGT1uWFvGs+Tq9iK8YappH8cV0UuNL:Cs1uVqC1nFvn85mL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141881, "uuid": "6fdf6e23-3405-4889-901c-b26e6543d914", "value": 110273, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141881, "uuid": "ed72917a-7c34-4e88-a050-1022fc3817a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141881, "uuid": "1a87e201-320d-4eae-a88c-364713556fa5", "value": "2026.06.22 Juni.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfc2a37a-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782115417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115417, "uuid": "a7661225-792e-4a36-a253-e8ff9eeec450", "comment": "Malware payload", "value": "08d0e3516f4937eef972464bd4665e37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115417, "uuid": "71dc830c-4dc5-415e-9870-bd6f4813fadf", "comment": "Malware payload", "value": "c885e69942529c7f73a2e42f39fcc0008ff8fa80f27028427478d4147140e195", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115417, "uuid": "aaf30356-18a3-472f-8157-7f1566cfc577", "comment": "Malware payload", "value": "3234cb0ab1ec82546ac3a006a51298c1a8a524e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115417, "uuid": "1f9728dc-ffdb-4062-9878-1cb6c945930c", "comment": "Malware payload", "value": "41e2a5a153f790ab40207234392403697b75546a7c0d3312f3c1b12e63589ad86f6731f5a45eff62bfc32b2046789763", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115417, "uuid": "e203a0a9-7c10-46d6-b457-e6966e787559", "value": "T1A74717DF54715599C136B5B3B8BEC7BC1ABA0DAFD44E2048712AEED279D03D310868B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115417, "uuid": "2fa977c5-092b-470a-aa53-29be02aedc8a", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115417, "uuid": "9116620a-4cb4-4282-ac98-6d5e9945ef13", "value": "6144:LwcsCc8D4+SRTAF11Idp+XffIPo94vxxla4NF55Bz7Xl7R9u+GmAfFN:Lw/SD4+SRTH+Go6LffVJR9u+QN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115417, "uuid": "557b1bee-4dd6-41d0-8992-c98560ad28b9", "value": 25775104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115417, "uuid": "10f37d8a-0f7e-45a1-91a2-c61beadd36c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115417, "uuid": "a216db34-5e29-4058-acda-44b3262738e7", "value": "VoiceMod.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d718d8-6e13-11f1-ae13-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1782116503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782116503, "uuid": "bdd01339-d89e-4fbd-8fbb-e2f05fa27780", "comment": "Malware payload (PhantomStealer)", "value": "ab525145e57509b5284bfafcf339ad45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782116503, "uuid": "d3c6cf54-470c-4c28-8c78-673b6a3f0f93", "comment": "Malware payload (PhantomStealer)", "value": "c8b4ce8bd2ae8e48dc2ab2d322faca65c673312dfa22751877e97426cb7b760e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782116503, "uuid": "90932e40-cc31-4105-bf6a-b79fc5a096e7", "comment": "Malware payload (PhantomStealer)", "value": "f576ede4e8e19128e703880f11460a4e35f0420a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782116503, "uuid": "2e102890-c428-4a24-a37e-2d875e9a80cf", "comment": "Malware payload (PhantomStealer)", "value": "6a7b762d2c629c4ee996aa8c636914ca011d477028c037f7da8e8352af386b940b69d77e2a2566aa33720d76e653623f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782116503, "uuid": "2102a2fa-f01c-4111-b832-f6cc70427d7a", "value": "T10C7502182259DF02DDD90FB2C875E2F063746DC9E821C2879EE7BEDB76757416E002A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782116503, "uuid": "87b45e14-c7e1-472c-a1f4-e8aa8a2e8655", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782116503, "uuid": "bd0e4f61-22ce-40ef-88d1-520eb1fa3f55", "value": "24576:x63KOepcDacYa3ku5JdHtKjtdyXaa5JgYVYA93ebSXzoEQ/JgVt1wt4:U6JpcfYaNSvyXDgYVY7WX08z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782116503, "uuid": "48bfe54c-6c30-4d16-a39f-45d745437da4", "value": 1610240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782116503, "uuid": "d1ca64a2-ed3f-4a34-b4c5-e2196d21c2cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782116503, "uuid": "a030d612-8498-4a0e-ad79-911ac20eb60b", "value": "mfqsJDOpsGEbaVJ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d7cc0c-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141900, "uuid": "872845e2-f3c7-4bd0-bfb4-f9acc459d7f1", "comment": "Malware payload", "value": "bcfe6f0c0ebc908f9ccfaeeac7d7e202", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141900, "uuid": "f75a8ad8-19e7-412f-8445-ac7c3bc7f941", "comment": "Malware payload", "value": "c8e983ca3ac66cde482a2eadcd5db559156992212d5d73f9585df50c0a8871ed", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141900, "uuid": "324639e1-cdbb-44e1-bd93-08fff9fd951f", "comment": "Malware payload", "value": "ba49d63c8cd0c20f1f58e973adcdc662c4781de3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141900, "uuid": "6b00de0a-bc49-493d-acc5-ebf861df29ab", "comment": "Malware payload", "value": "cd44046de7cd0fe67f71cf5450dbc11d7a0eafd5583ddd7ab5e18f776b445589e8939e65fbc52ba650489ead38a0ed67", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141900, "uuid": "f4128d19-3de1-45a0-88ce-a1784d50c236", "value": "T1BF750F24F719706CE6F3B7568F8DB291E70EE2B9065FC9CA5061A39D13A3B05AC411BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141900, "uuid": "29059fae-b55e-41fb-bb01-f84b485a8532", "value": "6144:NUC/70PT/Ak48QDKZYQz5xqyy61Q9au2FIZmlz6v9N2JLQbC+TTRrKy:n0oHTyR1Bu26lf2JLQbC+TTRrKy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141900, "uuid": "aa5e5fd7-471e-41f2-8bd1-0444faa81d07", "value": 1602932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141900, "uuid": "f337d7c4-e741-434d-9c1d-c447ba883d58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141900, "uuid": "630e151d-8611-49d9-8822-62de7b80c226", "value": "PO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e83376c-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782141776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141776, "uuid": "f38442a7-1b00-43ad-b815-db328d8652bd", "comment": "Malware payload (Formbook)", "value": "8c04259c0cbd38f12acc3036f9ec9673", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141776, "uuid": "c054f3d6-47a1-453c-8ad3-80508eef68dd", "comment": "Malware payload (Formbook)", "value": "c9914dfb295d673caef2fed92265abd7d3872fa264e246a25188bb24adef9f0a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141776, "uuid": "dc85b511-e844-4f4b-9b2d-ff1989b9fd33", "comment": "Malware payload (Formbook)", "value": "65f3b64df8d6a6de808f48aa36cd66ef193fe4c2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141776, "uuid": "fb0cab47-5798-4266-b486-1ede1e56f079", "comment": "Malware payload (Formbook)", "value": "41cc8889e342aa29d688303b326125c7ce0fae55cec13cba7a29f5806696ec9e704287d3be5e18b692d6d483ff9e52e6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141776, "uuid": "ef2d6e0c-a90f-4cd2-aa62-b8c45d35d337", "value": "T110F27A62B4F61041DD7466424A9EB393A7FD0F1573CE97F7220AF2D01A232FD8296179", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141776, "uuid": "622a19ab-a7a3-4154-a617-c6fe1ec9db25", "value": "384:FhP8Or/vPg89aRdln1ubPCn8qgYCne/XIyX:FhP8Or/vPg89aRdln1ubPCn8qgYCnP4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141776, "uuid": "dee4aa56-693a-497f-b834-12e0814f26a6", "value": 36821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141776, "uuid": "57d7bcae-e295-4e84-8854-bc46db7db592", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141776, "uuid": "ad819196-e7e3-4ba0-95a9-2a01e3e81ac4", "value": "Purchase ORDER PB 2400I TP1026230.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d33b38b-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782115306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115306, "uuid": "ca71cde0-be91-4eb0-8024-64df3c0f542d", "comment": "Malware payload (Vidar)", "value": "8d7e1b9d461f8a1557062786174d2d74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115306, "uuid": "77ff2a39-726d-4d07-a3d5-f642771b9b50", "comment": "Malware payload (Vidar)", "value": "c9f77f2a7cae28d3a7bf48b365f284d3189ad6c57d66145a22c8371110da2081", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115306, "uuid": "45702288-56e5-4826-8d99-5fa1b4dfbe83", "comment": "Malware payload (Vidar)", "value": "96fe4f933a6bea747a05408e9bf1650f9aee6f67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115306, "uuid": "79ee7a74-43bc-407d-99c1-d0011aa6849b", "comment": "Malware payload (Vidar)", "value": "64d37a22e18868813962a95dcb0493bacfb40c3cf7af2ad944cb6f5ca32eca36dc81e7856a3f2f81a4a5f1d44d78c066", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115306, "uuid": "6358434a-195f-4098-8ff6-fe8a3eee1d46", "value": "T1133219C77093A0B8C24A82BDC947117FD7A9305D070F1FBF57EC8B901AC29917AB9699", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115306, "uuid": "eba37464-e3dc-4207-bd92-6b821b45d5f8", "value": "17a4bd9c95f2898add97f309fc6f9bcd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115306, "uuid": "0dd38321-d37f-4103-96d2-779c7e2bd523", "value": "192:eGzPrxaF4qQCyoeMmG2+5fu04bqvbCnUW1DnoWGAjAEg24mAn:eED4FZQIeMJ2+5fn4bqTCnUWhoo8ERon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115306, "uuid": "d57f68b4-0f82-4783-bb5c-5baeb798f045", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115306, "uuid": "64c1e29c-6291-4a84-847c-c3f5ece801b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115306, "uuid": "b7f40736-c14b-4adc-b374-e19d18fc0de5", "value": "8d7e1b9d461f8a1557062786174d2d74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3187f3c9-6df5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782103529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103529, "uuid": "13ee1c75-6dbe-4b23-be5c-42c0e98bb938", "comment": "Malware payload (Mirai)", "value": "8401e0ad8b9268122f444a5eac24fbc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103529, "uuid": "4430bb21-45e8-4004-8be6-db1e0ac1c3ea", "comment": "Malware payload (Mirai)", "value": "cc281983d78727a9db9a1cfd24cbd45b2cc98025d5da262a93dca5a6b16075c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103529, "uuid": "5887c7ad-f0ce-430f-8769-c498f93f44c1", "comment": "Malware payload (Mirai)", "value": "f036f8698588b5a7bcd156bd4919d14bd9e5887d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103529, "uuid": "ed79e869-63bb-46a9-9060-6e40c9955b6a", "comment": "Malware payload (Mirai)", "value": "2c94aa0d2383424e02977d2490ccdedae31bc0caff9f23f08f9d08e81813cb42e29fb0f0462e4d652207e97c60532f6e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103529, "uuid": "4c4dea30-13d0-41ac-bed8-220011a2e4d6", "value": "T1D0B31851BC825612C6D612BBFA6E418E375623A8D3EF3213CD255F203BC7A1B0E77652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103529, "uuid": "63d70ecc-ab5e-40a5-af0d-6d8130b3f2c6", "value": "1536:bjcuL8lzTm/NWSGmQAf3ilNUsdnS3qF4h7Fo1YWDavLKbU/t5ttm1rO4nl6DoRa4:bjcKamISANUsdnS3qWJnW0LUU/t5nDu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782103529, "uuid": "1b6db948-91b3-4db2-97fe-f1132cf7e73d", "value": 112020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782103529, "uuid": "bc74dfbd-ed00-4eef-82ae-6be149992642", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103529, "uuid": "09f56f63-7db0-4fa7-a6c7-26dd89187367", "value": "nerv.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0af203-6e07-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782111494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111494, "uuid": "e55bd1c4-a59a-4380-bcd0-5953a6098481", "comment": "Malware payload", "value": "d6e724b815e099145d97ab0ce05cee25", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111494, "uuid": "0563d5f1-209c-4d6a-87fb-9f6389ce35fe", "comment": "Malware payload", "value": "cc4c6c5a2b954df4d39676998afd0c111587c8dc58370f80215bfd8684fa84c3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111494, "uuid": "eaa81e63-ac2f-4a9f-b3bc-917b087b4749", "comment": "Malware payload", "value": "ab9e2ccca7ed9d1a0a172604e7cd7c05b3adf2c4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111494, "uuid": "c892d751-2a05-4f86-bd24-4c7288fbd1b1", "comment": "Malware payload", "value": "b8dc1a188b73aaac7993fcacfdb59218f1b8b5d3a26605b4411f7ca920fd2c5148a436c4081b7db8484718b10d5ff5dd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111494, "uuid": "fe1173cd-ede3-4cb7-8d96-f54639181ed6", "value": "T154734B60CA1105B78F43BB98BCA90221C67DD321952709B1FADAC70D910E9ECE77D69B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111494, "uuid": "623e3803-421b-40ba-81fc-6b96f770bf13", "value": "1536:hywYUcam97AcX8AD2J+XVbk4zEumnMcXugYcXtP36+X5Zf:hywYD9lM3JgVYCjmnhXug9tP3tXXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782111494, "uuid": "9bd82f43-99b6-4c46-b579-64a1a18f9383", "value": 76966, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782111494, "uuid": "e790e122-5a36-48ac-b1b7-501c430ff3a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111494, "uuid": "3f37c3c2-8694-4bbd-a5a7-d5b733cfa78f", "value": "awb_fedex_shipping_documents_notice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeb53955-6e36-11f1-ae13-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782131656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782131656, "uuid": "d4db95da-8e9d-4557-af0e-b4155e5a7d27", "comment": "Malware payload (Formbook)", "value": "11804a7a28b2ce0b1a71dc079ae33dae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782131656, "uuid": "73c0cf81-7533-4cef-ae90-ab8043ee8628", "comment": "Malware payload (Formbook)", "value": "cc9dfcca94f44e8e1897099cebfcd4d7eb6dff56baacf1ed325520842a06e7f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782131656, "uuid": "d3ec5366-f3a6-4965-a0dd-3fbe4a710720", "comment": "Malware payload (Formbook)", "value": "28f2c59a861548a23574be7dcd43618be503677d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782131656, "uuid": "b146ba94-16de-4d45-ad4e-2d77d0236d08", "comment": "Malware payload (Formbook)", "value": "1c7f869a1c046e2589dac18fa1eb475cca1cd2b12e99128f802ece01db3e830630cdbab924eeaf2f35c022b46fdcb2ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782131656, "uuid": "1ee760b4-d2ba-4458-9c79-4f7f732fda72", "value": "T1D4A512ACE75786CDB75D805A92EDF628C1F25687081B056D42C8CEB3C7087A3FA11E76", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782131656, "uuid": "e251fdcf-de70-435f-be27-e0928468226c", "value": "384:+UzUzUzUzUzUzUzUzUzUzUzUzUzUzUzUzUzUzUzUzUzUzUzUzUzUzUzUzUzUzUzA:BA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782131656, "uuid": "37648c93-9146-4350-ab74-436ee12e3ce2", "value": 2262298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782131656, "uuid": "e8a99e88-f501-4b24-8caa-1fb8f78587b8", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782131656, "uuid": "9450b314-5f52-43c4-aa66-43f66b8b7719", "value": "ProformaInvoice-WES 5628-1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8a5a50-6e0c-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782113613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113613, "uuid": "ae509e93-7db2-4195-88c6-b4b72e973583", "comment": "Malware payload (Mirai)", "value": "5b9885590358a24c73339a03890e27f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113613, "uuid": "cc15ea81-99d0-4462-aeec-8d9716cbbc24", "comment": "Malware payload (Mirai)", "value": "cda41d8a4ee87b2e193bb764c400c15f97ff741dad69b8c8ca1462324aa9ed5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113613, "uuid": "548fe084-4055-4d4a-8632-98a3d410f129", "comment": "Malware payload (Mirai)", "value": "0f6fa436bcf5f7a6b17bb2ee24959b7e22cd2fe5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113613, "uuid": "f1a7a43b-9539-4ea8-990e-3bf86a5ecdde", "comment": "Malware payload (Mirai)", "value": "c39115021314afe50fb2f0af4988c7ad7afe770ee91d77e146f34f54c25fd819a82df123398c3c359533abf799af35bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113613, "uuid": "6e02bd1c-8709-4945-be8a-849e89412ab1", "value": "T1E8C2D070F8C1BDF5DEBEAD34885085D03BE51E493BD28DDA208DDE215212D3696A8A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113613, "uuid": "47903b82-693a-4bb9-ac72-60e6f08ca009", "value": "768:7KnqLiChP7gI5gBZw+LajR0u4uVcqgw092:7KqL1h4Zwa6qu4u+qgw092", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782113613, "uuid": "cb017fa4-eab6-4974-b715-610f2532e596", "value": 26224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782113613, "uuid": "e9f40f56-96fb-4bdb-be13-5f4006a5a107", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113613, "uuid": "4168516e-4462-475e-a14c-d792edfbf914", "value": "sora.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b01e9dd0-6de5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782096869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096869, "uuid": "1ba900a1-6ba1-4891-b544-1a553d4cf6de", "comment": "Malware payload (Mirai)", "value": "356a1243d88a22d8221d57aea7c3caa0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096869, "uuid": "a23f9f79-88a0-4885-9fc5-358937d0941a", "comment": "Malware payload (Mirai)", "value": "ce0b3137383e4112269155f36dfa6c238f6e4d57d73555c15b2c4ef796afbab3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096869, "uuid": "b70efdc7-5675-434c-abfc-4bd6080663a4", "comment": "Malware payload (Mirai)", "value": "abfd63d9eb74c5e6167850a2ef375e81893adab5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096869, "uuid": "f8d82b44-82e4-4929-a846-625b619465d1", "comment": "Malware payload (Mirai)", "value": "c24bff910c1e5889d198cb6b4d2731a59623ccce34cf82acb82a965ae8d1e55a1dfc2bc6083744d60e55786b67b78830", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096869, "uuid": "74efca95-bc16-4410-a50e-de3eb4289673", "value": "T16EB2DF34A2A964F0CD306034F57D8D47A7DA41FED0FD7622326750E85A468CD1AAC6D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096869, "uuid": "d1d70f5e-0e01-4cee-839f-6e0c2f76acc4", "value": "384:IoBE5aNSS75BOI+ypZ5vTlYIwcvsdTf5MF1iAUgefoeDYbZXGcH1bUhymdGUop5w:4aNSq5sOHpTqncvsdDePiAUgefoeDeXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782096869, "uuid": "0cee7388-4e60-4237-b184-55b80ce8b23f", "value": 23720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782096869, "uuid": "a16e4905-ffb2-4b9c-a7b4-a3687bd7dc82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096869, "uuid": "f2ea4625-25e2-4326-9228-b1ad0151bf4b", "value": "sora.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2738543-6e36-11f1-ae13-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1782131689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782131689, "uuid": "911e34f6-819c-4507-b8e0-86c37f26bef8", "comment": "Malware payload (SilentNet)", "value": "b8bf1f89d0d89c1e8f0a8af92b34afa8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782131689, "uuid": "9320d66f-a1a4-4af2-88c8-394b7a84c2f3", "comment": "Malware payload (SilentNet)", "value": "cee20b0ab5a4f45984e8692355fd73082c52120875101bd3ff87d07c82646ee7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782131689, "uuid": "c912acc1-28d9-41b2-9f23-55045ce35b5d", "comment": "Malware payload (SilentNet)", "value": "3405920f9737f5526176bd5f7808a939b8f45621", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782131689, "uuid": "0e755542-7ffc-4907-adb9-e1dcda9a45f3", "comment": "Malware payload (SilentNet)", "value": "d242e7049f56d0ac2122e10260762be4b655810f04fee10de81d4c9fb12679983fa83694d12f26f09e31bc7f3ac827ee", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782131689, "uuid": "e8a9c3f2-2e3e-48be-b652-c4d5e27c8e6d", "value": "T169562378D37E7176C98F3E304A0766CF27D6528AD6103D4F2A721B65BA0F2906731BA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782131689, "uuid": "dfedde1c-f16d-460d-a0cb-5dd67b46d0e5", "value": "98304:72XBrokwVgCXeEpiOQGWc8IQYrc16j5E0iGcPg/lIDAsXJoEiVQIUize8Tk7wf:YegCupOQ/+QR16j5E0b4guROXpzp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782131689, "uuid": "510a3da2-4936-4412-b533-44934f8322cc", "value": 6185180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782131689, "uuid": "a0bae4d6-fef5-47f2-a10f-1307c9c6f2d4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782131689, "uuid": "d8cfbdf1-6df3-406a-b43b-81f4af06c8c3", "value": "Krypton.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bfe50fd-6e0c-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782113505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113505, "uuid": "1f8552f3-8380-4248-acc2-3cd397f595f2", "comment": "Malware payload", "value": "d220857c10f1f2cbcf974a171e77d1c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113505, "uuid": "8d1e7883-0d19-49a9-90b7-668db3b5c0c4", "comment": "Malware payload", "value": "cf0897b743ae453cfcaefb59e6291c27c22065998d79efe37123015e7877c801", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113505, "uuid": "4d10ac24-aec7-45cc-9648-71bedaefbe4b", "comment": "Malware payload", "value": "c0ff34d9db93311578f5773e14e37f6cbd88605c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782113505, "uuid": "1e760d63-4b28-4722-a78c-92c15a2701a2", "comment": "Malware payload", "value": "929e6420fedc22ca2ed30e20bb56c6d64d4f2525cac85ba314eec7cfd23d51d58d96364d3bfa936204dc8b5142ea4a5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113505, "uuid": "22573ab2-9f80-4e60-89d7-73515155d6c2", "value": "T1A028336C5BB099C5F897923F9911A632F8F0693C61274ED686D923383D873EB4C3C166", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113505, "uuid": "ca859c85-0013-414b-a6f6-ffd87ae95ada", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113505, "uuid": "ea0f08b8-f3e1-46ba-ac17-1a17909a2295", "value": "3145728:2v7ig9NXQSn/HHwMkhQpR/26IhSatUUpGudsY:U7t9h7/nwMkha1rPUkCsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782113505, "uuid": "46af3411-6161-46ca-952e-76adbcb00a4b", "value": 102272173, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782113505, "uuid": "4626cd1b-787e-4705-a237-56596ac3f2b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782113505, "uuid": "0f06b0b1-1dcb-4f16-8950-46cc029d9e15", "value": "MEDUSA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6abd741-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141977, "uuid": "f692b0dc-adf8-4aa5-9aeb-e72d1f60926c", "comment": "Malware payload (AgentTesla)", "value": "fe5dfd219a1a98be46810e66bb794ed8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141977, "uuid": "e171e39a-37e7-4c6f-87f8-df3ca2d4f276", "comment": "Malware payload (AgentTesla)", "value": "cf9161ef4c3a30e7f4f963deea1eebfa0babb1718b9038e8318f9c57a497cd6e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141977, "uuid": "9a90961d-f230-4a98-ae94-7a0012099459", "comment": "Malware payload (AgentTesla)", "value": "3a21a27d4f2cfc1eff19ba05fef31d9a15fd9721", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141977, "uuid": "17196188-a8e8-4dc5-abc1-760c1f5ebabf", "comment": "Malware payload (AgentTesla)", "value": "ec31791ce53cd7d8913a991808c3b6ca4458b3f3c273c9a41950cd31633a47424821d4a18214ca4b443c1149f6f8d9f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141977, "uuid": "d26be4e5-a641-4b76-a518-e651d7474093", "value": "T186063C6194307258696DCB3ED0275FF4096F700B1A3CBD7E36A9921899C2F8B198F4E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141977, "uuid": "3bfd3bbf-c744-4692-990b-dac4d0d91925", "value": "98304:NNHMj2fnEZ3Sn7VzdPAASBjNC6tKgtL6iqao44SLjyXeVbi0mVgC94GdjOvFQ4:N5siEZ8XUwVl94G5wQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141977, "uuid": "f983a014-457b-46c3-a91d-f30c84a6bcae", "value": 3777936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141977, "uuid": "f63d3d23-0a41-4c91-b7a4-d8803f5b44e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141977, "uuid": "70e78aa0-c7cd-4dd8-bc53-36a7c81fa29f", "value": "doc-22305447dubai proposal2026.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8cb3f4-6de5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782096940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096940, "uuid": "f9ff16d9-e67b-426d-97c9-7cb2ad46c024", "comment": "Malware payload (Mirai)", "value": "992a89dd9d5edcca926b68e4afab8188", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096940, "uuid": "4f0e2f13-f974-45cd-adab-5579da5802d4", "comment": "Malware payload (Mirai)", "value": "d0345ab1663c0153617184e5c970a566e0b8965ab364a1c9eea7cdecad15cd61", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096940, "uuid": "d0a0abbf-5a71-41ad-a6ce-56fc4554d2eb", "comment": "Malware payload (Mirai)", "value": "1e1bb6b35dbaa899052e3a48fa91d27688f104bb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096940, "uuid": "10f270c6-2075-4740-9f0a-b68d3673cf01", "comment": "Malware payload (Mirai)", "value": "36fb904d04856fdd0e45f25e30bfee3740600305b4c7df87242f2b2202edde6da3654f038026667b73ee8e613dc7db74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096940, "uuid": "55d89e4b-72df-4df8-9d44-3b010296a242", "value": "T1F0330223B358FDA2CE751D3972FD8C8E3144466DD4ECA82236C459A162C225BFBD04E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096940, "uuid": "b3c9b238-4591-4e27-9634-f1ef03c05b94", "value": "768:kfZYvZxNZ/SPjiUv0w0zyIvfgJy2LHRfb+4Dd9q3UEL2qEK5J6OAsNTGjf2tl8Xb:zPtQjiZVcykHRDiL15J6RN2tAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782096940, "uuid": "f9b5a57f-45a4-40a5-a180-3142e4d323ce", "value": 51424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782096940, "uuid": "a8cff776-0964-47cd-9a0a-54291eb82b97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096940, "uuid": "a386406c-6fd3-4394-b35f-1b7511eb598d", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110f9940-6e70-11f1-ae13-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1782156302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782156302, "uuid": "f8547acf-2992-4611-b803-f731324a9d96", "comment": "Malware payload (RustyStealer)", "value": "2c632c2e6e8ee3027bdd6ccb3e01148a", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782156302, "uuid": "caaffa96-dec8-4466-b9b2-fcae23202b39", "comment": "Malware payload (RustyStealer)", "value": "d10102278c8462c411cb0d09125c81f03ae193294e55665f96ba0e71c8ea8567", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782156302, "uuid": "3cb6f680-219c-439f-ae69-19c781b8efd6", "comment": "Malware payload (RustyStealer)", "value": "088c69b9e52159d23fdc04061d721002c11bccae", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782156302, "uuid": "c4db292e-e268-4d11-8936-c77037269e0a", "comment": "Malware payload (RustyStealer)", "value": "c72bfcfa3dd148339f6b0ddf738200bd87bbcead3ab1bfe3f12f108b3b65a2ab867e2028690a83c2339af51afc59d63d", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782156302, "uuid": "60a65b61-652b-4309-9abf-835395b7df05", "value": "T1652633973380ACF4D732C631CF16EB524673D79D26819E4F5E8A2D44AC87522A3279CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782156302, "uuid": "e9b5040b-361f-4128-96b1-288f97abe0d0", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782156302, "uuid": "320229a2-d1fc-4528-89fa-57bb46c10d6a", "value": "98304:+pXIAFciXpIekAX667Uo/qrPAFkWZ4cUJAPpntl0s/anxdOsht2mW:+pVcIIetq1o/qrIFkWZ6JARnxinxs82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782156302, "uuid": "693e14e3-7208-41e8-b3fb-73b9880f8956", "value": 4738952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782156302, "uuid": "869dab8e-479a-40f7-95b1-77d538d668e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782156302, "uuid": "d08ccc8b-5273-4c7a-add1-3184935c0aca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f453704-6dee-11f1-ae13-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1782100518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782100518, "uuid": "b0d7dcd6-b25f-436f-8a04-311efb21fde0", "comment": "Malware payload (Prometei)", "value": "c4e975ef56c7a94c4201b559f429345e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782100518, "uuid": "03029b43-138e-43e9-b3b8-4a42da09b3c3", "comment": "Malware payload (Prometei)", "value": "d135ddfe09f72f009766f84ff20adc24162c9656782ba77ca247783757e46b94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782100518, "uuid": "9eec4826-d139-4587-a6a4-d2b4c8f1fb26", "comment": "Malware payload (Prometei)", "value": "d566539d48c058526f35c0ff809605fe8f2f459c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782100518, "uuid": "fcc71743-417d-44f1-bc29-f40e97c8722d", "comment": "Malware payload (Prometei)", "value": "d0739a03e07464c7b3ba1028265085d34344872609f7da0093cfcaee1a441ad7699e78e07872b68ba668e3d5fa5c4a0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782100518, "uuid": "5adeb6a2-b8a6-4108-9606-876bda96ff7d", "value": "T13CA423B4F9229E8F6DD769B91B24C35DE181C172589D4C2313AE94A34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782100518, "uuid": "0dc21450-e343-4dd7-9292-a450c7e0e6c5", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdl:Fs6pyCC/Ya2hpi6T6N4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782100518, "uuid": "c6830104-bae1-450b-a97d-683c85142a9c", "value": 449061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782100518, "uuid": "f2473636-8964-43b5-b895-dcac2cf101c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782100518, "uuid": "a82b7165-f8ad-47a5-9812-f6fd67e0d124", "value": "d135ddfe09f72f009766f84ff20adc24162c9656782ba77ca247783757e46b94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf85928d-6e51-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782143280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143280, "uuid": "266218af-41aa-49f6-9eb5-0f810ef0b63e", "comment": "Malware payload", "value": "6a3b35f3c9fc9bc3d593f6f21c4c8b4a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143280, "uuid": "96f2498b-b255-4b0a-b7a6-abcd50dae244", "comment": "Malware payload", "value": "d15349b786248de8e9d076348a71d86d6a2b5af8b3156afcfedeec3cf3ce9511", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143280, "uuid": "cf94d51e-4fa4-43c9-8f1d-a7a3e85694ef", "comment": "Malware payload", "value": "b80934f043975ce14e47db6da39b903c0001b8c7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143280, "uuid": "4e2a8f12-62f1-451e-8752-721241450966", "comment": "Malware payload", "value": "893296d9849a38797a8974b78cca2c080ccfeb9c43948053728bada4821c8041bbeadb4b035ad4e0e06e217f30052604", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143280, "uuid": "c64a3789-7760-447e-8e33-32b3473df975", "value": "T1DB51531AA49DC1B22BE7C1E88FC68DD5215A4107CC54C828F3791BEFAFBC85CF1A6518", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143280, "uuid": "c2c85a8c-eaeb-4fe7-828d-35efd156abef", "value": "48:iR4peKyylhR4pOEqyl/87bT+xxZVxjHxZeYkwosieV7MSvpQVodaZfjkwosboaEv:iREeKyKhREXqKYbSxxDxjHxZepeWSvpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782143280, "uuid": "a5af8ba1-c6a7-4869-b6aa-5695555632b0", "value": 2745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782143280, "uuid": "c23b48b7-8133-4747-a208-a97a22e27b85", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143280, "uuid": "896fa738-85c1-445a-95e1-5b719823c21d", "value": "bak.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373dc6b7-6e82-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782164097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782164097, "uuid": "0e906b4f-e49c-44db-a080-4d564e1940a5", "comment": "Malware payload", "value": "be2ff004167951b22db18e85902914c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782164097, "uuid": "ec34883f-c701-4bb5-a57c-6b52d4de7700", "comment": "Malware payload", "value": "d193e5970643899740db6dde6605e44936223871853a1f9977a4e638d57b8a5d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782164097, "uuid": "c699355d-3b0a-415b-8818-633aa44f469b", "comment": "Malware payload", "value": "7a1836da77b9e37462d6849bcb4ac0e417fe8630", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782164097, "uuid": "1b4fee0f-73e9-4611-aabe-93aaf0e1de42", "comment": "Malware payload", "value": "ea1fcb9f2d3fd1f5d97a568299f2ba2efa766ddcf9461629f9a20733015a81576c5b376faaa04ea68ad455bab46776a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782164097, "uuid": "8a32a9df-c3ed-4048-bc7b-1f2faff37160", "value": "T162F34A06BAC090FEC8D9C1B44EDBB136E971F44D5138B25F6B94AE222E1DF212B2D754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782164097, "uuid": "d3294c29-4da6-4c24-8e70-1ead7fac5fb4", "value": "3072:Bz5kwe7dQNKt2K929XwR2CxbQim8OirYE5qHF+DO0Q4:Bz29eMMK92GwG0iIE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782164097, "uuid": "e2c2a928-4edf-464c-a034-5f98e81e9674", "value": 167688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782164097, "uuid": "317be4d4-a05e-4939-b101-fabca17d22f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782164097, "uuid": "2f50096a-9144-4927-9702-2f2642473f25", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40789fbd-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141779, "uuid": "356def4d-d552-4ded-b1c0-a54777e8c091", "comment": "Malware payload (AgentTesla)", "value": "9fa6552a0074b87f21d839986e80da6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141779, "uuid": "67981619-11b6-4afa-b09f-a60fb83d073f", "comment": "Malware payload (AgentTesla)", "value": "d19a52218523096921521d6aceb4575c0773ee7f062cddc0aebb054ce37455db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141779, "uuid": "baa097fd-de43-4dea-9157-30a0e1cb38df", "comment": "Malware payload (AgentTesla)", "value": "0dd1f2eac74a73c5afb3a666fe891413b4111fb4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141779, "uuid": "4ce28e43-7994-4618-b3b9-d20fcd5d519b", "comment": "Malware payload (AgentTesla)", "value": "bf50fc4527f504c62633132e78815df28aa0f327b40a50bd17297cbe8d7ac9bc319379515b74d5dfa832d3327b64d0e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141779, "uuid": "d173bcbe-fcb9-48ea-8679-1a9c67899504", "value": "T120E257009C5E026868619E8A57D1453DAD423B30A3FE9E15FEDC2E8B76221ED35CECDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141779, "uuid": "6cdd18df-992f-44ec-a955-c2b12506fe8c", "value": "768:F0EYgLe2WFZLyXmb8SF/3y86p+uC3iD6CZwi:F0EYgLe2WFZLyXmb8SF/3y86p+uC3iD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141779, "uuid": "a118d881-70ca-4539-8cfd-dce533fc32d6", "value": 31873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141779, "uuid": "bb83d7bc-e01a-4002-997f-47cfc4ef55d6", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141779, "uuid": "3bd27fe3-e014-4796-91ea-09f171bf0530", "value": "NEW QUOTATION.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9ed62f-6e3b-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782133770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133770, "uuid": "da88c415-06de-482b-bbc5-75716865b070", "comment": "Malware payload (Mirai)", "value": "6649e8ac29f35527df79cb785f6c9aa6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133770, "uuid": "08f42906-cb7f-4e68-a4ce-d70fccc07c3c", "comment": "Malware payload (Mirai)", "value": "d1bf749e1e5f1837ce20c0e9894d4bfac41ce1c41680361d2a40f41afa16cdbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133770, "uuid": "095d3d64-ccd1-4a02-9d52-8f0373b4bc30", "comment": "Malware payload (Mirai)", "value": "c56139d6d39ed0863dd9bc48a887b7f1d576fadd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782133770, "uuid": "8be7d5e7-bfec-406d-95b5-f6f7f0213d87", "comment": "Malware payload (Mirai)", "value": "15074fc0ffda891ca34961fa44395c6bbedab5df69a9557fba1de3a7abfc86e9df5b752f26c740c06f7f5766bab5fdf3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133770, "uuid": "38cb9b07-43ce-4096-bc61-5589bd838f73", "value": "T1EAC2D030A19E4E8BFBBF2DF80978B51877F48A8D7794EC9034A197115204C27AA5ADE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133770, "uuid": "dbc2f32f-d89f-45eb-9785-e87decdc13ea", "value": "768:y13X64OdfHKtAk7P83Z+/eN+dT4uVcqgw09G:yrO1qtJP0+NdT4u+qgw09G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782133770, "uuid": "179ce98e-0052-4d38-9134-50bf786d39dd", "value": 27881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782133770, "uuid": "ec7f0aec-79ff-4c31-b5dd-0b0cfe17f5ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782133770, "uuid": "aee96ec4-a11a-4bd0-88f8-19a27075f8ed", "value": "d1bf749e1e5f1837ce20c0e9894d4bfac41ce1c41680361d2a40f41afa16cdbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956cc631-6e04-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782110139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782110139, "uuid": "1f297021-b6d3-4905-8d92-518c65fe426b", "comment": "Malware payload (Mirai)", "value": "94a99ed902353a8672398d55b0ee01a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782110139, "uuid": "803366ff-9069-452d-9165-d0e6e7f0297b", "comment": "Malware payload (Mirai)", "value": "d1ce8513f33356d775d5905b08a9b81490c74ce29f0fbae5baed1fe4a87c6a6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782110139, "uuid": "0ebb5c25-02b5-4662-a6e0-f3a2900aa222", "comment": "Malware payload (Mirai)", "value": "c22dd5b7385ffb50445d1ec7885f904b2c4e2de8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782110139, "uuid": "32416e02-93a2-42b6-bb58-14c24719a843", "comment": "Malware payload (Mirai)", "value": "f9f3a25f09f56327601daf02dd5eff7984f1d79e1ce599618725583d2502b08df73128c2dc5578112221fb7845d788cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782110139, "uuid": "d6850c80-5fe2-43f6-a738-e5bda5a4dd14", "value": "T150648433D91684A1E0104CF312273686AC4797BF88A726D3EF5A5DA0FF3145B52BAEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782110139, "uuid": "5ae57b3e-8ba1-4806-aade-e98dae3a008a", "value": "6144:HI8EHjwPYORE3wjojFwsTmXFscMdxDa3aT:o8EHjwUwjeFTmXFscMdxDa3aT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782110139, "uuid": "620bc81e-045c-4be8-9b0e-2ccd2001268a", "value": 326959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782110139, "uuid": "075bba4a-41da-4c45-938a-bbe3f109fc61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782110139, "uuid": "f40023d1-9e63-48d4-bd73-d7b88103fdf2", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae5a7a30-6e06-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782111039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111039, "uuid": "0c13947d-24fc-49a0-aa2b-2ff92c051634", "comment": "Malware payload (Mirai)", "value": "7f9522535d285e8f2c902bb330b399d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111039, "uuid": "aa70dad3-c972-43a4-af45-88a20f7dd710", "comment": "Malware payload (Mirai)", "value": "d1ec64b35157670d802bd27ba5ae2f1ef958bc46d41cd9dbbd1c1d6e460f3938", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111039, "uuid": "c07cf309-b471-4f15-a3c3-79e243157cd5", "comment": "Malware payload (Mirai)", "value": "55444e70376854218e7bc8f467f88483c94d66ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111039, "uuid": "8001e3cf-e805-4416-b7a6-699e497d0e14", "comment": "Malware payload (Mirai)", "value": "d71f10dacd3fa3038cc62a6a487da5235f6acf35f99a031f5ccefa362b07ea3628b8f0941c13919ca6c7e251f011103c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111039, "uuid": "890d4a53-36f5-4c01-aa38-149c22a8c374", "value": "T145649433991584A1E0214CB2226777459C47C7BF88E726E3EE5A5DB1FF3041B92BAEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111039, "uuid": "90d4834f-192e-4032-b212-ad5f944b4d27", "value": "3072:BIJGasFUJJoYCKYwSVla+1KwjoSKs9nSFYmk:BIJScJoKYFAwjotmx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782111039, "uuid": "09682557-8253-4950-9348-65fc51614e8c", "value": 326206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782111039, "uuid": "f3fc1bff-cc9c-4c2f-8400-cc3f98499bfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111039, "uuid": "bf0a58e1-6b0b-43ab-b2fa-525308fe9bba", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ad606a-6e46-11f1-ae13-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1782138305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138305, "uuid": "065158a6-efd7-4ea6-84c1-0189e7c425b9", "comment": "Malware payload (NanoCore)", "value": "3ebaabe329226d8e7428bc1c4dcb9e3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138305, "uuid": "feb287ac-0d1f-4a61-a546-6b5719353219", "comment": "Malware payload (NanoCore)", "value": "d337ba3b1ea0946b50973a01b66e2d9e26c6693109b6ac196a43ee6e20300e4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138305, "uuid": "fe53edfe-90fe-4fde-8589-8473038170e9", "comment": "Malware payload (NanoCore)", "value": "acde6fbb8be8f20540a7dc0a91429326635d0d7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138305, "uuid": "21318801-4fae-472a-a349-1e8b46a27017", "comment": "Malware payload (NanoCore)", "value": "6d3e8ac898ededdb94c743e1f486bd1abffb4c4f9db13b545fe41ee9933c80f9bffd9d5e3c2e2780ea77fcbcd911afff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138305, "uuid": "83ee7640-9653-407c-b8bc-520401f88766", "value": "T19714CF1A77A94A2FE2DE89B9611212579379C2E3D8C3F3EF28D454B34B263E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138305, "uuid": "5d4a6ff9-0147-4528-9b25-845d8266995b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138305, "uuid": "4cabbd02-4150-4bff-b0b9-4d4e028df7cc", "value": "6144:MLV6Bta6dtJmakIM5hMluAJDAxGJg09os2:MLV6BtpmkyRAioJgzN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782138305, "uuid": "2d14cf5c-d09a-41ad-933b-a9f4626b9356", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782138305, "uuid": "11826892-43d8-4c51-b07d-4e0c105e4ba6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138305, "uuid": "20cd024e-c4b4-4200-9329-755b758d6f48", "value": "socolive22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccfeac74-6e53-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782144162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782144162, "uuid": "0c5a2a1e-f3a5-4423-86df-0d463d814110", "comment": "Malware payload (RemcosRAT)", "value": "ccb0ced8596e527f6df9adae61c04427", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782144162, "uuid": "6e396f67-5ed6-42b5-bee8-4b89c8de2166", "comment": "Malware payload (RemcosRAT)", "value": "d3d02b25398110fbaa434c955c2037aafec29dde96d1e5e66711eda46c26a36e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782144162, "uuid": "503d7f49-951f-4cf8-aa3c-44ff2426ae37", "comment": "Malware payload (RemcosRAT)", "value": "ad2bdd029b61742b3f17d806e8ef2e1b046aaf53", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782144162, "uuid": "2055f6e2-5b1f-4cac-9567-beef2735358b", "comment": "Malware payload (RemcosRAT)", "value": "c4f7f370dec51b3ea48170a8dd1f2bc890d055d63fe30e4dc7c6b68c6f3787065b4943fe2902325a94415cd43724189f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782144162, "uuid": "e5d229f1-845f-4507-bc3a-1a143cafb651", "value": "T14E73119D03C8869447D009B08F3C5E72A23B847A2EBCC946B71536F9BE59B84945BCF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782144162, "uuid": "8974740e-3427-4439-a512-a9c145bac7c9", "value": "384:oPDrfoMMzfkroQp1H5S44HCu9mTaCgy7Bv0:oPDrftIsroi1ZS44HCuwBgsc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782144162, "uuid": "302a3d5c-9f6f-4454-b4d9-6f5232de487d", "value": 75027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782144162, "uuid": "5688de15-4e40-4bb7-9910-7bc8190bb5fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782144162, "uuid": "1cd887f3-9988-4866-9708-8696bae19d8d", "value": "Product AXINSamples__0626.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2facf5e0-6e1d-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782120705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120705, "uuid": "f1d123a1-19ed-42b2-9f34-2f1b7113c35e", "comment": "Malware payload (Vidar)", "value": "81e00f65b86f0db0754b5d851631dfb0", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120705, "uuid": "8027ed63-c7e6-4599-a7a7-02bee938e5f7", "comment": "Malware payload (Vidar)", "value": "d3edc0c8ca141d1a7e1f93f4d727f92e0e63bba43cac95723d9a20467e790296", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120705, "uuid": "b0ad221a-2804-4074-99d0-fb069bb6681b", "comment": "Malware payload (Vidar)", "value": "153a6e115c377fa1232636c03d6fd68d3643d196", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120705, "uuid": "0635211d-1436-4991-b491-3f217b5f6504", "comment": "Malware payload (Vidar)", "value": "a3f4b5cceb3a1ffb50696c98dfc1cf32eeac7f048c6c83871cced008a069b46e9e4fd83f28ce1a500268cc2cb14bad1c", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782120705, "uuid": "1b15662e-9d61-45a6-a7f8-e494a7920086", "value": "T111F57C07ED9509EAC09AA33189B35682B775BC085B3227D33E50B7792F72BD06C7A750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782120705, "uuid": "d11daeb2-95f6-45c4-acb9-007ba4b552e6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782120705, "uuid": "dd59d57f-ea94-48dd-9f77-d50185ddf3bb", "value": "49152:UnE+a2AcwPnWAKCJeQwTB/b/I08s+g0EB+AyTWlbNWdsN:UE5K8A/b/I08s+XEB+AyTWdw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782120705, "uuid": "0c6e024f-b4c3-48e8-b573-ac100b6e15e6", "value": 3372544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782120705, "uuid": "5b28cad2-bd74-4598-a5ee-d7c5b68f7306", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782120705, "uuid": "969976c6-1367-4abc-b118-7d254520d2e3", "value": "Launcher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8452efec-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782115264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115264, "uuid": "d8de3230-6a21-49ab-95d0-4d033921f2e7", "comment": "Malware payload", "value": "48f707c44019cd450823545e553f0251", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115264, "uuid": "277594b6-caba-4c2d-9685-0191aada60b9", "comment": "Malware payload", "value": "d401189368b3224934d439ac7d921bab6cb8e5a64a1630cec009471ea7fbc9ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115264, "uuid": "c0db2279-8952-4008-ba49-6195f5edc076", "comment": "Malware payload", "value": "55703075cd385c4a9b4d4a5277979acdf413763b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115264, "uuid": "abbe02c1-a2f3-4230-8e34-d252181dfab2", "comment": "Malware payload", "value": "c42bc2b5d1f645f2b970c1951533bd1977e438cc852d3c77c4adf8adf7b5606f9a18871c3e6162a6ae1365bd5947decc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115264, "uuid": "6d547b75-0c70-45c6-bf84-31c7872cac83", "value": "T1ED0833A5ABC4A4D7D7198733C136DA14AC62FC0D074788EF27A849563E6F2E839BDD10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115264, "uuid": "05dec496-0554-48ea-af31-fb3400189ffb", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115264, "uuid": "2120e8dc-13b6-464a-8527-ff8b3851a35a", "value": "1572864:N9zyznEWOQWPVr6LrtO5SrjtAsIgqTcaNH21A/QE5oeOwJ1crzZOb:N92znEWOdPJKrtOsHtAsg7lx76elKrzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115264, "uuid": "64d72b11-68b5-4a8c-a17e-00507eb4289a", "value": 80374297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115264, "uuid": "3abf4425-1bbc-49ba-bf8a-6cce4a513d24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115264, "uuid": "73fadcb2-5a0e-45ce-8151-6d01eec8528d", "value": "48f707c44019cd450823545e553f0251", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f88d232-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141294, "uuid": "1ca2694c-020c-48a7-87b9-cc74541cfa70", "comment": "Malware payload (RemcosRAT)", "value": "36e2b8747d0f8b00846aeae504521875", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141294, "uuid": "52570e10-9fa4-4de8-933c-3259956055a2", "comment": "Malware payload (RemcosRAT)", "value": "d4061c78f3dbc769af1f0a4964978c1ce7cf8f4701f3ab52e1b242b5b40d387f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141294, "uuid": "94a6dafd-8926-478d-b734-808ea355f765", "comment": "Malware payload (RemcosRAT)", "value": "c92a1f93864418de5a634b753e0262da4ea64196", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141294, "uuid": "d44b06b8-9ced-49e6-98ff-a7e6cdc7cd60", "comment": "Malware payload (RemcosRAT)", "value": "27f6e79a860832f341bf82108a83ec2f96a2b929855d221b6cf0e9db17b6b370cfea4f17232d0c7f2a60d2bb647af107", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141294, "uuid": "b11a5e45-6f91-4b1d-9178-179e73c64c3a", "value": "T1B4A58C96331D2E71A761F8B8EC853C1BE0BC637B929C516B354778C85C0B40A69BB9CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141294, "uuid": "d65be4e4-6361-4e17-ae5e-858d7e1a2cf3", "value": "192:kx6feZ0akXO9tk4FuDwQSXet9M0w/ZqUfHdsgDL+9Gi6gOE:oRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141294, "uuid": "5c67071d-4af0-4c51-b4aa-b53cc2fe0070", "value": 2138813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141294, "uuid": "ef44adc7-17c5-4258-919f-193b9129b595", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141294, "uuid": "ce1799ab-5d41-4918-904a-346fc1fcb65f", "value": "Quotation_Reconfirmation_22062026.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9533f0-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (SiriusRAT)", "timestamp": 1782141474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141474, "uuid": "d7c40d9d-9414-4bbd-9a67-e01206a994db", "comment": "Malware payload (SiriusRAT)", "value": "286ab1c862a170f4ccdba9ee6b870445", "object_relation": "md5", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141474, "uuid": "8fed441d-5524-4ef0-925a-20a062899224", "comment": "Malware payload (SiriusRAT)", "value": "d41252ddc4fab7295681019cfb2f1c1e899e2f480c306bfad78b24c38165a807", "object_relation": "sha256", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141474, "uuid": "5f2c4716-1670-4855-933a-d2e78788035b", "comment": "Malware payload (SiriusRAT)", "value": "a6dbc09d360b0cc7bb5b45e015e191aa4528b1fc", "object_relation": "sha1", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141474, "uuid": "f66cf4a0-2091-48a2-89a4-7b7e7d47f798", "comment": "Malware payload (SiriusRAT)", "value": "42c93b92da7acf92a005b613e328529413353767eff9d7e642d1ae36b63115bee590522af4e4c12bdb110d4b8e4aeedc", "object_relation": "sha3-384", "Tag": [ { "name": "135-136-141-43", "colour": "#F343BF", "exportable": true, "hide_tag": false }, { "name": "alfredcore-com", "colour": "#9AB8E6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141474, "uuid": "6e926eb1-00d4-4312-b734-20d9a3ed6469", "value": "T15E06CF06BC9524B9D5B6A2B148B291E0B731F85E0F2217C32F15A7B92F773D40EB5398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141474, "uuid": "52997b6d-2194-4a7c-bda1-c0074f4d6caa", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141474, "uuid": "09e6f773-278a-4750-be4e-f70e34619c09", "value": "98304:lvTbTo9Ow7UbGNJoH6S7QqL8iyhn8iYcLGLZI1raNk2gBLCSqL0GIB1Jpzx84lPv:lbbM/UbGNJoH6S7QqL8iyJgcLGLZI1rF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141474, "uuid": "2f418a42-82dd-464b-91bf-643d90dfef7f", "value": 3728584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141474, "uuid": "fd17f8a5-1ea2-4e7f-9de8-0edbd3fe919e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141474, "uuid": "6782fe2f-a35f-458f-8479-5539063bc24b", "value": "Bonifico2752.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b88d98a-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1782141287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141287, "uuid": "fbe3a276-ab8c-4841-8ea9-d814f8681d99", "comment": "Malware payload (XWorm)", "value": "70f14b435f7c8f8b24aaad9e43222552", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141287, "uuid": "b70274ef-2b5e-4834-967e-cebb14956a1c", "comment": "Malware payload (XWorm)", "value": "d41c4e42ec7b047d855df45e8c5b6b8a14c94743e79e87589715ff776920cae7", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141287, "uuid": "fb083a80-cba1-4067-9d73-576dfe21854e", "comment": "Malware payload (XWorm)", "value": "168af647c010d9f2b60dec950cf503c5abe599ae", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141287, "uuid": "8913ecd8-b874-4edc-b8cd-1cd3dd16159e", "comment": "Malware payload (XWorm)", "value": "4c698c17dd1833247eb2fee687531e5472855dc9807921209060482e6f55fd3c9c8fd29257f7e7244ec57604a92c7a40", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141287, "uuid": "7a56e15b-7c5e-4149-b8c6-b4348160194f", "value": "T166A51284EE293BF5A753ACCE14B232055E48607C244C932B5A6F4A836CC6553F3EF6E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141287, "uuid": "f6e5baf7-a96e-4bd6-93ea-876c09deb0bb", "value": "96:bLHLHLHLHLHLHLHLHLHLHLHLHLHLHLHLHLHLHLHLHLHLHLHLHLHLHLHLHLHLHLH3:8WGCyYcXVhkU0K6lKjcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141287, "uuid": "2bb16b16-990a-4adc-b20d-ea62fe38a7a1", "value": 2167842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141287, "uuid": "df860c34-302e-47ab-8813-b47877ece233", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141287, "uuid": "dbd7220f-4474-43bf-a737-34998be9ab38", "value": "orden de compra y muestras.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d60437-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782141415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141415, "uuid": "71edab15-9aaf-48d3-b3c8-d1a1c87306be", "comment": "Malware payload (Formbook)", "value": "bf580bbe97936c38eb762ae9453b0915", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141415, "uuid": "3ac2580c-aecf-4609-a495-c038c486da1a", "comment": "Malware payload (Formbook)", "value": "d43766bcc8d45cb537503718527c20600d81f7881b356ad485976f47ead91062", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141415, "uuid": "bfc5c771-27f4-4339-866b-cf996347755a", "comment": "Malware payload (Formbook)", "value": "5e3190cd1fb05d0cf6029c9238d8bedd8fb8b746", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141415, "uuid": "c1aee845-2807-4a10-88c0-64589bae42fb", "comment": "Malware payload (Formbook)", "value": "f361fdb323d3787d6fc7ad5a62a8f9155e2e9b019645d53a29d424f72d4f16413dc5ef62e099c1a0e00c18a9c7d8f4df", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141415, "uuid": "da5d41e4-e834-4c2b-80ba-2c2e60e534f0", "value": "T1329502019AC46FF4CFAC5B2990FE160DE3A14A8A5516658AFB23FD06EFF750052071B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141415, "uuid": "d363ad6b-b552-483d-90ad-40ae3b214017", "value": "24576:2KHTwl3S+EIglNBTXipTKolIqDH9mJpS+Ht+zFJ2lgItPT08OBh7j57pxR:JHSC+Q8LO+6lI5L9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141415, "uuid": "7d567c5a-a50c-412c-a85f-790807f7931d", "value": 1980545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141415, "uuid": "5d075bbe-d95d-413d-95a7-8783561d72ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141415, "uuid": "5e8fe19a-7966-4339-92c0-8bb1ab1e6419", "value": "Flexy_startup.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8689ae2-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1782115351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115351, "uuid": "4d09f090-fb71-43e2-93c0-24ae7682eeab", "comment": "Malware payload (DarkTortilla)", "value": "f17e14678bfb1475eefa43dcb91a8cad", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115351, "uuid": "9d5f8812-ca98-4be9-a073-e0b8ae626022", "comment": "Malware payload (DarkTortilla)", "value": "d45bdfaf72211e28cdb9566151db2cfbd98d27df680582e795b2a79e0d0044ae", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115351, "uuid": "6d7800b7-2174-4122-bb17-9701880166cf", "comment": "Malware payload (DarkTortilla)", "value": "a6531acda0c26ae9269c80e9e64b2ec711b4874c", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115351, "uuid": "1cb2c1e2-25c5-4afa-b874-e7184edbbe35", "comment": "Malware payload (DarkTortilla)", "value": "b0ef7d1cb60c6d30938e707e6a97ed02cf8f410f3932533e7c87a8310a1a305680db32db16b19b6ae1db4e32720db96c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115351, "uuid": "30faab61-7984-4879-bdf4-1f75499de669", "value": "T12645D02933D88688F47EDB358A761B4407F2F987D921D70FBE4A31DC4899B569A00B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115351, "uuid": "9432f6b3-4e22-47e7-b782-5d3fa5affb0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115351, "uuid": "c0027421-f38a-4943-a3e7-7510b5da0586", "value": "24576:zv2kQMk/Plb0HsBsxpbrqKR1N9LnOTmmYMNKjGhhv:m1ssBsTbFN9LnGmWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115351, "uuid": "0a2472e5-0b3e-4ef7-a61b-65b49b151ec8", "value": 1254400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115351, "uuid": "9010d686-3618-4e53-9f70-e960354570ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115351, "uuid": "bf14aba4-f482-40cd-a47b-741742b85d70", "value": "New Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b48e92ea-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (DarkTortilla)", "timestamp": 1782115345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115345, "uuid": "a9ab5728-7b42-4a6d-a674-8151660c4e0b", "comment": "Malware payload (DarkTortilla)", "value": "52fdfdac4eb28cc5f0f709de00c1e527", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115345, "uuid": "0c6f0d85-2e02-4c03-84bf-8c60669186c7", "comment": "Malware payload (DarkTortilla)", "value": "d58139c7219be351d742a21fc35150702bae9ac2023a7086620521f1721f2c49", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115345, "uuid": "26f3ea73-8240-490c-860e-67317800ccde", "comment": "Malware payload (DarkTortilla)", "value": "2a54e5da3531992016fcf0ab7f6f284a122712cc", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115345, "uuid": "5017479c-b8b8-4ed2-a86c-18ec2f20120f", "comment": "Malware payload (DarkTortilla)", "value": "8b2873d41dc342ec0d0ae71937d287d31cf95c1d4ab2953bc221ab35af501e0b59afee2b4e6b6f5ac16091d4c441d260", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115345, "uuid": "f03ded5d-671b-471a-b425-f3247fe7d71d", "value": "T18A35CF287DC6894DC5384F76C6735B8833F1DA4ADB82D70BBEDE30A8891E796C501E16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115345, "uuid": "d7fda08e-cc83-49f8-b45e-3e1657ca6879", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115345, "uuid": "7cd66a0a-42cc-4551-90a4-2338753799d6", "value": "24576:ahd94Elb0HsBsxpbrqKR1N9UwyOjMG9bNr:+d94UssBsTbFN9UwyONdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115345, "uuid": "dceac523-79d0-48f6-9f7f-a63da614dba6", "value": 1147392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115345, "uuid": "1384d35d-90b5-42a1-bd0a-22e6314e4f4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115345, "uuid": "6988a598-5f34-4c65-8a75-6d89ecae5e3c", "value": "ertyguhijhgf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0283164-6e94-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782172031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172031, "uuid": "7e431ef2-df94-4b2a-88b3-ade4ece6b6bd", "comment": "Malware payload", "value": "3703648e5586cbfb3539862dc2251298", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172031, "uuid": "737d301b-904f-4a79-8a97-28b0fe14efb1", "comment": "Malware payload", "value": "d58de1bcb41688adbb8967b0c5ba83b5c5beae7de4c9fe1b24382db7902c19f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172031, "uuid": "642d96b3-7169-47e2-8c32-9ffed8d6f029", "comment": "Malware payload", "value": "5f6f3e0e474043136774cb29bff0cd522ae2782f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782172031, "uuid": "0e315ec1-da85-4bad-9308-d6054cdefaae", "comment": "Malware payload", "value": "15bdfc91e157db154a50616c478403f442f90832f3174f0e5587c561ef1ac9869334b4476b60c40b68b04a30ed54cdb2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172031, "uuid": "2246e517-c768-4a08-b6bf-2ed66d70afdf", "value": "T1D3A58E4667A901F8D877C178CD462217F672B4081774ABEB45A08DAA2F33FE13A7E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172031, "uuid": "e3a0e999-6636-44e8-8435-a41368ad056d", "value": "108df5439b2b7803ecabd5e2df688de4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172031, "uuid": "8cd10171-df89-440d-a76c-3970a3154c15", "value": "24576:M34mYI6XF/yQn+RY/hDzDVfgrNehFUdJO12pFvp76cVgV4B3uM7L3Fu7p5fFUGZ/:KBKyQ28zD2rNuMFvV6cqVM3vL3Fujh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782172031, "uuid": "de5cf0c6-9fba-4beb-871b-f19a44e60331", "value": 2236416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782172031, "uuid": "5a9b4e1e-92d5-4e9e-8ade-ba0b1a28230f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782172031, "uuid": "da970337-94ff-4e6a-b2c8-534323530f65", "value": "SecuriteInfo.com.Trojan.Siggen32.45684.3076.18531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99bed172-6e38-11f1-ae13-42010a9c0009", "comment": "Malware payload (MassLogger)", "timestamp": 1782132480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782132480, "uuid": "33d86bd4-1375-4107-ba52-c93dee6cff67", "comment": "Malware payload (MassLogger)", "value": "50d74f643e9431fed94390f9f8e6d2fc", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782132480, "uuid": "66119e1b-1b40-4ff9-abef-5466759c563a", "comment": "Malware payload (MassLogger)", "value": "d5b2b936f706efa296508c00b2a0549834813dc1a20400497d5c980cfbfef76b", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782132480, "uuid": "611cdb2c-0cfd-4433-a939-5d2fc9e1e7d0", "comment": "Malware payload (MassLogger)", "value": "c0bdeff73fcd6094ecd3c691d845c1a250b8fbfc", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782132480, "uuid": "eca6807e-8a15-43ab-9a42-29a87c7aee67", "comment": "Malware payload (MassLogger)", "value": "ca28657c2a4797d0600ebb541d8e7f892081042832fea0c16070eef7f4762d3222f0a9ac5cdc6f81257ce771f30c2620", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782132480, "uuid": "f92ba17b-247f-4680-a138-4199c72847f5", "value": "T14DE2732EDEE6F4C13308F1459205BD561A5122A3A05943B73175B2E273688FF1FE27A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782132480, "uuid": "436bd022-35b2-4068-80eb-775881149a3c", "value": "768:FajjOhREU/txJecGlGmY/8DLJ/yqj+JEvqdkRgkrjXArmShmwmdNKU0ae4kA/0Xv:F/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782132480, "uuid": "9b9efe77-6261-471f-84db-e990c89640fb", "value": 31240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782132480, "uuid": "3bfc65a1-2ab1-41ee-b17f-8bcf0021dfb9", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782132480, "uuid": "eed3f8c1-3eef-466e-bf57-f2fa538dd50e", "value": "QUOTE-058-2026.pdf.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fc71ab3-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141858, "uuid": "ef971e05-e157-403b-8cae-1ca2fc7d3e28", "comment": "Malware payload (AgentTesla)", "value": "04ff01312bfa960f50b0966512c42e8d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141858, "uuid": "fa2f4d94-c928-43d8-99d1-5d3b9ec34e2d", "comment": "Malware payload (AgentTesla)", "value": "d62f4ce1e36efc4acbc6b76e0f84671fc1a2e1f72d0daf8766729cda9b9852d6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141858, "uuid": "9ddd1362-2ee7-4c5a-bba6-04c52eb37feb", "comment": "Malware payload (AgentTesla)", "value": "87c03b63c94ef286d6f096926e923716fe99180a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141858, "uuid": "a5de75f0-98c8-4890-b471-1dbc1b4d044c", "comment": "Malware payload (AgentTesla)", "value": "7754b12750ba57aab4acfce21cb6da1e48f41459480b848c2e6b7c0ae27013a881781a13c74d45540bb0ca9b8a421e51", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141858, "uuid": "4972fdc1-0025-4b81-ae0d-0faabf9959a5", "value": "T1F0065C944535EBCB24E0D376C80FBFF9A98E64631C34DD81B52E9A2DCC08E8A77151A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141858, "uuid": "320e97e6-d88a-4cbd-9039-235e2768f0ab", "value": "98304:Ey845145M6ZiGq/oip0MBdKY/g4QeAhihs2KcWrlWkR6JAtuKL1I:9oZzBneAaWMkR6sbLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141858, "uuid": "d66394c5-63ec-4dfd-a906-697d05527770", "value": 3781576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141858, "uuid": "da842031-67ac-48cd-8ff5-2529a5cb06a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141858, "uuid": "f1a47f14-bf95-4434-a229-52d917c5c591", "value": "Invoice-01972.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ac868f-6de6-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782097363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097363, "uuid": "05c8fa29-658b-4b20-b331-8a31ba859fd5", "comment": "Malware payload (Mirai)", "value": "695a3854751efbe066f0accc1a617297", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097363, "uuid": "e5554008-3141-4f14-bbf0-e25ee5664661", "comment": "Malware payload (Mirai)", "value": "d66d8002d603c89701071c6be50b479410b017203e85bb20f9b15860574dc617", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097363, "uuid": "7f4b694d-801e-4fe6-b8fc-657ab098c513", "comment": "Malware payload (Mirai)", "value": "38eebf535f914cf41e7f3f84e9a8a15e44ed18d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097363, "uuid": "6df8c308-4235-4821-9f23-002899cc1bd2", "comment": "Malware payload (Mirai)", "value": "938415de5d8b5663af398e840ac6f26342c02ca84e1932bcc72e7a233c6a3e97a08345f9f1ffddad58cfc66dd463bd31", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097363, "uuid": "7c421a95-2602-4c25-bc43-e3bbb48c8c0b", "value": "T14EC2D1322EFF28B1C2A460B6FC7C86C7625F4BB975F56521364057A1DDE100352B68E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097363, "uuid": "0dac881a-4089-4776-b0ff-74d2ce98bce6", "value": "384:kXNSIfjdxuZ1DUofVOyPqMvt6GqAAdq1K0jzNH7EUz6z6RNo9chTvGrhymdGUopA:AjKX9vt6GqA3Q0jzV7EUyUq90Ys3UozG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782097363, "uuid": "af5f2b80-19f7-40d7-8bf9-c29ab026109d", "value": 27336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782097363, "uuid": "8ef1f39c-e43e-4bb2-a081-94e84c0d6146", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097363, "uuid": "830fbc2b-e2d6-4f7f-83e9-5765aebf0a4a", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec5d699-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141320, "uuid": "7da50715-0ccf-4de4-9a9c-911a244fba35", "comment": "Malware payload (RemcosRAT)", "value": "d35601825a850a2c03567373dc5d6610", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141320, "uuid": "8225ddca-190a-4d5a-b6f1-baa39ff94980", "comment": "Malware payload (RemcosRAT)", "value": "d6ea12a8124866c210f639363ae04f6cf67c041ffee09e3f61e955d5e2b69db9", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141320, "uuid": "03e2c1b6-9722-425b-964d-fbebfa1f416c", "comment": "Malware payload (RemcosRAT)", "value": "0c652092a252a8fae0f3e51eda1056ad377383d7", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141320, "uuid": "3b27164d-6566-4526-8a62-c85cbc373d99", "comment": "Malware payload (RemcosRAT)", "value": "c65ac16ba011bfb4f2355eeb90d4ce87386276a509412ca025ad9023bf1183b7c94a9bdacbccd4a44d953ddf6f64068e", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141320, "uuid": "9948e5a3-bb6c-4945-a422-6cfacfd8f7f8", "value": "T128A34A70DE5407994E4B2BAEFC912A61C9BCCA19013350F5FEE9130D600A5BCE7BE66D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141320, "uuid": "a24d00d8-2193-4b00-9c26-4434eb887d17", "value": "1536:djA7Iu5UqnFODrglJolR/5hTqlXaL9q1V1sIcN5RQqtEJUNOdEZ:dc7Iu5/OfcIrqlXaL9EPsIY5RQq6UNOm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141320, "uuid": "2f4134c8-28e2-4606-b4c9-b03da3fb0f60", "value": 97864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141320, "uuid": "6e706fbd-85b3-4409-a59d-a96487d2f4c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141320, "uuid": "5061093d-1425-4b9c-9875-74573ce7f719", "value": "Quotation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1486691-6dd8-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782091261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782091261, "uuid": "86a603d0-9426-4ad7-8486-ef9278ebe879", "comment": "Malware payload (Vidar)", "value": "28e8e2568c7b4416c1ada52b14cc5441", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782091261, "uuid": "e7971068-caa3-4398-b30c-59abb5201e45", "comment": "Malware payload (Vidar)", "value": "d71d22dc0f225dd41a6bf2571b8206b378a87358d429d8f3a3b4119d59f407d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782091261, "uuid": "cb45e824-e367-492f-b3f7-eae315a2005a", "comment": "Malware payload (Vidar)", "value": "8066ca1f3fc9148521d5ade268c90e4b88165862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782091261, "uuid": "e54528fb-7905-4b02-9d1f-cccfb3795954", "comment": "Malware payload (Vidar)", "value": "43fb38d040597cdd89988cffd0265e95794829a1fbd09293b536925c79a73fe631cad671f96db05abee3e764375731df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782091261, "uuid": "c4250edb-2417-40c2-a260-c14bb1d7fa0f", "value": "T19EF56B07FD9509F9C4AAA33289B25582BB70BC051B312BE72EA077793E72BD06C35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782091261, "uuid": "aeee677b-4c52-4c42-956f-66be4288068f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782091261, "uuid": "a8294a27-7193-4811-ac73-5ac0f5713683", "value": "49152:xRkhP5jMRJIa7KJ8KYuMZ6bDTP8yNyqG+wVicPRkIs0mP:xeuWah6LP8yNyl+AicPHM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782091261, "uuid": "f93621fa-f967-40dc-9ca2-d1fcd0f8a555", "value": 3375448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782091261, "uuid": "e2631ba3-3b40-4785-8ca3-e98c51bca674", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782091261, "uuid": "4124e687-bf06-43e8-b876-5790252028f1", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76944c52-6df5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782103644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103644, "uuid": "7d8002e6-7b82-4f4f-9020-2012e6740fc5", "comment": "Malware payload (Mirai)", "value": "50d3418a9687f68738fef893e3307620", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103644, "uuid": "a23e5855-73b1-4812-95f7-856033605e5e", "comment": "Malware payload (Mirai)", "value": "d76c60aac76d011874dd64ffd9009413f0edf34556005195561199f54598b6a9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103644, "uuid": "190009dc-8221-428e-9273-c003e4675140", "comment": "Malware payload (Mirai)", "value": "99f4c90af50abf80c5196a0d8f9d3a8f4944c521", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103644, "uuid": "3124bcaa-cee6-4862-87d2-ba05918577d2", "comment": "Malware payload (Mirai)", "value": "9c7c49d9dc72bff692e7dfee4b1568f679b7d81fc3434c62e05f5f166db62655ad32ad41b6de0672ee04fd98f2c1ebb3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103644, "uuid": "6beb17e6-cd25-4492-86b0-6ae522cd3feb", "value": "T1CEB35D22B9751E2BC4D4A8BA61F74365F1F2578A21ECC51E3D710E8EEF242503257BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103644, "uuid": "9b46adf1-1cb3-4336-ba46-a9c2ddb3b675", "value": "1536:X1/ik8w0iX/SSqcYI8kKrN0v4oOaOHykDfZAXQChlhIyyLtSHWcuw9t9fDNWq5SR:XhjQN0Ao8JHipV9PfDNlCG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782103644, "uuid": "21444eb7-a60c-413b-9cb5-de0192aeacfb", "value": 112636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782103644, "uuid": "f901387d-0908-48f1-8e33-311759062c69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103644, "uuid": "8618d6af-189f-4ae9-9bde-c3c646e211ab", "value": "nerv.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d0cb530-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782115252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115252, "uuid": "190164b6-6dab-473b-851a-a0fbb6a2b203", "comment": "Malware payload", "value": "16219e04eab9d404f85408c70e2e0777", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115252, "uuid": "4de2597d-81b5-44bb-a1d1-b7ee0a983268", "comment": "Malware payload", "value": "d7e35158539f2b1e75b60ecb4723e5e355371e040f5f0a76aba5b486d543e63b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115252, "uuid": "13a5f1f3-cce9-4e2c-a7bb-590e4fa1de5d", "comment": "Malware payload", "value": "d742329593e9cf5c56b7681b34134c10006b0855", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115252, "uuid": "037f892d-4913-4d74-828b-4a3868067d3f", "comment": "Malware payload", "value": "2bf7d49f217361813a503e1065d089b237e5446f5f0d736f57ade8580cc1080732c29479b7565f6e8cf8cd9b7ef67b7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115252, "uuid": "0fee84ca-9dea-4b7c-9af9-efbcc7a51813", "value": "T14252D7CA71E370BAC1A8C37CC54E62B6CF5A3097061A6FBF49DC85953BC26112CF8A55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115252, "uuid": "28e30301-d052-49e0-963a-c37676713ace", "value": "17a4bd9c95f2898add97f309fc6f9bcd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115252, "uuid": "7c83e832-1698-4d32-8380-10e9cea6ed9a", "value": "384:vYqDVNgsJCuTNZw679w/VR9e8qcI0wlJ:Q4zTlZw1sNLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115252, "uuid": "378f2a26-6b19-4215-87cc-8e7a74bd3bdb", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115252, "uuid": "a6a06982-575a-4334-ba4f-7e27814f3d1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115252, "uuid": "0f79f391-c111-4f54-ac29-2421134a16d4", "value": "16219e04eab9d404f85408c70e2e0777", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbdf8f74-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141556, "uuid": "d5828b48-a60d-4d2e-975e-d49e906d1d11", "comment": "Malware payload", "value": "3a738ed024ed4f93e474c0a19e9213d8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141556, "uuid": "8fc38b80-44ec-4a80-8ad8-f1c9e8549ae5", "comment": "Malware payload", "value": "d8628fa850089ecd1719b53239c68382fcd1a8ec0d278527e8a3038a0d27b0e8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141556, "uuid": "7deb709d-7a95-4b62-97dc-0b138b54c8e0", "comment": "Malware payload", "value": "b5ca62ccfb57b13c9af698e95818b9d92285f5dd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141556, "uuid": "c9fa8b60-c561-40bd-959d-c44c96cfe2d3", "comment": "Malware payload", "value": "1fcc99b3a69e68ad019cfaaf0226c01213ff7c9f68eb786c1de130bdf5cf281c929d7b555e5bc994323a65ea0ed80a94", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141556, "uuid": "c254030b-14e8-4937-b6eb-d464622539a8", "value": "T1951602118AC43FB5CFAD5A1C50FE160EE3E10A9E5416798AEB33FD46AFE7A0451071B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141556, "uuid": "56457835-8d58-495b-8b32-907f63717a4c", "value": "49152:bj6E9s61DaefB5dXXy9sc6d6TuuF+3JHnURdihIKW8rpkI:f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141556, "uuid": "2803208b-41ff-41a4-9b8d-bfeb8e8515d2", "value": 4313019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141556, "uuid": "5fcca6ef-9cd8-4243-926f-837d5017f884", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141556, "uuid": "9b1e2096-559b-4e14-ba20-edebd6a40a29", "value": "IGH9874567.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4bdacf-6df5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782103651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103651, "uuid": "d8cb53a8-5b96-4067-a829-a154e4c6f099", "comment": "Malware payload (Mirai)", "value": "20402cfcd33cb67bb667334f3dee8bd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103651, "uuid": "5fdf7b6c-7788-4d97-95a5-ed9c2b7575ac", "comment": "Malware payload (Mirai)", "value": "dc1d0d968707d8f28bc9e5d27f883ac5d6ac4ec49623dd02db79f6ea28062cf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103651, "uuid": "6d8ec075-0fa7-4b57-823a-bf021df3ea15", "comment": "Malware payload (Mirai)", "value": "d92c3c091644960bbaf0f5cd35b76dd226bd8420", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103651, "uuid": "6b589f27-47d5-4053-915c-f70f3307d7b4", "comment": "Malware payload (Mirai)", "value": "6b8f5a253b295c7d09db020ca7be305aaef7e2b220d971ef274ccec555bab9cd12ad0526ad0744b515237173f2a80ab1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103651, "uuid": "9ea248e1-5192-4fc5-a648-79eeca2dd09d", "value": "T1A2B34C02731C0F47C5B75AB02D3F57E1A3FE999021F4BA89251EAB5692B1E361182FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103651, "uuid": "bd1ffcfe-c040-483a-9892-ed63dcfda9f8", "value": "1536:bL8aGHx7rZazxJWsvNW/GHogtC4sr3L2LLOpHqDXz+bJ6ecKwgmkyRwPIeSZ:bKKNvjoUsWerb9BjAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782103651, "uuid": "e75f8023-005e-4b92-a13e-114fa70602b5", "value": 108024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782103651, "uuid": "513896a1-3ac9-4f8d-bf51-3c6cdc628bbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103651, "uuid": "d1f0d587-34e2-4ce1-bcc7-5615b36f8ba6", "value": "nerv.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2c4c1c-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782115302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115302, "uuid": "9de1e0b6-118f-4417-b50a-b2ce86dde8fc", "comment": "Malware payload", "value": "7f8f8760489ac267c48d963a52137346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115302, "uuid": "db579de3-4436-472b-aee0-f6f04c426fa6", "comment": "Malware payload", "value": "dc863e4d3ac3ff5a215d47740a4cb3de3bcea6abf13f84cf25e66f9cdbb93c2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115302, "uuid": "099d91d3-ac34-4921-a9de-1a661984b6d4", "comment": "Malware payload", "value": "ba44edce054370740e4670cc1c2f9810b6bf7b99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115302, "uuid": "fd027116-1418-4a4f-b2cb-9a952c7b9629", "comment": "Malware payload", "value": "418faa0caea680d1a8c877c1553f98521f5b8cb18d1cc3ff4a78a324779970d8cd94ab2ee681b785569c232e6705eb3f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115302, "uuid": "caa7e79c-4574-44ad-a67d-d4d58bd7d8bf", "value": "T11EE733E59BC874D6E20DCB378535D518AC72B80E0B4748EF27D809563E6F2E93A7DA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115302, "uuid": "8a194878-c0ee-483c-8417-284ed2d464a3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115302, "uuid": "cd5b54a8-6bfa-4f3e-9a70-487d33e38b9c", "value": "1572864:IgQWPVr6LrtO5SrjtAsIgqTcaNH21A/gE1oeOahi81ePNc:jdPJKrtOsHtAsg7lxrmeVlQFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115302, "uuid": "90493995-9b4b-4893-87a6-0eafe1566d8c", "value": 69290734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115302, "uuid": "9459ae3b-76ca-4ac3-a908-e6dacc2a406d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115302, "uuid": "25f7383e-ce92-42ba-a4fb-290b0a8438f0", "value": "7f8f8760489ac267c48d963a52137346", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960aeef6-6e1b-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782120018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120018, "uuid": "1b88a351-4494-4fc0-92e6-c977ecb588b9", "comment": "Malware payload", "value": "a4ce737a0e4d244381986abd02d6794d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120018, "uuid": "cc278838-2672-4b7d-922c-3bb9b675050e", "comment": "Malware payload", "value": "dc8cc79461a06d8b6d70c02a9912c3604d175fd1b1d0ad438e24357ac9786a35", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120018, "uuid": "1a28d369-28f9-404d-a3c1-2d636d0f253e", "comment": "Malware payload", "value": "ff21bef0606d521f9a6acc6caf63668ebe503130", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120018, "uuid": "f76f0a98-57e0-444d-a0e6-5b3dc837f09d", "comment": "Malware payload", "value": "05a4e31428453a29f2b166d82959ff6ac8bfc458ff3371d0d290e54f99743930f966fdac46b94dc1c7f83327fa9a19c7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782120018, "uuid": "e0e60221-529b-47d0-b846-751832273951", "value": "T1C4137D6966857C24AE99883B1C7E2F0CB9A983E1310451EDBFCB3CF58C49B9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782120018, "uuid": "a6b6d539-c02f-41da-9cc9-2f0745c60c46", "value": "768:e+z89GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:e+zxco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782120018, "uuid": "665cc68c-7488-4ede-8505-6c75933275db", "value": 45509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782120018, "uuid": "68f791c6-7159-4bb7-b8c0-929cc83a615d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782120018, "uuid": "a9e9579c-2beb-4312-ad80-a32cb5516d01", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a435f25-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (STRRAT)", "timestamp": 1782141419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141419, "uuid": "166a0c53-4dda-49c2-89c5-61bdfc999cf3", "comment": "Malware payload (STRRAT)", "value": "6c23256a7e0ea90d3a54f6796eb2db0b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141419, "uuid": "b12bca1d-a88e-4726-b485-4de21a14a778", "comment": "Malware payload (STRRAT)", "value": "dcfc2934ced84dbb4db34918436e8ed2a6f51553b7e0bc84ef17a17fae6145ee", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141419, "uuid": "84e34b0c-a703-4b2e-a364-80229c01343f", "comment": "Malware payload (STRRAT)", "value": "11d129e5ded42ad15c4e4e611854dc84a022de52", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141419, "uuid": "d619964f-65a3-4c45-909d-5458b2aeae1f", "comment": "Malware payload (STRRAT)", "value": "4f5c5197b1b23ec8de3539dd31dba43b89654d577a18374dc51de6f9bbb62dd170b682573a46a99b92c64b91537c1d6e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141419, "uuid": "82035c24-8d3d-4a3d-8dbf-d6c5afe11a3b", "value": "T1FC050055B3AA498B1B0B9E34341A1D6377B80B60EFCC49C49257EE998C5EFC70359E0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141419, "uuid": "859f2f07-9743-459c-b123-4b34b97591e6", "value": "3072:OJE/CWT2+8ORKy2eCeJef8ESPu0apXuX6t9pXTOxpE3MbayoJN+KH9ZKXMIXPWHb:2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141419, "uuid": "4e0aaf91-6a64-497d-8e86-6cd41ac59b87", "value": 849400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141419, "uuid": "3863cce7-7db5-4641-939d-4832dc66643c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141419, "uuid": "bc22161c-f4b4-41b7-9011-a3d87348d0a1", "value": "Proof of payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169d8382-6dd4-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782089310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782089310, "uuid": "67e4d75a-074c-40fb-a59f-e9d5b0ccc9f5", "comment": "Malware payload", "value": "de786e27c860ef6f357ef831417ef3e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782089310, "uuid": "1377f227-ea16-4884-991c-028209daae71", "comment": "Malware payload", "value": "dd2fb463fd8857ce858b96a6b2ec88ebbc2fd724b82a591f69576614f8c81e5b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782089310, "uuid": "55937793-32f7-4ef8-87ef-6b01ec39eefc", "comment": "Malware payload", "value": "c5a157801a7bda0cc1a9cc3545f52e5b0e893e82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782089310, "uuid": "d877a29d-20a2-4601-84ba-e0b82bdc2754", "comment": "Malware payload", "value": "d328c0cb0c6203faf5b42ebeb118003dd3acb9992b2052bde75f0fcea0ea197d88bc86af7bb20353c85c902ca64db7ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782089310, "uuid": "88b3d8c1-6279-4dd2-a4ed-036cc6a30835", "value": "T17845DF03BF50D546D18A2E7489B4C7F92320FC499A65934B34EABE1BBDDE2C39D122C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782089310, "uuid": "270085c5-7e0d-4292-9266-7eac0c02b55b", "value": "e3a511be552b442d33e172edc95820fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782089310, "uuid": "6b1f6b66-b638-4981-a059-98848e57f2b0", "value": "24576:7yOaX5HT9gFGconk2dHdnc2UiSjCne7ZzqWMaTUdSLc3eSJ2Q9Lb:7yOaXAF0n5cvNvlqaTASL+eSJ2E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782089310, "uuid": "c5a4302b-d21d-4cc0-9b1b-4c13e12c37e2", "value": 1219336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782089310, "uuid": "9e188145-0566-4aa7-89cc-d644a0adfb71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782089310, "uuid": "79221906-a3a9-4e4f-a8c3-3362b3f551e8", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d931df-6dd7-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782090869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782090869, "uuid": "e20ce598-5925-4b16-b44a-4fcc00ccbdfc", "comment": "Malware payload (Vidar)", "value": "8b52777c279f46bac0590a0af8b279ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782090869, "uuid": "a4df4f81-0de7-4d84-a6b5-74ffd1834859", "comment": "Malware payload (Vidar)", "value": "dd57db91a672c68953f58462b9e386591f6731c6ee1ec1b699d29b62d4c18572", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782090869, "uuid": "c472a46a-ff53-4116-8135-6d2250901075", "comment": "Malware payload (Vidar)", "value": "0f6e109bb5036a7008356e5e491489b3045adb34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782090869, "uuid": "b7a1b0a0-acbd-49c7-bdea-6d9251c7c121", "comment": "Malware payload (Vidar)", "value": "1cfb3e628ec11bf0f1cf46d10222d6806ac9b80f23911fa9aed0cce3b7d81dd8733a32004fbc0bb38c1daebd12cc7941", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782090869, "uuid": "d64dedbe-5507-42d7-94b6-8cf3b3bcfd48", "value": "T12EF58D02BDA509EAC05AA23288B751927B75BC491F3127D72F90B7B82FB37D05C36B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782090869, "uuid": "68585de5-6442-4ee9-a2b6-b4cec9e22a8b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782090869, "uuid": "985a0bff-1a1c-4528-a3a2-ba09b21127c0", "value": "49152:4c+kMm5gkLtxovZ2WAFPjDECIX5+6VvZCrN:4ltZ6DECIX5+61kN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782090869, "uuid": "765fa1b8-cd01-40bb-8fb4-ed246d2fb082", "value": 3400544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782090869, "uuid": "58c01915-8d79-49c3-b008-4df150198538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782090869, "uuid": "b7564371-0156-4aab-9866-44b46d001cf8", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4043279b-6e03-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782109566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109566, "uuid": "770dc9f5-8c9d-4811-a9fb-6c40688e88e4", "comment": "Malware payload", "value": "9703f990370f5e3fc19c8b0517b7bb24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109566, "uuid": "44bd0ed6-32af-49de-912e-d3974a414970", "comment": "Malware payload", "value": "ddaf85a93a209dce761af0ed1edeb4f7f71d7056413c06b5533e47a83d7f88d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109566, "uuid": "32f6ed37-9f94-4e50-b7fa-15fe81912af4", "comment": "Malware payload", "value": "3f0e031afed0c002f42b90610ca56efa9332ab9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109566, "uuid": "fcaa99fc-e140-493e-b6a3-9b0035e97a7c", "comment": "Malware payload", "value": "55233e4752a4c63cf46fc7d15141c563e5d69e3566a2bd4d4fbdac72eed648705d40c91c8d19a4c84ae1b34eee2b8bbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109566, "uuid": "6642c910-e5e5-416b-9fe6-0c7e9d8e3a2c", "value": "T124263903F99191A4C1EED1308666D293BA717C895F3027D32B50FBB92B36BD4AE79314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109566, "uuid": "98dd9864-0094-4bd5-b4c7-468ee12c8197", "value": "49152:vfzVerb/TAvO90dL3BmAFd4A64nsfJQG387ON1F0yGCyFKFck3BkYG7sDMVv7buL:ZxG33pyFNZCjSAEqwK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782109566, "uuid": "c0732859-b572-4c23-afe0-cac6643a6bad", "value": 4735168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782109566, "uuid": "c603e84c-83ca-416f-bf22-4aaecd038c1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109566, "uuid": "c834d8e2-6557-4d9d-80a2-d7ccd7b5c2c7", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bf66437-6de7-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782097694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097694, "uuid": "a045152f-e116-4386-8608-876a41149de2", "comment": "Malware payload (Mirai)", "value": "261c0baf5a81ed4ab9408f93dce90211", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097694, "uuid": "61ed2ce0-ec26-43e0-99fc-f1b364784cea", "comment": "Malware payload (Mirai)", "value": "df0f17370665acba778dffb57135a02abc34c6bf9399347ee20c689433401d44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097694, "uuid": "2fc21eda-158f-4020-aac1-d760c1872501", "comment": "Malware payload (Mirai)", "value": "96f1ed6cb6a747ee2af85fa9e138cb11806b372f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782097694, "uuid": "35cfed91-f9ac-42a3-8502-cbdaa91f2199", "comment": "Malware payload (Mirai)", "value": "d9adb131e43e2f06269d7cf54600b34d62a715b8c549d63faa88aedc2f21bacddce8a04e130fec3edea249912d6632c6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097694, "uuid": "2b2eceb7-8470-4718-98c0-529200233fb4", "value": "T18FD30A42BD429F13C5C311F7FBAE42983B136BB9D7EA3102ED246F91234B89B0E26551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097694, "uuid": "45d623d4-10e2-456e-98a6-ece5662d78ad", "value": "3072:opkdNPyiJWoPvICBNrnmUrCfiz3EW4Ese7Eg2:eiJWoP7NmUEiz3E3EDEg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782097694, "uuid": "d72418a2-98a6-4e9a-8f70-e3e4edd900d3", "value": 133188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782097694, "uuid": "a974fc86-0ee2-4253-92de-a2a86687ae6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782097694, "uuid": "d52bb8b8-81bb-438f-bd6a-66c110a26936", "value": "data_arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6231cdb-6e1b-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782120045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120045, "uuid": "6b59fee9-0758-41ba-8f90-92efc032b38c", "comment": "Malware payload (RemcosRAT)", "value": "7edd0f9a4a1b690b115c43194ebbea2b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120045, "uuid": "ddaa70c1-c649-456f-97fb-081a157e4e18", "comment": "Malware payload (RemcosRAT)", "value": "dfa61653a19eb4591ddf7dbcc6d6a37ba0c658f4bd7bf9c1f152730fff3deafb", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120045, "uuid": "a9f01a56-433e-4d5e-bea9-de683bb1dca2", "comment": "Malware payload (RemcosRAT)", "value": "9c3a99a88bafb12f1eae8dda2c48c9655a2892ae", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782120045, "uuid": "45f6a0cc-4441-4876-89aa-d1a8ab081be1", "comment": "Malware payload (RemcosRAT)", "value": "40dd8df7478ed20a34da033bf104d0566ebad33c7b7cef7b41c41e7a0702132448a47f4d2e4aecd39779ef828bb06ec1", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782120045, "uuid": "5cf34886-b1d0-4b46-9cf7-9a254faaf83c", "value": "T1EDB533436BFF3C7F4B08822BF66F9F1912614E539009E063A9D270D1D4EFA069627D66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782120045, "uuid": "12df59a3-78d1-4ec9-9219-925ac92650a3", "value": "24576:TmOJYof9mb8MG+iOW63XuzVLF1hzuGWJTiUJRHacji2MSw6JWkiNKKFjUVcT+lcB:TMbrW64xHhcTR6SR+WU+l2gTN1drwXL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782120045, "uuid": "071c1b23-7b5c-43fd-895c-c6203014b860", "value": 2388831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782120045, "uuid": "f25378b3-809b-4837-88fd-964702a3c1ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782120045, "uuid": "6491495a-08e8-4139-bba6-6535e81814db", "value": "ps_NFNPGapwjJjj_1782119277295.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5b7fdb-6e55-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782144864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782144864, "uuid": "bea28001-619d-4d8a-8620-c5383ae3777f", "comment": "Malware payload (Mirai)", "value": "dac44b6d2f8b2cbf9b72f0e96c4bd64a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782144864, "uuid": "c4c03771-54dc-4223-a051-691f9ec4e785", "comment": "Malware payload (Mirai)", "value": "e25c2997386ecc32f7716dc4c3cf05c96e38833216325eb2164be1c0aeda43fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782144864, "uuid": "71e8deae-2a96-4d7f-8255-649b68e985d2", "comment": "Malware payload (Mirai)", "value": "18ef7db8fc2b5c71ff14c0045383c2d3d21797fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782144864, "uuid": "296437fa-725a-4808-99ba-54a0723635e8", "comment": "Malware payload (Mirai)", "value": "846e210d4379f0fa49cd8a6de0ead5e2c2f2b9fc4d128547f1ad69080d5386ea6b3dcd2c98cbdaf8b9f09553130c703b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782144864, "uuid": "7e70db9a-db0f-4db1-ae18-a1e3cdf841c7", "value": "T10424C60AAF610FFBD8AFDE3746E90B4529CC551322A43B3A3674D928F54A54F09D3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782144864, "uuid": "372dc339-7225-4f1b-905d-3d3f437828aa", "value": "3072:+Ez5RQIBudvuGvUBDkPrR2GYQPg/oZ0iyDyYBD9e8:+ENRQIIMvB4PoGXo/78Se", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782144864, "uuid": "fbc3d401-73c0-4bbb-ae26-6c1d9e79ee83", "value": 214352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782144864, "uuid": "72341332-eaa5-419d-85f6-8b491941d7fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782144864, "uuid": "967decf0-1699-4ead-ac5d-18584c85b5d6", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662cb4b8-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1782141842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141842, "uuid": "c9e54b29-5039-43af-bc51-1aabe3e32be9", "comment": "Malware payload (AsyncRAT)", "value": "eed10e1a26e4b294df731df476a2e9f9", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141842, "uuid": "432ef2d1-364c-4d1c-a54a-70eacea8543b", "comment": "Malware payload (AsyncRAT)", "value": "e2fa1f0b6df7ca036edab2d3c9ae4990ab2898c7a25c1cf0a0326bc5b45d4fa6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141842, "uuid": "f3f62a36-8193-4d1b-bd0e-3f505c78c156", "comment": "Malware payload (AsyncRAT)", "value": "88c350c036817e6d271ca8729ab43c8ffc3d5508", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141842, "uuid": "e9b9e252-af1b-44b5-a072-c06236488bd0", "comment": "Malware payload (AsyncRAT)", "value": "ec78b0c7e9478e95d3f262a336d064b3da5c6ce9c0568d32c945dcd680cd76f2bb8b31acad292301a6ac5d02e24e4b2e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141842, "uuid": "db0338cb-544e-4ce9-874b-faf697647a58", "value": "T1FA74C00166C03DD0475F9B3EB27B71C9E356099A7A0B4D8BE721FC48FEA5A15F292630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141842, "uuid": "0e492cf7-1ece-4dd7-9c45-ca87bee2cc81", "value": "6144:2LXcj+3ZBPkDzg8f0NRKKZiVj4Ao+NNM6E3AduMpg+CNeZHCZUBKHZSYH:2DBhKKZiVU1+jVGMO+1HCZRHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141842, "uuid": "e058ad9c-9ae1-4f0b-9637-15e402bf80d4", "value": 352461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141842, "uuid": "3ee708a0-ca54-4dec-9679-db301e5103b9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141842, "uuid": "e63b89f6-b6c7-4f2c-8026-3c45303699e2", "value": "Purchase Order PO-2026-789_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df51ebd-6e44-11f1-ae13-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1782137426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137426, "uuid": "ce076ceb-8dea-4d01-b14a-24ebf57a0b4b", "comment": "Malware payload (CoinMiner)", "value": "343da20a5db5a3dcfff78d3ee853038b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137426, "uuid": "ebbe950d-cfb0-4705-924e-3ac98df07e3b", "comment": "Malware payload (CoinMiner)", "value": "e350ca46f64afa440429285396c60ff2ac5c325996eed910832bd94c9f43c487", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137426, "uuid": "d7e62429-e63d-4909-a784-5fe2f4360d9a", "comment": "Malware payload (CoinMiner)", "value": "10bbf24515ca365e2333d6129ef439a38c146ee8", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137426, "uuid": "b865d8b9-874d-4210-98a5-9127698f0a6f", "comment": "Malware payload (CoinMiner)", "value": "94cc2925bda5e9fc53634cfe0ec6b33cd259131168507d2e8b22023fac7a7e42d8b669408a0ede0a843b64aec59e7154", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137426, "uuid": "09d77488-7eee-4d65-8f66-c4c18bc861af", "value": "T10EF53386E4A1E0FCE852C4B05B340B8B6B1E74654B619ADF1368A6F53D312FD8E3DD21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137426, "uuid": "8ad1a8b1-8be8-4279-90f7-0bacfdba7625", "value": "3641b918fa6fcd6b6754b75fd2065c00", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137426, "uuid": "3dc384a3-dcfc-40ad-a3d4-8d284eaeb7a8", "value": "49152:GAZxbmVpd1229agRkwq7E2CulowBeXoxfdrM181M279fUhuLsJIK0McQ:JZxG2OXRHlulGXoxp179fm3cQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782137426, "uuid": "e9440cf3-bc79-444c-a0d6-a72df63c864a", "value": 3446248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782137426, "uuid": "4237be35-5f60-4c19-88b9-318cdc67eedc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137426, "uuid": "87b3438f-7967-48bd-8170-a755c3e93035", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9406e0-6e0e-11f1-ae13-42010a9c0009", "comment": "Malware payload (ScarfaceStealer)", "timestamp": 1782114263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114263, "uuid": "2719e083-ce66-421c-86a4-e985b2ab23bb", "comment": "Malware payload (ScarfaceStealer)", "value": "0dd679f8d2624c0326d358479e664735", "object_relation": "md5", "Tag": [ { "name": "avkill", "colour": "#A6CE9E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114263, "uuid": "9e72cad1-41b1-4bc4-85ca-17ae83a5b871", "comment": "Malware payload (ScarfaceStealer)", "value": "e3f43bc77fa2ef74946abc231c0980543aa8fb54901dfa23ade201e886a27672", "object_relation": "sha256", "Tag": [ { "name": "avkill", "colour": "#A6CE9E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114263, "uuid": "84464757-8354-451e-8aba-8fc3eb06aa67", "comment": "Malware payload (ScarfaceStealer)", "value": "f558016334afeff7a578088a7078add70be31bbb", "object_relation": "sha1", "Tag": [ { "name": "avkill", "colour": "#A6CE9E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782114263, "uuid": "d7526ebe-4a54-4e96-880b-76926e5ca72b", "comment": "Malware payload (ScarfaceStealer)", "value": "dbf5558c7bb7234a278c6d9ae06fb3b7596a28412244c247a0b6f8572c64f66f644e3185d7d23299e0aff8947824c077", "object_relation": "sha3-384", "Tag": [ { "name": "avkill", "colour": "#A6CE9E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ScarfaceStealer", "colour": "#B33444", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114263, "uuid": "7086247e-fcd7-444b-99d5-19f4e3bd70b8", "value": "T1EB187D03B3A705D5E8F7DA3196E65223A932BC066F3085DF324C17262F73AE05A76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114263, "uuid": "de4846c5-aa4c-4d65-8004-d2fb596c889a", "value": "9bf3f5698d1c8e5d8bbe8d194ac5d544", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114263, "uuid": "c7daba2c-ad49-4035-9c31-b00240987c26", "value": "786432:GAZqtFi3zQzwBs6vNtcZY5Dfw3pgPVlcmXW+:GAZui3zQz2jOZKft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782114263, "uuid": "a15824a8-d812-4836-b7a4-afab6c789197", "value": 90253312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782114263, "uuid": "2b103729-f238-4e80-bdd2-39c01e7d79d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782114263, "uuid": "744fa475-3985-4111-a452-f6b96f254086", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b74ea5-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782141548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141548, "uuid": "65bfcddf-0a5d-4648-8152-93ae0cfca427", "comment": "Malware payload (Formbook)", "value": "63ea9f38d56e270ca5f0941ec0c18d47", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141548, "uuid": "ba83435d-24ac-4d52-b42e-e8f08a9d1be0", "comment": "Malware payload (Formbook)", "value": "e55968141708af195f67a6037b31e232fe3b2c01c4b41927a1191f225a6a58f6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141548, "uuid": "4581f92a-05b3-4d34-9a6c-f08c65c8a19c", "comment": "Malware payload (Formbook)", "value": "496e9ea5111ae813bee53e14adb498a375671d4f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141548, "uuid": "6b335051-d61b-4b7a-8734-372955041f78", "comment": "Malware payload (Formbook)", "value": "d4ae5ed73ec85a95b372bea048147c2a958939af30e2095a386b6f705e68bdf9eca5afd4903447cb9d45c5b61fffe3cb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141548, "uuid": "85556dd2-398f-4ce5-a04f-a04698894148", "value": "T18895021099C42FA48F9D5A1DA0BF225EE7A00D8E6465698BF733FD06EFF7A00550B1B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141548, "uuid": "c89bbdb5-720f-45a4-a1ed-8064f23f66a5", "value": "24576:Hq710kDcap6K1YGPR/fiQuKhVGrQUhD4ZvE0GtXwKzIBY5Sugu8E2JCm0RQb0lnM:CTNlKXuHCAUoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141548, "uuid": "3c33e2e7-3095-4442-bfd7-438fb1f7fb16", "value": 1980747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141548, "uuid": "43c80f71-1239-4c61-be5a-9447af82f9e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141548, "uuid": "526e7822-91cd-445c-a952-03bddd2e0519", "value": "Yeni Talep Duco_Nq.s.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef308bc-6e07-11f1-ae13-42010a9c0009", "comment": "Malware payload (Gafgyt)", "timestamp": 1782111577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111577, "uuid": "3d8dcd4c-54c5-415c-9d31-f745ad9a07c1", "comment": "Malware payload (Gafgyt)", "value": "85b8f610817ce8a78f095bc82f2319c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111577, "uuid": "25930b52-f705-41d5-8823-326cbb33274a", "comment": "Malware payload (Gafgyt)", "value": "e56247766310af8e9348e370a83a22d341c2d40cfe9bc765898df918ab6c1b69", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111577, "uuid": "dc0bff6a-79df-44af-81f3-6767aa140b48", "comment": "Malware payload (Gafgyt)", "value": "14a118c8f943b585c9d9ee593a294b7caf09dd13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111577, "uuid": "5e2eaaf7-4309-49a6-9445-66ae4050652a", "comment": "Malware payload (Gafgyt)", "value": "27f6308ec593c33de3d4f55368583e69504d2468a686740c1f9fc29909b3ad9ad7104f8c7c25596a4b4f284bcd353e1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111577, "uuid": "130fc036-5437-4a9e-9d3a-26095a88cbbf", "value": "T109749523D8154595D1615CF322273389AD0B87BF89E732D3EE2A59A0BF2051F52BEEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111577, "uuid": "8fdc6718-a978-4e43-aeeb-e4cb9ec06876", "value": "6144:uvRThkFmlfwjomvOkmymE/67QaSXRiORNb:8RdkFmhwjxMymE/67nSXRiORNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782111577, "uuid": "09bf3036-df64-4572-ae0e-29bc8977d687", "value": 349725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782111577, "uuid": "046ccb46-697f-4209-97eb-bd4e95e3a259", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111577, "uuid": "acf66266-ae67-479a-81d8-fc3c994ad7e9", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d63ecf2-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141505, "uuid": "1e4d8fc3-085a-439f-b7b6-f0e0bd6985b3", "comment": "Malware payload (RemcosRAT)", "value": "bd46a5f98365b8782da9107f5115d448", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141505, "uuid": "28e47531-fb73-49fe-979f-b2d0579c42b8", "comment": "Malware payload (RemcosRAT)", "value": "e73654f99e3083688750ab556580592b0cf0a63175d86d7c32e172196a577d4c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141505, "uuid": "402eb033-440b-4e60-ab06-53babf64addc", "comment": "Malware payload (RemcosRAT)", "value": "7516f92539151e86af3492414d71fe166e11cd31", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141505, "uuid": "bd0088ce-8a43-4ee6-b2f7-a257ad9d8a15", "comment": "Malware payload (RemcosRAT)", "value": "4b3116555f34c13da3395f23cc520cc49eda16d29df95df9c8cce6e9658df95832d72bbf10075304b0203903653cb0df", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141505, "uuid": "6330fc67-9751-4594-9c6c-6df619707af6", "value": "T17DD29D70DAD1216DF7B6DA74926E4ABC532B928B312F1F3A00D522D0CB13EC16776879", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141505, "uuid": "809b9dca-174c-4c26-a929-a9f9a5665936", "value": "192:uGkr62bTZc2eRvXtnup0aqgiLA4Dii9zXYukJIOXssoCmdmT3m/pR4BJJDMpHMDs:ukwZcyTwLVtIuLTsLOmLopR4BjDK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141505, "uuid": "ab73ea6d-4f7a-4912-8ed4-933174060be4", "value": 30481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141505, "uuid": "025b7a65-53fc-4c2a-9ad2-5e4e23c0c89f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141505, "uuid": "e2ea96fc-7ce7-4da6-be9f-fe588eb66432", "value": "shipment Docs_PO#RFQ10930.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aaced8c-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1782115275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115275, "uuid": "8d517b11-073e-43a7-afa2-e9d0f3d91ad6", "comment": "Malware payload (RemusStealer)", "value": "5154b86d4eae71012e4ab8c076fc36b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115275, "uuid": "f7f54a31-9926-40e5-8e0e-5f082d0978a2", "comment": "Malware payload (RemusStealer)", "value": "e7b999184fe1dd10a5018bfe049ba961059df4b3e826393bb7886abb82956b80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115275, "uuid": "d35e72ad-657e-48b7-9641-df278323c792", "comment": "Malware payload (RemusStealer)", "value": "07046b74403769d94de06880645623ffdf9a06d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115275, "uuid": "5efbcca7-de66-41f1-9a87-704f9a34f99b", "comment": "Malware payload (RemusStealer)", "value": "2cf14a575876665bbf947f97060e84eec98182fc408e1ff43995a6551fd8867a6bf9dd913b3f0622a7ef5485819c8f02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115275, "uuid": "a17e4ea6-b275-49dc-8bb3-331b3becb931", "value": "T172764C03EC9155E9C1A9A33089B79252BB757C491B3223D72BA0F7392F76BD0AE75310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115275, "uuid": "be50a68b-7cac-4545-a216-526fb0ddb9b5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115275, "uuid": "b378560a-f392-4dba-a5de-13119a31b897", "value": "49152:flOZiQc2ZE1JWTKRUycOlZD9J5KxanGaM4k7EQB0yl7R7LcYv7CORl9196Jqc2mq:fE0lFnjM4k71B0uuceJqPLdYAnEuas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115275, "uuid": "d8355df3-c0fc-443c-bf7d-f119879f0f1e", "value": 7358824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115275, "uuid": "a49e74ba-71c1-4ef6-ab7d-d286a22eae5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115275, "uuid": "a1d3b257-c20d-4201-9a38-4b8a3a8bb257", "value": "5154b86d4eae71012e4ab8c076fc36b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928ef934-6e2e-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782128173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782128173, "uuid": "93e2e49b-1b8d-4783-8ff3-cba0e20245e7", "comment": "Malware payload", "value": "1d04536714bb22a3e909525a7dd627f0", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782128173, "uuid": "68c3b84f-ac26-46bb-bb11-62cb0cfd9f46", "comment": "Malware payload", "value": "e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782128173, "uuid": "f60859e7-e53b-426f-9af7-1c3be26b2715", "comment": "Malware payload", "value": "affc166fa1874ff3ec0e42646e008cec972b76ab", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782128173, "uuid": "1dd1928b-676e-4cec-b455-f98f1f247cbb", "comment": "Malware payload", "value": "ff05a72b056b8d16cbe1d1d99130dcfdf7d3e53cf109e47a85541b4ad7997ebb06639ab73bc950a003d6e5a6e29e1441", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782128173, "uuid": "f8f2497d-89bd-4f46-8656-e1842062c7c4", "value": "T14565020BA6A401F9D5F3C174CC42590ADB76F84A47A5EB4F03E449961F276B09E3FB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782128173, "uuid": "319eaa7a-42a4-4a20-89ab-005f9d2bf852", "value": "7e266528ec985c53014ad02d5c6a12f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782128173, "uuid": "b2244394-7325-440b-9b05-6f36fb097fdd", "value": "24576:+7JVbIr44BR1IVOe4waHbTkEFhA+b3XYXKXjAOY5MBmYBREkM2eU25gooYHJLUY:moj15e4w8xhACEKzs57Xci5NLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782128173, "uuid": "1b6b66ab-ed38-44db-b26c-d1dc3e65e9fb", "value": 1452544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782128173, "uuid": "d6ba8154-bde8-4da3-b377-1ee5f5058227", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782128173, "uuid": "caf0f218-8654-4bd6-b66f-16e27387b4e8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c6903ea-6e91-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782170521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782170521, "uuid": "0d5a2d63-79c4-40bc-aa55-0a55797a2885", "comment": "Malware payload (Mirai)", "value": "9db50f37305da580f62541577ce563f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782170521, "uuid": "c0b1d75e-5d6e-4c0e-afa9-419db2a81442", "comment": "Malware payload (Mirai)", "value": "e88eab522c01ac2be9f19d8f55c4ceebe8e04a01eb72922d7077e31c5ab4ed34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782170521, "uuid": "f951487c-23df-495d-b61a-cc5ee91f42d0", "comment": "Malware payload (Mirai)", "value": "4d460b267052034813c0782dded381d87c723cc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782170521, "uuid": "f70a248a-efd7-4fd5-87bb-6d7674c9518d", "comment": "Malware payload (Mirai)", "value": "82edb71eb32aa7887e4ddc7bfae4c31c5c2c615f0e6ee7564d968190c68165781ad98851631c3de7999ddeecf9f9cd8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782170521, "uuid": "9641ea0e-0b33-43c6-b158-e64d85d9bab3", "value": "T190F30885FD915B26C6C622BBFB5E42CD772A17B8D3FA32038D255B20378A85B0E37541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782170521, "uuid": "75ad418a-21a9-4e25-8a3c-4046cd1b0a4a", "value": "3072:TlTOxKnfLema9CTdmWuj9ZTS+d4XNSMcVBGsc3IGjBk:hTOxKnfLedCTdHuRZe+d4XUMcVAh3IG2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782170521, "uuid": "47533847-9238-4a26-a105-95596522f018", "value": 166412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782170521, "uuid": "a56b2057-4b66-4f49-9fec-178ce9a84f45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782170521, "uuid": "59bd6540-25e6-4599-a1d7-60ff27e56237", "value": "larm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d7a7e4-6dde-11f1-ae13-42010a9c0009", "comment": "Malware payload (GuLoader)", "timestamp": 1782093607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782093607, "uuid": "8d80357a-4494-4e88-9e02-364c2194c5ab", "comment": "Malware payload (GuLoader)", "value": "b0e14b749d6ea74efedde6ca496b45d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782093607, "uuid": "00deda76-4681-4e4d-8258-56e74105dc99", "comment": "Malware payload (GuLoader)", "value": "e9b9e9b3ba47548c9f0937837bf16550f573c25f7405e8cfbf45519d79ccde4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782093607, "uuid": "4e245000-a241-49bb-bcc5-90fe95aaf2fe", "comment": "Malware payload (GuLoader)", "value": "a0a473dd0296e295d3802c77bbe5766ffb333b0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782093607, "uuid": "7b26a3d3-5e97-4164-a361-3e7f79c49eda", "comment": "Malware payload (GuLoader)", "value": "5fe7050637bad551410a1f0dfd068d051e4323f71f1c458ebd2bdd8affa388fda7aa4b84c7d16a8160415710148779a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782093607, "uuid": "01970a0c-f8e5-49f3-95d3-5100e8f5e4ca", "value": "T1E674126161E5D87AC9645731DC3A07FAA485FD1AC4B48A0B73C17E6939B13C2EE0EB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782093607, "uuid": "558e03a6-6100-4d61-ac22-7499a78f2823", "value": "6e7f9a29f2c85394521a08b9f31f6275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782093607, "uuid": "86887454-1523-4f30-8104-a4a28528df48", "value": "6144:IMm4CCEv3liZFEDwxQRy4Cm4k2WQ5s9PxVVuVGNZJWG7JtmkfCTydOjkY3NAC:IMw3v3lisDpRfr4c6iPxVVuVG577mkfy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782093607, "uuid": "8f2ee31e-3e29-4531-a5f0-71a13631d9a9", "value": 369264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782093607, "uuid": "a79b3a57-5652-44ea-925b-335b13a4ece3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782093607, "uuid": "59e40f45-4c18-4cfa-814f-4f865570767d", "value": "rDirectricesdepol__ticasparaempleados_2026_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1717d086-6e2e-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782127966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782127966, "uuid": "94fbec0e-dddd-451f-bd60-737350a33f29", "comment": "Malware payload", "value": "6a584892be411d669167a89258da5c33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782127966, "uuid": "9b1006d7-058a-4d47-8d1c-b594aef4c0f6", "comment": "Malware payload", "value": "ec8d60bddd7fe56464c19e510e14cc4efcb932e4aaf7df24de87b00c7ad95f1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782127966, "uuid": "e0897596-cc20-4021-b4e6-6bf5a701178c", "comment": "Malware payload", "value": "924e596d2a3101c8695e7102152f3808a0608bc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782127966, "uuid": "3c53ed03-6eea-4f5d-8c02-9ec0dda63770", "comment": "Malware payload", "value": "aaf6e2c1af13313e1ed4bce03ccf1218c229cc507aa208d2ec3ed086b109e7edd1771f060bfbbd829ad8e4b2b254bd27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782127966, "uuid": "0665e737-d43d-45e3-8e72-c94344dd4eb1", "value": "T1CAE6D026E3AE21C8D9BBE0BCC5974A57E5723C044B350BCB29D1169C1D67FEE0D79A20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782127966, "uuid": "6d211977-3623-4165-8204-4cd93a6b51b2", "value": "3593ecf3bbc480e3a53e7b22f8fb6689", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782127966, "uuid": "21341ffe-76cd-4452-9d16-276e7b434f86", "value": "49152:Tn9Ml7eUjeBgr36rdYuL5h0MsUK7fIzoIlPz8t2/vPvDPiVDsgQRFNYjbnGWprnC:aOrdYuLA0zTnDPiVDsOlE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782127966, "uuid": "fefb9561-a3d5-4e49-b432-1ed268ac88b4", "value": 15053824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782127966, "uuid": "6acffc5d-80be-4e1c-a1cf-a3e4a68e4a12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782127966, "uuid": "341c55e4-6a1e-4fcf-9845-925dccf63d62", "value": "SecuriteInfo.com.Variant.Application.Barys.69136.32697.29003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85e40b3f-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload (GhostPulse)", "timestamp": 1782115267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115267, "uuid": "dea35da8-0d0d-4403-b272-435d75791ae5", "comment": "Malware payload (GhostPulse)", "value": "4b1fd32206aa2831edead99efe88549a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115267, "uuid": "01f3f4fe-0e25-46b7-9626-6286cc72cd3d", "comment": "Malware payload (GhostPulse)", "value": "ecaedc68c09154f9e97673d84d1860d5755828182a42f6aab64ab3766ce47396", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115267, "uuid": "a91995f7-2bcb-4c60-a975-3f6342ee4a62", "comment": "Malware payload (GhostPulse)", "value": "d7982957ccd47d3603494688dc4a3d1a6d5183f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115267, "uuid": "1e1e9b2b-a0fa-4b99-b3cd-272f0862aa6b", "comment": "Malware payload (GhostPulse)", "value": "295e67e1d85e27b4e2bf161b4c783ce8b065dbd0f3869d9163e5878deb9dafc3941b974bce6898cf143e816a16913372", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostPulse", "colour": "#5689DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115267, "uuid": "08fece89-1596-494b-805f-b3e1a5ec9488", "value": "T15ED63301F7D634E9E1A9D1328D09CB92C995F298AA44EF83CF454E512EB79BE03470DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115267, "uuid": "3a611bd0-6264-403c-afa0-22ae30bc6d42", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115267, "uuid": "374f9c8a-24de-4060-b020-3bfa75740964", "value": "196608:+p/QnsMGHVcHhOrRYARMqO7L0dl0wJvo/wJ2WAc2OLL0esvKinH+k+FQZh:+pIzG1cB8LRt2qLho/odAcJLY5rfuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115267, "uuid": "2c2bd7d2-409c-407d-9d99-048df3db0beb", "value": 13331791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115267, "uuid": "4e5a6850-9a9a-48ae-b8e6-6556b9a64558", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115267, "uuid": "6f7a56dc-bc68-47f5-b910-352be6726a18", "value": "4b1fd32206aa2831edead99efe88549a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed83c5d-6e49-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782139924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139924, "uuid": "5335e6b2-d9a3-4606-987b-1dcee373ccc7", "comment": "Malware payload", "value": "bfab914fe1b96232cf54dc0016a32f06", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139924, "uuid": "5077a9ab-c768-4569-bd77-8cfa2203a09d", "comment": "Malware payload", "value": "ed1d99b06bccf9436bb1b9517520010b412b3d8d9d12bfd6a6ef11df1df1ceb2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139924, "uuid": "dd5fcb4f-1f76-4f9a-ae59-bead63d04fb0", "comment": "Malware payload", "value": "5ad1b75614cfd1c9867c5939f630010dc4bc1142", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139924, "uuid": "6255dd95-a0f7-422c-be9d-6d1acf5d6693", "comment": "Malware payload", "value": "82e17bdb7056158653199f8e8d8d98cd48e77e35ef129ae34564c87a7c70f3d969d98a8a4c2f1b29dfe6738edd83d14d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139924, "uuid": "35e0e97c-e053-433c-823c-79162647332d", "value": "T122A4239C26D11A352CD7B294B9153F870770E71F37ECCAEBA60B39C46AADC30054664E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139924, "uuid": "baa7b215-5c8c-4353-8a21-328303315b54", "value": "12288:gJAjNngJOPJzYfcEaN9B/Jm0LU0gM7aQt:g+VgQefclN9BhmSHb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782139924, "uuid": "b36d1eaf-fd94-462c-821d-6f23af064b71", "value": 467513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782139924, "uuid": "3669a818-7932-44b3-891c-aab60cbfbc9b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139924, "uuid": "96ca0377-46c4-4b9f-b8a8-4126c64077b5", "value": "Loan_Prediction_Approval_v3.3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83300bc0-6dd5-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782089922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782089922, "uuid": "d49014f1-60aa-4bfb-bf91-524c80d152c2", "comment": "Malware payload", "value": "ac802a6a3fc75926145fd519d8631baa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782089922, "uuid": "ee5a7d4b-13c4-4a0a-b5fd-13a193143f61", "comment": "Malware payload", "value": "ed8060fe81b7f72936bdda1f1fbb83a96084ad28082ddacb88a59a48b1db0ab5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782089922, "uuid": "0059dcbb-0547-4b33-baf2-4ab220839c98", "comment": "Malware payload", "value": "09b15a9014dd9bf94f4afce2b5980c1a58cd38bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782089922, "uuid": "2e0ec676-cef6-41b3-8e66-c3f65be825a9", "comment": "Malware payload", "value": "2fa253d8197717c350cc7d09bec5a2dee31a139a648992b0b9785a8f21528dfffc7e77ea383c0ea8bf44d15c89d028c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782089922, "uuid": "9f1d6744-835d-4b5e-8ca4-144a1d472007", "value": "T10CE623D97A8411D4C49309B0B69A93ED32C0BD5D45ED4E2F39C62D03AF51CEF290AEA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782089922, "uuid": "9bad6e3b-7dc8-447d-906f-13b26019356b", "value": "a5aafbc9f7097539c906c7c235ab5ad4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782089922, "uuid": "8ba21eba-8a09-4a24-960d-ed2f202c4989", "value": "393216:aFWW3ekoc88osa+qwmqufi7Yhp8MefxNAnR2qZy6C7:DW198Ua+qwmquZZePARbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782089922, "uuid": "88ddb9c4-5071-413f-9e02-b967b773fce9", "value": 13953944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782089922, "uuid": "318835cc-13ee-48a7-94c7-819cd7132b39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782089922, "uuid": "4d037e28-57e4-470e-b18f-e1b4cd8d1a51", "value": "Cs2Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4008c511-6e61-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782149939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782149939, "uuid": "880be84c-6856-4702-8d40-92fff4bbecf9", "comment": "Malware payload (Vidar)", "value": "84bc87a5e899d7338ffa877ea83c37b4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782149939, "uuid": "9043f244-b918-42c6-b993-4d39087ceb2d", "comment": "Malware payload (Vidar)", "value": "edad96e122dfbdeb2c71cf52330085a3deeb04586062474c119a2ac2bab5ab47", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782149939, "uuid": "34a0ebe6-1c3d-4b03-9271-6fbcaadfddff", "comment": "Malware payload (Vidar)", "value": "f00f6519539367ae31bab92076354245708bd9d3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782149939, "uuid": "e827f9fd-e4ac-47f8-969f-31f2cc034bcf", "comment": "Malware payload (Vidar)", "value": "5a3217e30aa42feac198bab95668cb3568873cd20f04096b7a86900c98815aa15c6eba3fb12ba9e41e17b24ea8d0e3c2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782149939, "uuid": "a793bad9-8be1-40ac-90d6-c1439db35511", "value": "T17A068D07FED01C6DD559A23685B39681377CBC051B362BD32E91B2762F723D0A9BA720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782149939, "uuid": "1d456b51-92a6-41ec-a382-61b9306afc28", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782149939, "uuid": "5d0d5071-0b19-42c5-901f-f7b0298467ea", "value": "49152:CuC6iaGUfTcv0rvyDK6iE+uAImudaxaBZipx6Xf1tV1wShEIp:Cnnu6Gzh1Du8xaBUx4bqSWIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782149939, "uuid": "50b7aea4-a788-4fff-9f66-a3153a8cb942", "value": 4016960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782149939, "uuid": "f727cc85-f06e-4919-94b3-8739c6480d24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782149939, "uuid": "09f0f089-49a6-4667-9e6d-d27dcb9f22a9", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2801d4c9-6e04-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782109955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109955, "uuid": "3bfe7c6a-17c7-43d1-a383-4ec16c564cbb", "comment": "Malware payload (Mirai)", "value": "a3e1ed1cd2571fa3e2fa02717ef90230", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109955, "uuid": "081d3749-361f-41c0-896e-ce4cf92cf837", "comment": "Malware payload (Mirai)", "value": "ee223d4c46acb576bb9d3a0f371431cbbc1336ecf403dd75ab3a073fe7f3c811", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109955, "uuid": "bff5851d-74e2-44c8-b32d-f335b11da8c6", "comment": "Malware payload (Mirai)", "value": "f2b9f3cf6efeb5cf7cfb5fdbec82bf67662bdeee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782109955, "uuid": "0aa12f16-90f1-490f-a79d-c63e57c422db", "comment": "Malware payload (Mirai)", "value": "56a38b7621d27873f57c575f31e54cf699342cfdef3f7622e4ed91f3b8e184fd620d96149e7b6fb09fe2abbbc8804aa1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109955, "uuid": "245057e9-3b62-4716-800d-8e3ba49cdab4", "value": "T11E74A623C8154595E1614CF322673289AD0B87BF8AE733D3DE2A59A0BF6051F52BEDC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109955, "uuid": "3b103af1-7cda-4695-b0e0-129ec6cf309f", "value": "6144:T8lafR+gAjDwjowXDiNaQn3mIyQAzXKTNu:eatAHwjhux3mIyDzXKTNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782109955, "uuid": "a26a1733-7d2d-4ff1-8795-72dc350150a9", "value": 366676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782109955, "uuid": "a6d835c4-d7d4-4145-8f01-644d33121e37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782109955, "uuid": "6066ab87-d05d-45f7-a327-c67efb533fe8", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989c71eb-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1782141927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141927, "uuid": "2e9f8656-7ff8-409e-b409-f6874e2265fc", "comment": "Malware payload (PhantomStealer)", "value": "74ff2f56e582a67bdfffc68502a0b1d7", "object_relation": "md5", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141927, "uuid": "1e59264e-c286-4095-b071-dd9bc475ab2b", "comment": "Malware payload (PhantomStealer)", "value": "efc9d9a00d755e1db2bece5f3876de42c0933e222d6a97ad47a01827cc153303", "object_relation": "sha256", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141927, "uuid": "9765c3f4-64f6-426b-a11e-391cb8bed706", "comment": "Malware payload (PhantomStealer)", "value": "cdc1f991db0108259c89164d476cd662143e9661", "object_relation": "sha1", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141927, "uuid": "9840d0aa-37f2-4719-bca0-75d53833eaa7", "comment": "Malware payload (PhantomStealer)", "value": "222a7781eb6aac7ca58646c847695434b56ab465fe345f383d6a91f504f1a7ebd64ccf57bc1a9f12c48e8c6d1f0b682d", "object_relation": "sha3-384", "Tag": [ { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141927, "uuid": "fa439302-dc3e-47fe-bf51-62bbca358970", "value": "T1811602118AC42FA5CFAC5B1D50FF260EE3E00A8E5456798AE733FD46AFE7644510B1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141927, "uuid": "383a918a-0aeb-4aa4-b69b-e944f630e7ef", "value": "49152:R3VriAv9FKve5pu9itHcDRL0IUdVlN+2fuw:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141927, "uuid": "6fb1ad83-de14-4ee4-8cbe-a4b8837557b7", "value": 4317932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141927, "uuid": "b4525646-db25-4ad9-b769-495620f301f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141927, "uuid": "9190eda3-434b-4fa0-b678-6cd9de1079d3", "value": "FEDEX ACCOUNT DOC.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2eb8046-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782141515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141515, "uuid": "ea65c2ee-fedc-4af8-b779-73fbe9cfbd13", "comment": "Malware payload (Formbook)", "value": "b6e41b35fd514049f7384bc05a560210", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141515, "uuid": "aea33b2f-4443-49b7-8ee0-2071df4831f7", "comment": "Malware payload (Formbook)", "value": "efdaf4ed6f70941fa55643519f0a2b420c0fa4a488e8934411ce574465f119ee", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141515, "uuid": "6ec4c011-7671-4bd7-b7fb-35b238f4830d", "comment": "Malware payload (Formbook)", "value": "1e3cacaf0f1d680925fe49e427559b6926b69cae", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141515, "uuid": "daee57b9-93d9-4fbb-9c43-428a643e87ee", "comment": "Malware payload (Formbook)", "value": "76568c2d8e5f0b77d50ad3e057044390b059c8296b6d5a425c3122e181e44506fc2bacbee22e8464f95a63d5cce95999", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141515, "uuid": "235ed245-a422-46e8-90bf-dd68232d4f17", "value": "T12E9502114AC42FA4CB9D5B1C50BF364AE3A1099E9456288AEB33FD46FFF7B04550B1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141515, "uuid": "d74d9ce0-49d7-4712-ae89-aaca8a04b900", "value": "24576:KSojqVsHp9cnTfQEf91rkrGOvCXznp6fvdv1f/cumcGXqF+f+38:8+khv6nIFGcM+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141515, "uuid": "78d3fdbb-c54a-4740-85a6-17cb610b8685", "value": 1978559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141515, "uuid": "1c6b80d4-f361-4b8c-93ac-d9bd734fafa2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141515, "uuid": "a708a61b-a27a-4f6c-82ab-54edc36ef20a", "value": "report.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "523bbd25-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141809, "uuid": "d9c89245-66ae-4fea-ace1-0ea174c32c90", "comment": "Malware payload (AgentTesla)", "value": "2c88c3914bfa18e03e2a98b11130824f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141809, "uuid": "da271358-6eda-41f2-92f0-b0a3bd7d722e", "comment": "Malware payload (AgentTesla)", "value": "f1511d38d6b64d36bd649cd9f39587b8752b4124c64e0740ee6ff094d4fb1b23", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141809, "uuid": "6c7de4cd-7f54-4a67-9ced-f7e597b5ff4b", "comment": "Malware payload (AgentTesla)", "value": "9e9b7c9f271366214be5fbba9b34d61dbac3f5b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141809, "uuid": "8c3b62ff-2b56-480e-9ddc-a4f5e44530a9", "comment": "Malware payload (AgentTesla)", "value": "531793e30a5fbbc5e26e64b554d1e07c1548f6ae68973fa7513b1869db583aee92b5d8c657a456fd462f1e77ec15d992", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141809, "uuid": "6c5d4d5d-fcbc-4bc4-bd18-b8ae780ce205", "value": "T1FAF5298117A0A1337760E7AD5237EE31A44F681319DACF10312EE728791CD4F67A9AE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141809, "uuid": "a6bd9411-ef45-495e-a93b-61ba8f41e874", "value": "98304:T3JdAdsSghU05itONRERLjka3hYDjWAKz4CLuvxxgO3z24inDgNav9Y9g0sS5Mdj:TZdAGSpXwDERLj93ODjWdtLVUz24ODWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141809, "uuid": "6eac0b85-635e-40aa-84e1-7a47b184e696", "value": 3321761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141809, "uuid": "09da25f8-7da4-4790-9f2c-7fb00ac5788f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141809, "uuid": "fb64b4be-57b8-4fcb-9629-5e300b61e3c5", "value": "Urgent part P14797-24-A.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3522c4a6-6dd3-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782088932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782088932, "uuid": "f5a57752-5362-4241-878c-20c86a73116d", "comment": "Malware payload (Vidar)", "value": "4b9a7a4f3b2961ee4a9a22d43611357c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782088932, "uuid": "5b062816-5eac-4a94-ba25-38893419e3e3", "comment": "Malware payload (Vidar)", "value": "f173bf9573df7fe9137d8c9a4fbac2b108187a250ee9b830ec3873bccd4ea10c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782088932, "uuid": "75c9671a-aeff-4b28-a8c3-a656bf051efd", "comment": "Malware payload (Vidar)", "value": "1158a25ac26cfda2289bab9691ff4b556f96ea96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782088932, "uuid": "a7c1e919-0890-424a-8b8e-cf64d5a4bef1", "comment": "Malware payload (Vidar)", "value": "6a8248c76e3fe017543609bd586e8b0bb204c99d6702f34ed9cdaada6bde80fef03014b3d582a57bc0d325e0d5002291", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782088932, "uuid": "cd60eedb-d0dc-4f9a-921f-4368c4ad2225", "value": "T115F57C07ECD249EAC0A9A3718ABB9582B771B8091F3227D32D50B3382F767D49D75718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782088932, "uuid": "c22ec7f3-190a-4577-b5d9-cc55c440ec0a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782088932, "uuid": "2471ab3d-9769-49a8-97cc-3c896726e958", "value": "24576:zqJU4d8s9xh25fYZnhc6ML2CdVOTXWAXCKMhrm2Rw6NRMX/smJKKdhNRXSLWORAD:zqJR+6xgRY1KbNOBQxR/URLwZ8SCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782088932, "uuid": "a9bff69f-9259-4a06-9f77-eac0ec59c131", "value": 3351904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782088932, "uuid": "3fde63f2-9933-4f69-8db4-4ae0c2aab24c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782088932, "uuid": "6b5f4030-5303-4c61-b5b3-acbc00b19867", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced3baa3-6de4-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782096491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096491, "uuid": "295b54b1-e82c-4763-92df-e07633d718ea", "comment": "Malware payload", "value": "e66f444d93ca51f3a3630e847b29bbd9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096491, "uuid": "cd66ae2c-8165-45ec-9692-5e3c385229f0", "comment": "Malware payload", "value": "f197de37ab531b3db10d24757e3668602901389878afe2e11546a3f6be5d818d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096491, "uuid": "7a041587-330e-4bce-8391-ea04ae69c2fa", "comment": "Malware payload", "value": "f96c95e4dc4cf85aa315a34d4815225f2324b0d1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782096491, "uuid": "7b440295-dc64-4a01-813d-3ed4c9d0df1c", "comment": "Malware payload", "value": "cf77a458bd426e6e671c82b04880e869396a1bdabecf0c47b7897cc80a374705e630294954ef342dc664a20cd8dbbb3b", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096491, "uuid": "0a1d40f3-0549-4ab7-946a-62a8fa3ba908", "value": "T16C136D6516953C25AE99883B5C7F2F0CBDA983E1304491DDBF8A3CF18C15A9CE718B1D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096491, "uuid": "3b2dd275-0774-4b40-82a9-e04e1f89c716", "value": "768:Jr9NyXsZztC+9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:BHusZOco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782096491, "uuid": "43796063-9b53-49cb-b5bf-0a7b867e5492", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782096491, "uuid": "63ccf469-43cc-414f-8c14-2e9b3d457550", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782096491, "uuid": "8a40ece2-e9b9-40b1-ab9d-e789de4e474f", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65406ce-6e43-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782137333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137333, "uuid": "562dfabc-7974-4194-9d22-d2343ab06472", "comment": "Malware payload", "value": "7ee470fa82fd63c493ac5b21e56d62a4", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137333, "uuid": "1aa4352e-0088-42e8-8483-6bd55f4c27f8", "comment": "Malware payload", "value": "f1df00a47848af0d79c74d7cf3040dc07f80ef3db960b7a78cfd9b7cbc80ef1b", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137333, "uuid": "15caf863-fc24-4907-89f9-62afac2a0e95", "comment": "Malware payload", "value": "df075540dd088005ec64a0151a7faf6a66ba5680", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137333, "uuid": "fe741e10-5151-47b0-9b75-5c1c5ee83740", "comment": "Malware payload", "value": "69d2e34976c06b20de96c05f391d7194df2ff980a6ceb01b9b6b37024900be6879525da2bfb51792a51e0d0060c70d5c", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137333, "uuid": "642ed293-d672-4f38-8c83-c9b89d6a5e41", "value": "T1A97733015023598BC1C5B837EF7FC670AF797329A16E3198D13EA63B7F952C11E294A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137333, "uuid": "eb348d68-e07f-4598-9869-46a44ad4ecde", "value": "d54f4ce7166adf987d04345af91ff939", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137333, "uuid": "e03584b2-2448-404a-8dca-c0d5f666371a", "value": "786432:NIk+ErDw9oLCiZ350O4COAbpiSg3X/LF0lA9iyT3Zx+zey:L+0DwO1iC3ihLuA9BZty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782137333, "uuid": "f3c5af90-da0f-434d-bc24-d40df1267c0d", "value": 34412642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782137333, "uuid": "462d3bb9-d164-4e2a-8676-3cefd3e839fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137333, "uuid": "d9f578ce-4dd1-4dd9-94f2-08332d27c463", "value": "XENO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d94bed-6df5-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782103648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103648, "uuid": "35c22fbe-2610-4288-b8e5-6947b9187aba", "comment": "Malware payload (Mirai)", "value": "8a71c0fdb99d6723b47f54f81cf5b3a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103648, "uuid": "1ac5e050-ce28-495e-9104-5404e769c0b3", "comment": "Malware payload (Mirai)", "value": "f27a165f3cdcb6f72dceaf130398fa7f78b2a5c7e5a22cb14db5e8c5b4151cb9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103648, "uuid": "f76fdcbd-90a9-43a0-9e24-183689fb020d", "comment": "Malware payload (Mirai)", "value": "2b674e64329b508e29531403a5211db7bdef8ffa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782103648, "uuid": "d069f213-a468-4244-9943-46f0286c32c7", "comment": "Malware payload (Mirai)", "value": "55349ac74e881abf6d23b651259b258d8532ff9f053c51d5c807dc5c2f42ffdae5e8a9b275d2ffd4ee79cd74d77985df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103648, "uuid": "b2c99468-920f-41d9-a028-8d8e9f771ab5", "value": "T184D3E71E6E218FBDF769C33447B78E25A39873C622E1C641E17CD6115E6028E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103648, "uuid": "99c0e081-7335-4153-bd71-cef95e9926f5", "value": "3072:z0SBJcnFwP9oYCz0iXC6dw9BaFZnugRQeAgs9:vJoFwP7Cz0iaiUz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782103648, "uuid": "8826e82c-228d-47a3-9572-9161d5336529", "value": 138292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782103648, "uuid": "cbb1b1e8-b351-427f-99a9-16622318869b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782103648, "uuid": "2645fe52-4f85-4d03-b1b0-a425e4a70228", "value": "nerv.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d89e75e-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (SiriusRAT)", "timestamp": 1782141291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141291, "uuid": "09cc3fc4-7344-4755-8e34-64e6b3a7c513", "comment": "Malware payload (SiriusRAT)", "value": "ad90591b2248a0b5a44cda8aa839e4f2", "object_relation": "md5", "Tag": [ { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141291, "uuid": "fd22eb8a-d3f2-4cf5-b844-e2cca5abbf38", "comment": "Malware payload (SiriusRAT)", "value": "f284ebb4a8899b3831714ea095a37a95c8d1b63c5987347692ef124b2ed98a33", "object_relation": "sha256", "Tag": [ { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141291, "uuid": "e6996e43-146a-4177-9cc4-4593c3c9d63b", "comment": "Malware payload (SiriusRAT)", "value": "6119440a375b005aa4d0b353317c4e666eb86d60", "object_relation": "sha1", "Tag": [ { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141291, "uuid": "1c81e12c-c45c-4555-a2e5-40b9b4bcc9fb", "comment": "Malware payload (SiriusRAT)", "value": "50bf826e665675064d849cc73cae38563bbc5a780271ca5521febcd0d2596fb71b67da24c21d3d37bd7a54354b99f095", "object_relation": "sha3-384", "Tag": [ { "name": "SiriusRAT", "colour": "#84AC5D", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141291, "uuid": "901c93cc-d0a9-4411-8657-e6114b9779b3", "value": "T1BEA40C38ADEA402B71FBEE598AD478D6E95FB663370E541D109303CA4713942EDC263E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141291, "uuid": "5b15833b-da7e-4489-b103-028848bc1ec8", "value": "12288:SWn6kWIDX74F9DoY8+j4nSpieUiiLyovijeuG/4NEMr:dD0B2NGN5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141291, "uuid": "c5db6b2d-458e-42f5-b072-93a281d8bf0e", "value": 454934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141291, "uuid": "97615ddf-c748-45fb-a80f-42b08132afd9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141291, "uuid": "2346d386-8ecb-44e3-adf5-da61f6d701eb", "value": "EFT Remittance Slip - SWIFT482847284994723.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb258b97-6e44-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782137797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137797, "uuid": "5099ddb8-d904-4391-89b9-656027963fcf", "comment": "Malware payload (Vidar)", "value": "adf6a14557d511c3e960b22c4e645b54", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137797, "uuid": "bbd7146b-86ba-400c-a3f4-b7ad0ae3ce56", "comment": "Malware payload (Vidar)", "value": "f3321076596f3bf0f3cf48b50437c694b726e787d5703915bcb33bac49701551", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137797, "uuid": "aa0541cf-68f7-43cc-8c45-45bff1645f65", "comment": "Malware payload (Vidar)", "value": "75ec993235a9dc4a5aab04f372e1f7a8b2ef66d2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782137797, "uuid": "908c0e54-25dc-48aa-aef9-59abe3c8b24e", "comment": "Malware payload (Vidar)", "value": "250e43e49d69442bcaa0368cdb117946635b10214aa33bf327e8176e4155314ce28a52337bf9d12540a62def3b5432b9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137797, "uuid": "8b1a9ea0-9cd1-4479-a3a8-5826742094f7", "value": "T1DD067C03EFA10C69C456A33189B39782373CBC491B322BDB6E9167792F767D06936718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137797, "uuid": "83da3701-b22b-4763-8569-7c2e54f9f45c", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137797, "uuid": "ce297015-2471-4288-a4a1-b30eaeb65faf", "value": "49152:CZ6CbCS40l74PWVgJYEWATlQ5ZwbbrYRkNrgyNa/pHdtTaPhJmMP:CdUnkAkwbPK1HdFaPGMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782137797, "uuid": "37521916-b32d-4f4a-b4a6-22f5c3f06b8d", "value": 4018096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782137797, "uuid": "ccc6e697-8206-4522-94a8-862a2a94423d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782137797, "uuid": "8a65dae4-95a8-431a-bab0-c63fdef8b041", "value": "mpclient.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1440888-6e4a-11f1-ae13-42010a9c0009", "comment": "Malware payload (ZigClipper)", "timestamp": 1782140331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140331, "uuid": "5f860d8c-5de4-4c27-aa01-1814d8ddb516", "comment": "Malware payload (ZigClipper)", "value": "0f89e6a8ca11c4e734b1bb205e264ae9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140331, "uuid": "2dec3d61-b985-4e7c-b820-b2e65e9a5d2c", "comment": "Malware payload (ZigClipper)", "value": "f3355943d1b279778879cbe6f036bd1b2f86b6e33ef1c4b1f4896a4e540b3593", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140331, "uuid": "06b02a37-06a1-4bab-bfd1-9141b328dac9", "comment": "Malware payload (ZigClipper)", "value": "99188aeaf816b25a1c489e5609394738df16d0bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782140331, "uuid": "55684a64-b7c4-4127-8000-520f4a4db34f", "comment": "Malware payload (ZigClipper)", "value": "a409bbb0a80933aabd26990efc33779f17a2fa394e17eed1e8a070cdb0b03b819b61d3e56d5c74db984c407f15a4d8b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140331, "uuid": "63e9880f-04f8-48aa-926f-e16f77cd0619", "value": "T1EA75DF8F51A820D1E8B97773C42ABB0E9B39BCE925A151DF1B563320F93D5498D1B233", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140331, "uuid": "2a460714-76a7-4071-af01-3a3aa02681e6", "value": "24576:P1hEMWsvokDqy3HxnCZ6hXbJNV2kXkD4fg7h9joLvJ9enOwk6CHvrIiy1RENz4wU:cEUkLUFQwf0gsR1WKc3bovWO+U/uI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782140331, "uuid": "11d491da-b450-44de-aca9-c42d7ac46ef4", "value": 1550104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782140331, "uuid": "130698eb-cb16-43d7-8525-ffd6ee43e01f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782140331, "uuid": "205e9ffc-31d9-4955-9102-85bcb437b87f", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83666efc-6e29-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782126000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782126000, "uuid": "e66950a2-c05c-4cf9-95a0-53650ed97ff8", "comment": "Malware payload (Mirai)", "value": "8957780475e7bc5529085cad584705a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782126000, "uuid": "77269e20-a252-4989-a423-6de4544f9a27", "comment": "Malware payload (Mirai)", "value": "f411919f8ff69ffa0624d73d3380e4cd52a33b8ecf0fc8d29aec74e96eaff6c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782126000, "uuid": "f50b4875-918b-498b-9a9c-b281d89169b9", "comment": "Malware payload (Mirai)", "value": "ead1b29679d709340801a71ca575f369aff8803b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782126000, "uuid": "52ddc7ab-2ccb-48bd-84ce-c414e804833c", "comment": "Malware payload (Mirai)", "value": "5865d7a25b3f6a6eace9ebd35ae212923f79f1b979e5b5727347da54d96195e973631025b823948c6797c956798e2216", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782126000, "uuid": "dbb685f9-1b2b-4705-b2bf-d642e12823ad", "value": "T1FEB33819BC81AF00D5D615BAFE1E534D33535BACE3EE7202FA145B2D37CAA5B0E2A141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782126000, "uuid": "eace8bca-30e6-4023-a2f2-0b186c9dd012", "value": "3072:Oj4wEY2O7WJjCVRVtmDTJazd4dIaJTfsZvRls:OMwL2UWBCV7tmDTJaR4dIamI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782126000, "uuid": "68c6c696-870c-428a-b9d9-e9847441542d", "value": 108628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782126000, "uuid": "12bd19c6-a91d-4d65-9785-061979a42cdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782126000, "uuid": "0fb46fb2-bc52-4379-b7d5-3ab618e537eb", "value": "45u", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598b1376-6e07-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782111327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111327, "uuid": "b6f066c8-05e0-4158-bf83-d62fa8135111", "comment": "Malware payload (RemcosRAT)", "value": "99822d8c0bb5bf455e00acf1c13412fc", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111327, "uuid": "e5911633-4e92-4e72-ad28-65dad97171b5", "comment": "Malware payload (RemcosRAT)", "value": "f466228ff96831257a3ef22ba3bc1f3279467c8c0b207f0c310352903d30780c", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111327, "uuid": "9559785e-f1c8-4a7c-8592-39e558c17f7f", "comment": "Malware payload (RemcosRAT)", "value": "77637c6a25b1c4e52a6d34d9a7d818a6cb96a018", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111327, "uuid": "4b46d9ff-5ab0-438b-b159-6b5e656210b6", "comment": "Malware payload (RemcosRAT)", "value": "87f11c36b15ecf1e2801eb8ca794f2c1980472982e094c642149c0a974222cd35757e0fad3bd807221818dfc8ab39bb0", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111327, "uuid": "7be7984e-81e6-4bf7-a872-971ca0df9515", "value": "T187934A60DE5403A94E4B1BEEFC951A61C9BCCA19413210F5FEE9170D50069ECE7BF6AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111327, "uuid": "6bc93dad-9e94-4d1d-924a-39d1bc81d16f", "value": "1536:d4A7Gx5+qnFOt7whlICdFWfYK8da4FlHzIQiQhcn+7ksJUxP8P6:dL7Gx55OpnCI8da4FlTIBQhu+7RUxPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782111327, "uuid": "92a30648-d663-4676-961f-9a94abc0cf3d", "value": 97123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782111327, "uuid": "70331545-310b-4964-987d-9e7357c4d558", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111327, "uuid": "d4a03041-1b16-4279-a1b8-23a8f1153275", "value": "Diffus149.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a655a0e-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141876, "uuid": "c3b43058-f704-4ac2-9529-909b3ec12d74", "comment": "Malware payload (AgentTesla)", "value": "e45a786f15f6322dc9bff3d2bd4c4d7c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141876, "uuid": "255caaad-7b80-4004-a6fc-c2814138b8a8", "comment": "Malware payload (AgentTesla)", "value": "f5dc559fb2d25f2f4eeefca68be80f8e4772b038907f19ac5864331a37917d05", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141876, "uuid": "c79a1261-4c3e-442c-807c-86c761422fdc", "comment": "Malware payload (AgentTesla)", "value": "5397057076cb7bbc7e1ca4be7b8a56912fe05116", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141876, "uuid": "5b33249a-254e-4b80-aeda-c6fa042ba2d4", "comment": "Malware payload (AgentTesla)", "value": "c1370e05e781d04394a88f4c774f9b776ffcfe7f0708b6f1207f24b5a90e8773d738bc2c81c1591a5108a72f124f9ac8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141876, "uuid": "525f77b1-547f-49b4-a0d1-bd3e68e3ec94", "value": "T1D7F26A07151A863A069C6398D75E08FEEEA0883332205DAFA9DF7D359C47A1731973DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141876, "uuid": "35d8d296-ab3d-49ad-bc4e-b16502ea1b6e", "value": "768:59wlWqBBmEhCyLjF7aI5BGrRG6R/CNbu8xpV9uMlffZGx6F+g/L/MXfU2qbDWKzS:59wcqBQEhCqJaI5grJBC5u8TV9Rfo4oR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141876, "uuid": "60e18a5d-0da5-473b-afa2-e1c42f81fd09", "value": 34449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141876, "uuid": "7fb21cb0-3909-48b7-abd0-fb2897ab6bdf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141876, "uuid": "f4a3cdb7-e544-4fa2-9f2a-7b82296bde15", "value": "Request for Quotation FPG SDN RFQ260619_Pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61744f83-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1782141405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141405, "uuid": "be7d1b3e-2fac-4832-afd7-0b7af1c6f503", "comment": "Malware payload (PureLogsStealer)", "value": "d7897421b3001bfc92be0d127386d38e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141405, "uuid": "8503f4ab-24e1-4b8d-932f-143c2c796a41", "comment": "Malware payload (PureLogsStealer)", "value": "f651c3e4f37438c8b3df4b2a0907512de20e36595f65a921ad9638673e83dd6a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141405, "uuid": "01398929-5ee4-45c0-b40a-94fa072f73c5", "comment": "Malware payload (PureLogsStealer)", "value": "67dc63654392fb138eb69fd9d44a4feb695a0cba", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141405, "uuid": "18392abe-c8fe-4e8e-9d26-6ef3df2ba32b", "comment": "Malware payload (PureLogsStealer)", "value": "f1b31df8cade13152d6f3c7083d0439e0cdea6092eccf5468d4c95c7abe470c0774fafc92566f16655256c186db3be2b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141405, "uuid": "c4a0f06b-c858-4302-af89-3ec1f4bc164f", "value": "T193750836CE4FF1286633BA074351748BF98A9711314F598E20A72799EC37F06AE64D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141405, "uuid": "75d2edaf-ceae-4b62-8eb6-50d0ab0bfa3b", "value": "3072:EyEMK4cFIqjX3wiRTzxDz3kGC74Sng0v2UQgHvEutcFZTnDBDSVkq3LKiM6jsNcW:3kjX3lRTzxDzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141405, "uuid": "f7f0975b-602c-4e21-9ae2-2f554be0d092", "value": 1594162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141405, "uuid": "167fdd88-b172-4439-92cd-165d78f0d1b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141405, "uuid": "a397b09d-7010-47a8-8000-f96666c4507f", "value": "output_o2np0mqz.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "156a9695-6e48-11f1-ae13-42010a9c0009", "comment": "Malware payload (RatonRAT)", "timestamp": 1782139130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139130, "uuid": "9876074c-8024-4c60-aca8-96338864bc83", "comment": "Malware payload (RatonRAT)", "value": "436a48cb924dc5abbf74af84a3e8a51f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139130, "uuid": "06a61995-c542-46fe-a380-d2481e8fbe5c", "comment": "Malware payload (RatonRAT)", "value": "f710fb64a042409d4e095eb62b87815f4dffd26728c8a6471e7cd5b444749660", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139130, "uuid": "4d157d09-8364-48ad-8600-1255298f5907", "comment": "Malware payload (RatonRAT)", "value": "91e24b027f6013891eea6291915d0aa3d7bef1b2", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782139130, "uuid": "e926add7-7a08-4906-861b-0a9dfadd592b", "comment": "Malware payload (RatonRAT)", "value": "6052b2b114dfb205c5704bcbd9d5f498ff8aba1a12f681d691ac748f05d61b6772239d3181857b587d2c74d25493ee97", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139130, "uuid": "cde9b8a4-722e-4ad1-a016-0b8295ae286b", "value": "T1EA0633301F3E1DBA4664C22C62BFAE5D0F940EC684FCA1D69FD5188B639E7404967CB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139130, "uuid": "66248e62-9590-4586-acea-7610c2c4453d", "value": "49152:y85Ap8ZHlLXeuczEQE8Xh1KrvOFbtgnNCa8JP4/:b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782139130, "uuid": "06eee191-2501-4ec1-9b0e-90fdd43458a1", "value": 3969678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782139130, "uuid": "b57bbb35-61b8-4455-b90f-c7bb61315007", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782139130, "uuid": "68c9f63a-2042-4a55-bf4b-82396a7e3edb", "value": "mfrmfral.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b55d3d9-6dda-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782092002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782092002, "uuid": "9d02058e-ec18-4282-ada7-5fda4cb956fa", "comment": "Malware payload (Vidar)", "value": "f724ccfa36870ebfb208d2fcca886fba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782092002, "uuid": "369cf49e-8866-475e-9e50-8034f5026258", "comment": "Malware payload (Vidar)", "value": "f9814cb4822b66a5ad8a479656a2fff57ad90d1294a0c4265ae9ab61ac173b80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782092002, "uuid": "c53c6f16-ee39-43ae-9961-a94178bff542", "comment": "Malware payload (Vidar)", "value": "28461a1b13c0a4287dcb9c8cd76e5aead9335c35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782092002, "uuid": "59c4f432-f233-4748-8e1a-44b4a5f98616", "comment": "Malware payload (Vidar)", "value": "f44feb334e37422746fca0f388a4a730430f237079f4894da978435531c166bf8b614d449d48731e65d07f6490849b81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782092002, "uuid": "e974f596-9796-44ec-b815-37cafaf0e23f", "value": "T1A2F57B06FC9608FAD49AA23289B29656B775BC080F3227E36E9077783F727C45C39715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782092002, "uuid": "6c06fd11-61a3-486d-8ea0-dedf3fe73612", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782092002, "uuid": "9f5760b1-4039-4a96-89c9-151a6e88696b", "value": "49152:uz4QF1aIIZYXdCA7ANEw5R6bfhmu1QxtUoZkpNa7OCss7w:uhwAq2bhd1q+oZkpNa7OCsV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782092002, "uuid": "9e3e2f7b-4d42-4527-82e9-d75a9512b306", "value": 3376472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782092002, "uuid": "381b33ba-66a0-4934-ac61-7ba743d96de9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782092002, "uuid": "567cb3e0-bde8-4549-83a9-27a99a235b4a", "value": "WandEnhancer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69479a0b-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1782141418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141418, "uuid": "b3201a6d-d15a-4103-bd74-a98f98653ec8", "comment": "Malware payload (AgentTesla)", "value": "e7eefed5bb2cfa6443b2e990654c2f82", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141418, "uuid": "356fcada-9d37-439b-876f-af04794d1f55", "comment": "Malware payload (AgentTesla)", "value": "fa74415147a3f022e754f3450a8d25f9ee01d54ed29c9f882c4c321f09a484bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141418, "uuid": "c12feb23-6b93-4359-8428-757c84d0ff1a", "comment": "Malware payload (AgentTesla)", "value": "0d3f76c86c9b6168973ea00ea60fc51357244030", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141418, "uuid": "d0fe5d75-c830-4f38-bcfc-d5afd4c56348", "comment": "Malware payload (AgentTesla)", "value": "a0b0e64d954570b4c301c4d9af8afc4e1dde6bc754a80ae94e223fc674d12ee0ecc92c342960293f2dccb21053b04bcf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141418, "uuid": "f215f48c-5a7a-4606-af8f-ac319d87ae82", "value": "T1E7E52A418628B871AA6ED73CD037AF604A4E20036298EF2D357D5758B7D2F57278D8E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141418, "uuid": "27265be6-a84c-491e-a68b-a64a559582cd", "value": "98304:rmQcFGfM7aWjuGxCvpBuw4rxYVW8XwgEufLKlMSOTIEECELkD:aQa4GgPuXCXwyTfT/Jb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141418, "uuid": "8ed0a485-e40b-4c99-ab0b-fc4ff785a2e0", "value": 3310841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141418, "uuid": "4e06328d-0ddb-4174-9d30-d2484393bc95", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141418, "uuid": "15a63859-4bb2-407e-bc63-76eabefe74f6", "value": "SGC-MSH-CPR-26-170601.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8a52b98-6e79-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782160449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782160449, "uuid": "e4cf0cfe-6eef-4cd5-9130-445740514931", "comment": "Malware payload (Mirai)", "value": "fe73a6e47b9d32a5f2676e48989e05c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782160449, "uuid": "704e6355-d299-4e2b-8ea2-6e5956015699", "comment": "Malware payload (Mirai)", "value": "fb9881cb026b90f6ead249de94fd97488d49e3fff7f50f45c70410483aaa343a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782160449, "uuid": "02488207-46bc-47a9-8ac2-da5411eb54cd", "comment": "Malware payload (Mirai)", "value": "6f42b1bd22caa943843651254572c5cad8aef47f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782160449, "uuid": "7bb15610-1922-4106-8e20-b3d229fa254a", "comment": "Malware payload (Mirai)", "value": "4a6baeddd5b18175fb9ff0ceb12724914fbe50faccf01f5b942ff6d0b7ed8483f77f67ac0f4d6908c82caefcb7e22b88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782160449, "uuid": "802e2dea-2353-42a7-b89c-6b60e0e32610", "value": "T168143A46EB804A17C4D62775AAAF43453333DB74D7E773068928ABB03F8379A4E72605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782160449, "uuid": "d42c8880-7a39-44e2-ad25-f466d8641c48", "value": "6144:38cX8XRBYNxAn1la4gnluDU11K7tMy2uL/K8r:38VwNxA1la4gnluD+u6K/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782160449, "uuid": "d3316773-48c8-4e69-baa8-8ed4aad318ad", "value": 197922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782160449, "uuid": "dec58b7e-c177-46b5-b493-8b239b0ea50c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782160449, "uuid": "5c0e63a0-41d9-45fb-98cc-b75ef2b4bc3e", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8fc082a-6e06-11f1-ae13-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1782111165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111165, "uuid": "ec9c8065-eba5-476a-9b48-4434f5294b42", "comment": "Malware payload (Prometei)", "value": "2d5d3c1f4835217b61ec7632a8a8d752", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111165, "uuid": "548429f6-5b2e-4ff8-93f1-766714a50569", "comment": "Malware payload (Prometei)", "value": "fbce8fb39a943d9dafb800573aed6f63ce7a9246858a1db3a8058f00143f0948", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111165, "uuid": "6117a538-add1-4ddc-b6d6-9322aa0e36c4", "comment": "Malware payload (Prometei)", "value": "3c6ddacec05a4cae4b7f1db7e25f1e436dd62be3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782111165, "uuid": "5637f3bd-1247-40ec-807a-2df4a39544e1", "comment": "Malware payload (Prometei)", "value": "13ee4aba4b31441636a2dcaaccb4fe6d0bd7f5bcca232e34789596c91c9dc46be66ae817a0073360c4a712f73ab023cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111165, "uuid": "402e7006-aa42-4adb-9cf0-149899bd7ad3", "value": "T1AEA423B4F9219E9F6DD769B91B24831DE182C172589D4C2313AE94A34F3D732BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111165, "uuid": "083d2e5b-f1d0-4482-ad43-03213400a394", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdm:Fs6pyCC/Ya2hpi6T6N4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782111165, "uuid": "44a33c04-c1d8-423f-b337-49cd87f24bfb", "value": 449060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782111165, "uuid": "fff29ab9-f3d1-4ec7-a0f8-a55242c5ca1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782111165, "uuid": "097a30ca-2d8b-4149-bbd0-3f42ecf73387", "value": "fbce8fb39a943d9dafb800573aed6f63ce7a9246858a1db3a8058f00143f0948", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a446923-6e4d-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141446, "uuid": "1a588c6c-34c9-4843-ae3e-7341bc78dfe8", "comment": "Malware payload", "value": "79166e89122c508f63d3861e3a017054", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GRC", "colour": "#0EB570", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141446, "uuid": "88ff3ee4-a146-4a39-b69f-f7dc32e74fea", "comment": "Malware payload", "value": "fcc336a6a918a7b2c4790522090c2c951779a43140da03c965f9e5d333efc492", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GRC", "colour": "#0EB570", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141446, "uuid": "1565291c-060a-4bc2-a3e5-b6def47a9e2d", "comment": "Malware payload", "value": "905b97833e88195a373b1b929334345320cf7076", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GRC", "colour": "#0EB570", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141446, "uuid": "5e656091-e9af-4f9a-9dc0-6cc07846828b", "comment": "Malware payload", "value": "b1f469720a5b6ae4f87f035820bbb97a4fa03143ee34d44aa2efa66d814f8bbb7b61a2449c27f6aa8964b8c28c9b287f", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GRC", "colour": "#0EB570", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141446, "uuid": "eb7ce077-ddd1-440c-b29d-7a643fbdd63b", "value": "T1DFE5275303851BBDF69D0EC9C94B215B20F2D46B7D251298EBB36EEBBC3B9845430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141446, "uuid": "51dc9970-dc32-447d-ba1a-1509128c8006", "value": "1536:0SBuYg2wmcRGyS5cRFEQJsRQkLZqg58Hgt3tZ+UOOBNsC/piYidGNzWbgkarvyRw:T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141446, "uuid": "226ce3fa-ca52-4924-a9b1-a1dac95f5133", "value": 3140299, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141446, "uuid": "6378fa7c-0415-4a0b-8688-1fc119f4443f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141446, "uuid": "d5764349-4921-4d81-899e-6b83671b0d4e", "value": "\u0394\u0395\u039b\u03a4\u0399\u039f \u03a0\u0391\u03a1\u0391\u0394\u039f\u03a3\u0397\u03a3hzO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deda3fbd-6de2-11f1-ae13-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1782095659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095659, "uuid": "eb860e4e-f5c5-4e3d-8a66-5c0ade10ef35", "comment": "Malware payload (Mirai)", "value": "6b406c155f39aaaadb6f988b63e30f76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095659, "uuid": "843a21fe-4749-4eb3-988e-884c1eb19e2b", "comment": "Malware payload (Mirai)", "value": "fcc9249b4f188e5a66fca4fd3811585f16438e7dd0542301f1575209010fad90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095659, "uuid": "b0992045-25cb-4dbb-9354-335acf8d80cf", "comment": "Malware payload (Mirai)", "value": "4d12d9960de695d0e8bdb5f79497e8c8f181f367", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782095659, "uuid": "7564c7f8-b9b0-41cd-8de4-3d5a0c598e68", "comment": "Malware payload (Mirai)", "value": "433b32bd1bb251abe16dbc401368dcde35624c308f47b9a5ca14af0358c981c65df831832927f7f791e04f14cd1272f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095659, "uuid": "1f626f4d-ac64-4063-87e7-677b89c743fd", "value": "T1FCC2E1A350F6CA03C8F2837A6E3C5AA662605834A34EED2D77794BC477460D4657ACCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095659, "uuid": "c8da12e0-0ad1-44f7-89a4-5a8717bd4602", "value": "768:w5+Kcrb9VDJee2KTgdTHOBcK5ZCAyukANg:Plrb9veKTg9QB5VjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782095659, "uuid": "1b4635ea-f202-4df2-b4f1-7e55165f5fd5", "value": 27712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782095659, "uuid": "7bc8a245-41f9-4502-837f-7582226ff952", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782095659, "uuid": "7855b026-f995-4536-a961-da3617bd5488", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e69e8459-6e51-11f1-ae13-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1782143346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143346, "uuid": "3a7e6036-2473-4d2f-ad4b-49ef53739f0c", "comment": "Malware payload (ValleyRAT)", "value": "268188701cfd8c256b1fd50aefc904ca", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143346, "uuid": "24f87d04-428a-4dc5-b1f1-45121ef957e4", "comment": "Malware payload (ValleyRAT)", "value": "fdf62cca7e7b7b73486321b0b29260cde2de3b283d87febec10f88c87a31f646", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143346, "uuid": "13fbb962-7b17-4ea0-acf1-bee058385264", "comment": "Malware payload (ValleyRAT)", "value": "32f90dd064f0fe47e783e6dae00e9c2ab2063be7", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782143346, "uuid": "4d3d4ba7-562e-423d-9d5c-f3ea09a23554", "comment": "Malware payload (ValleyRAT)", "value": "c0bcdc118d0b71c57e3941c80f5345c8c007bf297eed8a54b3a481aa64a2f3f4b6c8f894b262926cb261d5c76b801e56", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143346, "uuid": "4a033afa-68fb-4b38-b6b1-12b744eb356d", "value": "T111D633773AF58E8797A66234A26CB543490091C5834CD5A1F3A180E7DB458BC3FAECDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143346, "uuid": "c6ae4bf3-4fcf-4e0a-adaf-68812b269d5c", "value": "393216:VUqSGQxjPEbajDclAZRV0yVG2b22crYVlX:WqSGQxjPxcKVLjX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782143346, "uuid": "8bcca85c-c0b6-4cbb-8913-3381db3871e6", "value": 12870263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782143346, "uuid": "ce070909-1c6a-47c1-8b50-da63eaf69c90", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782143346, "uuid": "9afa0340-369f-4604-87e0-833aa8a29c51", "value": "MCWinMailAll.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8f1a5f6-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782141954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141954, "uuid": "98113f24-d729-4adc-91b9-6159cc890c29", "comment": "Malware payload", "value": "4109dd5f282b484c220403191ac5e938", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141954, "uuid": "53611dc1-c87f-4d32-bb8b-673dc8e219cb", "comment": "Malware payload", "value": "fe4e23207096e3df7749fe87436ba0ffa0be8601b1fbe60b795ad61826a279ac", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141954, "uuid": "b2e9fccf-4f30-4557-b9ec-74275abe63d9", "comment": "Malware payload", "value": "41e173f474f8b503e71beba8963c93f31142199b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141954, "uuid": "c3a72ef0-3d0e-4e84-b5f5-dd8e4419cf3c", "comment": "Malware payload", "value": "4edbbf0c87d322caa5d6b444de8dbc994564bb09fcf9e6eedda0e967a2392d6fc3854353aa13ba26405c78bd4f62f264", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141954, "uuid": "48d5bf6c-dbe2-4adb-b293-a04f107468ab", "value": "T16675EB39F6E4511ED093F79E8CFAA5DBEE18BE55511C580F60930B9B8921E422E4333E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141954, "uuid": "070634b1-6113-4381-850c-84a17a1f21cc", "value": "3072:8M+r2F02no46OdrMuNI8pMvXrR0kksWcts2IV+myI9LDrRna8cmtWZjyXW8NC08W:i99dTC9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141954, "uuid": "764325c0-bf6e-42d9-8916-3491306d0bf0", "value": 1662780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141954, "uuid": "488d1784-a47c-44fd-ac57-255dcba48d1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141954, "uuid": "a99305f8-1b6f-4698-929c-7c3ee9fc2613", "value": "Company Profile & Certifications.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6fd5d7a-6e45-11f1-ae13-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1782138112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138112, "uuid": "4930fcfe-ade2-45cf-b5e0-b655c66be07a", "comment": "Malware payload (Vidar)", "value": "7d8946ca862fe4a2cfe723f8583f4767", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138112, "uuid": "d7e1255f-ed1f-41f2-805b-2d68fdf5873f", "comment": "Malware payload (Vidar)", "value": "ff1860389f41deedf8b72f3cd4cf7b33584c0b329264bb58d1d62d0f6cda777d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138112, "uuid": "eff65528-9673-4d63-a320-c7e0a97ca6cd", "comment": "Malware payload (Vidar)", "value": "36d2ab1dd36957542552164c77dc387308be4b1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782138112, "uuid": "7cbbf321-d650-400d-a44e-535508117bf4", "comment": "Malware payload (Vidar)", "value": "c3abc27b2c2586985c5f719da4103eb28f990980d8bc0d82124ed446802b451feca2e3319c4e6bc8127cb84f68dacce0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138112, "uuid": "534701f5-f3b4-47be-8363-16e4878b7ed6", "value": "T1CDF57C47AD924AF9D06DA3328DB256917B34BC492B3227C72E50B7782E733D06D36B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138112, "uuid": "e2c3337a-1905-49ea-9462-8a7ec43687d3", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138112, "uuid": "350de5a4-67af-41a7-83cd-06ad6ac15dde", "value": "49152:UEkKrfbFkjXJ1KC3AB7QXl9NgWuXoCWD1jA+Zd+d:UCzv7KgWhD1jPKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782138112, "uuid": "ae60c2bb-16bf-4871-af47-00443eaba6ce", "value": 3401576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782138112, "uuid": "7f0c24a7-dbb7-4f1a-845c-5fdab6e6e11c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782138112, "uuid": "9f2623aa-d45b-4170-aea3-682b424a3ec9", "value": "\u041d\u0441\u0430t\u0430lin\u0430\u042564-v.6.981.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b987779-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1782141932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141932, "uuid": "e11344d5-abc9-4d12-9a4e-40fc5bac6795", "comment": "Malware payload (Formbook)", "value": "a86beb63354e21cce49b810f94d18913", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141932, "uuid": "2cee31f1-bb9b-422e-8267-ce6e3b564eef", "comment": "Malware payload (Formbook)", "value": "ff46cc264bc2f18511757b98e909967062b9ab81f86b813c458dd160aad7103c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141932, "uuid": "4e14380f-bf84-47a7-8ab5-bab861cfa3ee", "comment": "Malware payload (Formbook)", "value": "4bd3376eb15a9a9977e95bd779fb0461474937ef", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141932, "uuid": "1c221d42-0f56-460a-9176-e2325aa78d54", "comment": "Malware payload (Formbook)", "value": "acd360de480cc37e763f062b418b5730f1da4c6ac6222a9cac51b62da1eb878239d8059de850135b4ea3d7caf3871e92", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141932, "uuid": "f5db1c33-07ad-4aec-9ec0-20cb5295a912", "value": "T13C95F1005BC42FE48FAE5A1D90BF259DE3A00D8E6459798FE723FD46AFE760451072B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141932, "uuid": "632e2c9e-2bc9-4fca-84ec-2d386f421977", "value": "24576:VXxn+79lLPtsfla21x3P1mb+6lwingurr7agkzyQLJhLfRPznEiJXh8:Omx3orTPFkzz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141932, "uuid": "5f189567-85f4-4a99-a23b-5de5bab9adf7", "value": 1996152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141932, "uuid": "ae64702b-946d-452c-bfe5-ae27e872d2bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141932, "uuid": "17887cc8-075d-4b88-b1e3-1cd2cb980a4c", "value": "S.O.A_ 21-06-26.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c80e43-6e4e-11f1-ae13-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1782141820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141820, "uuid": "9f4894a9-08d8-4fbd-93a1-fe085c004600", "comment": "Malware payload (RemcosRAT)", "value": "74d5aa2fbc1b3d3cac85d9bc6c550965", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141820, "uuid": "417c413b-af92-4822-b62e-f282e158bfa9", "comment": "Malware payload (RemcosRAT)", "value": "ff5004351d3890580a7d0c612fa9eb693703be4fb93b1d1b36c6ad4ca8a3d6fc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141820, "uuid": "4bf1628d-c353-45f7-a0aa-18a2a2bfff22", "comment": "Malware payload (RemcosRAT)", "value": "6f8a3bac32cd2d8ca0be0e411b6e8ed282884934", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782141820, "uuid": "188ac020-18f9-48a1-a8a7-112f0d35c638", "comment": "Malware payload (RemcosRAT)", "value": "7c58c04a3e91a7ea3959b17abae0d85991ef3ca3baae505a6c92dd2b0213af19c46df935346d1b8a7fa8b8a2170e56ef", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141820, "uuid": "84b3a3c7-64c0-4e75-a438-c56f4838d9a8", "value": "T16F8570088FE88528B7EB7F2917AE2652946EB66507DB4A5500780DDC037783C6C73F6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141820, "uuid": "6eb55bb7-5882-44ec-a9d7-972d8621bca7", "value": "12288:Sc+6+NguARfPEjkKo5tYKrjOQFQP9kwCWe1gths3pJbE3i8reRcmPnm:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782141820, "uuid": "deaed0fc-c97b-432a-9548-467646e735c9", "value": 1821978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782141820, "uuid": "ce3c5c72-e7d7-4989-999b-06bd7ac406fd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782141820, "uuid": "98b79dd1-f23c-4934-953a-e933a482220f", "value": "PO260600520.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b22764e2-6e10-11f1-ae13-42010a9c0009", "comment": "Malware payload", "timestamp": 1782115341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115341, "uuid": "a18e39f7-62f8-4489-bc70-e92ddd79096b", "comment": "Malware payload", "value": "e438047afd2be8f7311ed6c939b99e25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115341, "uuid": "d320ddae-8a3e-44dc-8cb0-c64731d4c75e", "comment": "Malware payload", "value": "ff554e8b429c238cbf03a9ac337c9487f90c609a8128a55f7640782c29db315f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115341, "uuid": "196ba24e-660f-4f2e-9046-65235914b0ca", "comment": "Malware payload", "value": "4e00343833a4e5abe9376ba52bb9b1f0e403b371", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1782115341, "uuid": "b3af1330-446d-4be0-ad95-22edce7d6ca5", "comment": "Malware payload", "value": "ad4a13cea892e9f732ecf2b9b90283f2bc95d993d40a1f0142eccfb01130b6fb56723276b407d46e02122ce337653028", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115341, "uuid": "109807b5-9964-48b2-a65a-de5e57d21791", "value": "T162E733E59BC874D6E20DCB378535D518AC72B80E0B4748EF27D809563E6F2E93A7DA10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115341, "uuid": "ea1bdd9f-6c68-4472-a114-f51ebe1c201c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115341, "uuid": "b14f3908-ebff-4d37-a748-2dad13218094", "value": "1572864:IgQWPVr6LrtO5SrjtAsIgqTcaNH21A/gE1oeOahi81ePNW:jdPJKrtOsHtAsg7lxrmeVlQFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1782115341, "uuid": "605b70bd-88fd-47e8-8c95-dc726abd573d", "value": 69290734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1782115341, "uuid": "0d2b81ae-deb6-4154-abd1-d725418f1ca8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1782115341, "uuid": "9bb5cc5f-f72d-4aba-b980-918a6f40d5d6", "value": "e438047afd2be8f7311ed6c939b99e25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }