{ "Event": { "published": true, "date": "2026-07-06", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-07-06", "timestamp": 1783382582, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d9819e49-2da7-45bf-8c2f-f2a6cd503580", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4117f159-7920-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783331486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331486, "uuid": "7f6d0518-7f33-409b-a5ed-9c971948d752", "comment": "Malware payload (ConnectWise)", "value": "33ec8c450eae651af640be407dbd321f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331486, "uuid": "68440f08-23f1-48ee-9791-fd53bc4f898d", "comment": "Malware payload (ConnectWise)", "value": "01dd052c3778b4a893a13ebd3281b96c7bf96707e9d5b5fc89077e273b5464b4", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331486, "uuid": "f38566f9-2775-4072-8dee-6979f4b5dd92", "comment": "Malware payload (ConnectWise)", "value": "0c9a0fd623ecd0337f0f46b6d63c32eb4b36da3e", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331486, "uuid": "aa14a1f7-c77d-48e1-8f9f-86b31f172c41", "comment": "Malware payload (ConnectWise)", "value": "9ec40f16e38bceead56b88760c223e8fcbbb2c9ea17d76e1ce2fc31402c778a2d81ee4b481c938bc61badca494cbb38a", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331486, "uuid": "7266f326-42c5-46e8-9177-40b4074f2b31", "value": "T1BB039D74FC49BCA1437BDBB6E528AE99D33323E3458666583A6E538BDF31625CD0D800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331486, "uuid": "b228b99c-640a-4196-8d91-12f223fc366d", "value": "384:uAmDfYHgvXd9gNsNbvlmMw0wZpcCrtRccR0UuiWNy1wyJeqBtB8TD8yADr0c3bEd:uY4XysNrlw0scCrvWUuHNYm0yu2iEM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783331486, "uuid": "52bcea51-d7bc-4715-89a6-162ed841fbf7", "value": 39549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783331486, "uuid": "bc0e5c2b-fae6-4140-8361-81d7fbcebe54", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331486, "uuid": "59b5a503-6832-4a8c-b13d-ff72341864d0", "value": "zoomm.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f061a3-794b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1783350174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783350174, "uuid": "5ff836b0-d3b5-41b9-8891-acc00cd1264f", "comment": "Malware payload (SilentNet)", "value": "3b7fdd96d87c6c77e2498fd2c430ef22", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783350174, "uuid": "e6cfe6c1-33e5-429f-993f-ce6b61f47734", "comment": "Malware payload (SilentNet)", "value": "02a8aa2f1042c8520ee731d032b78cbbfd034b63b8c1be18cfbc405cccb50835", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783350174, "uuid": "f8711254-fbbb-4c3d-a1e7-01bdf965b8d7", "comment": "Malware payload (SilentNet)", "value": "0a08367c220b30fd43120e460a8b016643248930", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783350174, "uuid": "5a40864d-cb50-4f7b-a9c1-b75b7f1f413b", "comment": "Malware payload (SilentNet)", "value": "caa920d6125a346bf6a76bfbd7cde104c85f2a1db8747371ce628efa6f6e7ddfaf8983bf51ded12e61977f15a54521db", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783350174, "uuid": "ba09ef48-2a51-46ff-b8ea-b7f20693bca7", "value": "T150A6332A5F579DBDD2063EB12222745D536A57878D0283FF38A709DFEC01AA31794CA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783350174, "uuid": "ef40c05f-4343-4168-b4a6-12a39fe01feb", "value": "196608:qCfFfpX7k+Q3ss2NhVK6LkODfT1cVnohW8BF9pNT27CScDyGHUF4:qsBX7k+Vs2poODfJcVcW8EuF5HUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783350174, "uuid": "a640e3eb-757d-454e-b5f4-1d6bd92bd58c", "value": 10145551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783350174, "uuid": "319c0c4f-6fd7-4cbd-8ed1-d7d0dc84387e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783350174, "uuid": "46bc0112-c9f2-4901-ab62-b4d7cef9b317", "value": "HugoCrystalOptimizer-1.0.0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2aaeef-7920-11f1-ac1e-42010a9c0009", "comment": "Malware payload (QuasarRAT)", "timestamp": 1783331717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331717, "uuid": "48bd8c3f-62f6-4eca-a50d-c1a8b370c053", "comment": "Malware payload (QuasarRAT)", "value": "b523b356c05115230a8ca18e37891999", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331717, "uuid": "d07e7294-4fd5-4174-ba57-f931857882ff", "comment": "Malware payload (QuasarRAT)", "value": "04e4559705398c368e63f11d5cf623017587725640f2c1049e16f0b8c69490d5", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331717, "uuid": "78c67627-77c5-48a7-8d51-0ecf16ee978a", "comment": "Malware payload (QuasarRAT)", "value": "6a162b0ea15ed986c6837850ee21e2174d8f7324", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331717, "uuid": "22b00b37-db22-429a-a80e-53a3e5816f21", "comment": "Malware payload (QuasarRAT)", "value": "0290d421038994f7e178f0680dec660ed7a7c53b8b05e7107cf7d69a8ecb6a7b80612851331185af35cc7f1d45648f2c", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331717, "uuid": "66ccce14-17b6-40f9-ad9b-6c9f9d643d2f", "value": "T1815533E9BDB939994E708165506B1E5F2EB15B47C880DAC363E0BCD72BB7F2504C9C28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331717, "uuid": "afe52cf4-50de-4df9-9b48-664e086dbe6a", "value": "24576:IeS00XN70J9KT8xSKiX/g6K+Z06xvDoWEQgrs4VFWaJEk9ISw6RD:IhiQgAPEWIRD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783331717, "uuid": "03a9611a-5c59-4e5a-99fd-e365996b1519", "value": 1397893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783331717, "uuid": "45780b0c-057a-40d0-ac61-ca306bf7a0d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331717, "uuid": "e491b64b-99c3-4e67-bf51-4cd146b58f18", "value": "NEW_output.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3da92d94-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783364981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364981, "uuid": "9be16cf9-9dcc-4ea1-8399-bf466c2e12c0", "comment": "Malware payload (Mirai)", "value": "6bad36f22218937ef83ef428d020dff8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364981, "uuid": "e35bc221-9723-407d-8964-ebcc700dd206", "comment": "Malware payload (Mirai)", "value": "051b8ecbadfebcc4b5d799e95850be6453a59c0aeb9b5749a2d6496df750e8f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364981, "uuid": "d271e648-6a8f-45ae-b585-64ed9c224891", "comment": "Malware payload (Mirai)", "value": "001fcaeabbb9321e5c2a00c210f87be49e0447a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364981, "uuid": "5eb36334-a25e-4879-be36-1a0bc46bc69e", "comment": "Malware payload (Mirai)", "value": "736be63ffc63fc3f01e7087a8701eb8e4f047f9e5b881aa4f6f62cd5fe582cba9f4df2da377473d3125030083f6431e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364981, "uuid": "ebccb2ea-80be-4f37-bf9c-03439a28e609", "value": "T1C1F31A5CF550872BC6D0267AF69B128C33725B64FFDE3705E9146B383BD2B299D2A201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364981, "uuid": "900d2975-1c0d-4ca6-91ef-1b88bd49ef9b", "value": "3072:k9kOu/XUAUm8okWStdAtZuflbWDshGNWM7hkqPYjQNrki:k9Vu8b1okWSTAtrDshMWlGY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364981, "uuid": "d157dee5-506b-4702-b842-6bce70d5597c", "value": 165372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364981, "uuid": "5282d05e-13ad-459d-b79e-615217ab51ec", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364981, "uuid": "18da0971-77ba-4a0f-a398-09872d58206a", "value": "armv5l.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3afb1bee-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783364976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364976, "uuid": "10851cd1-6080-4b4a-9019-bda00501bd35", "comment": "Malware payload (Mirai)", "value": "fce69c75cc1b05f4f77c2a2fa1c6db4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364976, "uuid": "86be4e46-63d2-4538-843f-5ca418787306", "comment": "Malware payload (Mirai)", "value": "06faf46de9d8f10ed2105832aae85584ef20dfe3aa24e572608044b61347ac44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364976, "uuid": "11eb08fa-3b48-4740-b9a1-a4966326d682", "comment": "Malware payload (Mirai)", "value": "fdd347448b7e7337d7af563f824f1b573f20cba7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364976, "uuid": "85750075-c300-4f43-a1dc-07e03b4c9216", "comment": "Malware payload (Mirai)", "value": "dfa65aa983815a6a238db60912092001ce1cf3689ff2fd541ed2ab0654de44bc1df3f24c7cd400b3706c65454dee6322", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364976, "uuid": "03767121-5757-4459-b724-ee2e36f8f1bd", "value": "T11923F121B343ADA3CB28BC7D9F51CA42791553A1DAF4755100F869497EE2500CBAF78F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364976, "uuid": "c86409c7-8c97-4b57-ae73-afde766da3de", "value": "768:H22vyz90222y7vrLJRwN6Dr2Op7c9i3489q3UELIK2rqYcbYBbc6iTO:WBz9022HrLos2Opv34FLVb8bc5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364976, "uuid": "fb5f6819-a2d1-4830-8ea2-b53716470162", "value": 46272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364976, "uuid": "c0a756e4-f2a5-478c-abdd-83fcd2042b7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364976, "uuid": "a51e3919-f1e9-4de0-85a3-8e67f5ade863", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2f265e4-7941-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783345931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783345931, "uuid": "20346fc4-c409-467d-9dc6-2b482b1b68be", "comment": "Malware payload (Efimer)", "value": "5f2ac7d5c9ce70cd7bc296d71ec7d9ed", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783345931, "uuid": "42105de1-282a-4685-a59d-057ff6de2494", "comment": "Malware payload (Efimer)", "value": "076f038960f32eb4390f9151fc34d781547a11fb1aa454187b7dd9bef20f35a0", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783345931, "uuid": "4edce041-2da8-448c-bba2-a5de6fc1505c", "comment": "Malware payload (Efimer)", "value": "eb1bdb2ced82c712393848fcc4efacbdd9ab51ed", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783345931, "uuid": "c0f5fdcb-cfce-4301-ab58-dcd71e045e9e", "comment": "Malware payload (Efimer)", "value": "52c345dead3af64b45bcc5f33fbb2bb113bab6d5e644e656b2d33387ba3d4e4609355ad86e0839fd0666a3f46e7f8893", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783345931, "uuid": "d34b98eb-0c98-41f2-91e2-24d510b8d92d", "value": "T1B1E6330C7AD002EAE5B3483DF9F38652E8B474A70771CA8F4758E3A66E172E14939753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783345931, "uuid": "712cc5bf-8ac3-4a18-bddf-23082fed83ce", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783345931, "uuid": "21aa6f53-581a-4026-83b9-e183f637f65d", "value": "393216:SPhmJVVkAzfZPS3xBJFkXMCHWUjXccuI3/PGTAI:SPA9fksXMb8XJH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783345931, "uuid": "95a4cc86-494d-4000-b0f0-b7d85dcb2a90", "value": 14319003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783345931, "uuid": "11e3228d-520c-484c-85de-e6df33f6f123", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783345931, "uuid": "95e17ee1-fffd-4b2e-b5dd-8083fea2b6cd", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f72ab9-78f4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RatonRAT)", "timestamp": 1783312509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783312509, "uuid": "ab583852-c8ca-4e57-87f8-4cf709018e55", "comment": "Malware payload (RatonRAT)", "value": "1554a7ac5ef7db3e00bd589a0e6b58a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783312509, "uuid": "46d0e6eb-3f25-4d49-b3ab-b6e338d233f2", "comment": "Malware payload (RatonRAT)", "value": "0873c1604c1850994e43eea66804efca3fbddc30e1073563206c160ceb18bd31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783312509, "uuid": "fb951281-7607-4689-8ffd-675d390069f3", "comment": "Malware payload (RatonRAT)", "value": "e09f010fffcddb5ccb1db2a17c347a6dda2f4f56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783312509, "uuid": "736b7bd1-ea60-4d4f-a500-df84582e7d26", "comment": "Malware payload (RatonRAT)", "value": "c6c818c3996a4b7ea00f58b259eb2ceab3694c816fbd2d19df7108b73073c884a41075695aec6479768ea11611769e6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783312509, "uuid": "3bfdb429-f080-4d7a-9f01-f0ca60f53b2b", "value": "T1A0B63354B2BA0AA8E6F6817EC1B78196F133B85B6721D7CF63A005422F277F19439F41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783312509, "uuid": "f759db59-cbdc-4477-bf67-9591d7131fe2", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783312509, "uuid": "e9de6e0a-cc5d-4047-b129-f9c9d9dcde54", "value": "196608:K3EKNO+jFhDpDhM5/tA1HeT39IigbauDXURuAdqDE3:K0IVvLS/m1+TtIihuARuAdqDE3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783312509, "uuid": "2e389fe2-556a-4ccf-8229-cda676e2fa40", "value": 10822914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783312509, "uuid": "21988b9e-7561-48da-af1c-a81a11dd2022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783312509, "uuid": "62bf706a-c1fc-414b-b16f-42e639257dee", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64340d5-7952-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783353130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783353130, "uuid": "73a49733-592e-45b9-96b3-1e787a615182", "comment": "Malware payload (Efimer)", "value": "8ef53e9ef1ab2f6cc70f30775cf35b55", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783353130, "uuid": "d9ecebce-a81f-4095-a08e-00149e3c6b3e", "comment": "Malware payload (Efimer)", "value": "0876b567e8c76c5e1b99d44ab12e11942eb8f9c7a08daaeead6ffa280c22172b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783353130, "uuid": "c7462941-14ca-4519-93e0-1cfb9eb4bc04", "comment": "Malware payload (Efimer)", "value": "28758bba837722e8f31a9858ea8ddd3c26462295", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783353130, "uuid": "13fffc05-8d61-4645-a9e4-e9372d1af786", "comment": "Malware payload (Efimer)", "value": "19b5b1db81adea89cb2485aa3a5acce621616123af22f6d32091ab1e4a58aa8cda25b1f8eb509c08fa168175b8cdbbb3", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783353130, "uuid": "c4a84b23-453d-4172-8080-10b163b0956a", "value": "T184E633489ED001FEE7A3427DFEA16485E4B674794B32CACB1794DA927E772D18C3C122", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783353130, "uuid": "f38a99b0-f941-428f-b06f-92e215098e43", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783353130, "uuid": "e15de760-d294-49f6-afcf-be95cab65ac4", "value": "393216:Mc/FAFH4v9saYZUOLfKbXMCHWUjXWcuI3/PGTAI:Mc/mH4FqZUiYXMb8XrH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783353130, "uuid": "026aac8b-ee38-47d5-9244-1741f84ff542", "value": 14302762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783353130, "uuid": "64fe6d0d-4587-4969-b648-6731232b2cba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783353130, "uuid": "11ec7ef8-42b8-4eb2-8a12-ad3dc5184154", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3897a7-792b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783336226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783336226, "uuid": "a45c4db0-044e-4196-b5e2-5714f3c329ac", "comment": "Malware payload (Mirai)", "value": "a9b0efb47384c7b6b43f17e2ab050cad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783336226, "uuid": "00cd29f9-5c2a-4871-bd13-0a0f7b5712d0", "comment": "Malware payload (Mirai)", "value": "0c123df68ed2376c44fe40d2657dc49a559217b39b99f1ade3b5d0de5842fa11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783336226, "uuid": "f7586c92-8650-4a07-82af-f443665ed452", "comment": "Malware payload (Mirai)", "value": "5c50443012cb730b134cec6478830dffb719e329", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783336226, "uuid": "e93ca306-ffb9-42e6-a5fb-b0b6a66eca70", "comment": "Malware payload (Mirai)", "value": "af22225ba3685a66516a8ce1b496b7110bb1e7bd57a4a165bb0f9ea9df8b58b1d9c4a20b2945ece802506f10771ab890", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783336226, "uuid": "3d082b49-0c90-4b2b-bbc6-fbe52c64de6f", "value": "T171256D5AF2B370FCD027D030439BDB62A83AF47501216E7B65C4DA352D66EA01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783336226, "uuid": "d175d8ea-9f5a-4d76-b987-645bc93fccf6", "value": "12288:mZ+iQJzYALzjf51mXryImU5vEXEWWmy9x4++L975k:mZ+iQJvzjfbMrHmScXlN+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783336226, "uuid": "32557879-adaa-4a3b-beb0-3c227063918f", "value": 1033120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783336226, "uuid": "c74f3bac-66db-48b0-9b43-a5af278a24b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783336226, "uuid": "2b44e4bf-40e2-4378-b370-55803d8505f5", "value": "0c123df68ed2376c44fe40d2657dc49a559217b39b99f1ade3b5d0de5842fa11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3b3962-7929-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783335662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335662, "uuid": "44dcb6e7-7ff7-4001-bd21-11209e585626", "comment": "Malware payload (Mirai)", "value": "99857ce496094acd1fbcda7e4743e033", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335662, "uuid": "e79eee5b-f1a6-4c18-880d-b938386d0d31", "comment": "Malware payload (Mirai)", "value": "0d64cd75599dea5b8cf393b6e2b709f51b3971e64b96920e0707020e22ee7953", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335662, "uuid": "9c26982a-5be4-4868-bf16-9b7380fbb2f5", "comment": "Malware payload (Mirai)", "value": "01ddcc124d0bac1aa7e68d0ec3653c5615bac202", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335662, "uuid": "aa595d7c-9fd4-4997-9b92-48e47cd535ad", "comment": "Malware payload (Mirai)", "value": "6bcff2244f7a9cd0517e2030cd87c74d81e697a81f213cba59aaa49e250edfa4e3b2203ed26c9abfbc3cf66988cbe15f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335662, "uuid": "76ab0864-9113-4970-a330-13032892fe3d", "value": "T1D6F33B06B30D0947E2672EF43B3B27D1D3DF9A9121F4E744251FAA8A9172D32158ADCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335662, "uuid": "8bee855b-4893-4be2-af6d-b58ec8522f51", "value": "3072:0v9PHxAwpHQxWFrctE3u6LVFq3tpvx6VzW:01PHJQxArcmu6LV03XwVzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783335662, "uuid": "01909497-98b0-4e85-9056-fa0f82d0d742", "value": 158956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783335662, "uuid": "dddce321-ee82-44c1-90f6-9d16cba3d861", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335662, "uuid": "c4e893ee-07f3-4849-bb1f-5c0d8f70cef0", "value": "iran.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b292b3cf-7937-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783341555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783341555, "uuid": "3fa68910-c9dc-45d5-a9dd-25db01cfb2ff", "comment": "Malware payload", "value": "918a17a38a3937a1bf279fcbc6bdacd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783341555, "uuid": "eabd98ef-22b2-4adf-9ecf-cb5ea37c8eb2", "comment": "Malware payload", "value": "0f02f4e28347fb1ac2bce2e02fcd9323ebd17bb0be6b3e37e4af219eb55a8f08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783341555, "uuid": "0c6227dd-9ae6-427d-953f-cc3318dcd5c3", "comment": "Malware payload", "value": "d472e9b22b7001ce5bb9bd15dbf705ac3f2ea535", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783341555, "uuid": "6cc7f5b6-ab2e-4c2d-9dd9-539ca9b3dc4b", "comment": "Malware payload", "value": "02617fb12669f98ab60a7f9e1fdd7c10aa678239f39b6621d5cce9408f70b6722117dd97d2878d1fd2702aaa9ec89dc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783341555, "uuid": "37f7d145-b1c9-4416-8dd9-fc2108531e04", "value": "T10816011189C46FB5CFAC6A2C50BD161EE3F04A8E50167989FB33BD4AFFA7604521B1C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783341555, "uuid": "40d6a5d0-b011-45b4-b623-f28d2b84fae7", "value": "49152:vbCSTLqbp1zY5xG0OmkrIH9k7BNhehJpH/dmc3KyQ11IuWxE50Zs8:N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783341555, "uuid": "50fb1be9-89e7-455e-a9e1-961b85adc1f2", "value": 4294357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783341555, "uuid": "4ca8bda6-216d-4288-97c0-f0ec1c64cd0e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783341555, "uuid": "1e8a6599-33c2-43ed-a11f-8220019016c7", "value": "Shipping Documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e98e47-7974-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783367736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367736, "uuid": "fb02a0e3-fe12-4f01-9c08-8e8e53feda25", "comment": "Malware payload", "value": "dd543142955d6c68e6af2acaa0f92b51", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367736, "uuid": "1db51da2-bd0a-42a4-9d5f-b9153ed99c66", "comment": "Malware payload", "value": "0f9e9e3f242dce4f85b98819a8b9db4d28634e5147a832e3f4c24218eb1c8489", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367736, "uuid": "477cfeb4-327a-499d-a497-4f143cae0794", "comment": "Malware payload", "value": "300f6d824ac368cbd0db059ea048820989dc9715", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367736, "uuid": "0801602f-1b88-4e7b-bcda-481756ef22c8", "comment": "Malware payload", "value": "ed3a884ffcdc39ff2bfdf21cef431e01bcc996940c1b498277ce9bb0912531d5803e7df9e8d53e3ae223a85874b27a16", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783367736, "uuid": "19e94ea4-ff93-4062-8c18-62db71cb7bf1", "value": "T198410B8043A18992E18F8E79F518D8D9E32CAF113D5EF57A3C1664C1A4C2CFB650156F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783367736, "uuid": "37964753-07a6-46e8-9fba-f0aa4c73e036", "value": "48:9N7vq8gkkUlBii59TDPgb1POwu/UPVlhziVJR+5aFP7Tr05alXxFt:LbNgkXBB/POLUZrAab3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783367736, "uuid": "2185fff5-893b-4ebc-a0da-3a07bb192f0f", "value": 2231, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783367736, "uuid": "e3798a99-8807-4d67-ad55-0c3ff22d9230", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783367736, "uuid": "b2970e64-8825-43ba-bb4d-9c44f0a9c380", "value": "Pivlex_CRM_API_Documentation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea1727af-7958-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783355821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783355821, "uuid": "2f27aebb-8a40-4115-81f0-10f85bd3962c", "comment": "Malware payload", "value": "0bae1dae03d2186697a557bf58924d49", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783355821, "uuid": "27b928fb-cfc3-4bd5-982d-08dcda73b0d8", "comment": "Malware payload", "value": "0fe1ba3145b5b940133971909a3d5dd505b9cd2b69d4b62d021e5350071d12e9", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783355821, "uuid": "53114647-9535-40a4-933c-fe63fa0cf74b", "comment": "Malware payload", "value": "aca2531fdaccda16709d41a7c8ca10e14aa3787f", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783355821, "uuid": "53f94d2e-b21b-46de-a836-6114586d3336", "comment": "Malware payload", "value": "6b16ad530a4c262384c792d33a69b4e9b90c4ad961ee6dbee3d08be5528e9b177f1d8f8f6bca7cf412d108c4346225ba", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783355821, "uuid": "41828f47-7d1e-4602-8346-0c2aebadc9e6", "value": "T1E9F7330F085DC487C57F57F6795234BAD244C9272DF4E42E2F0A47A8B6E9E6200BD92B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783355821, "uuid": "e951f461-1f6f-414a-819f-7aac6d1eddf3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783355821, "uuid": "6a0bf899-76df-4e7d-9c8a-fd16e9e3e343", "value": "1572864:2t9IKPmoRWYjJImKljUoEkB9dNDsMLXgiMZrIuEtSqsZSQ7:2UKOoRWwImKljUvOhLXMxIuLAQ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783355821, "uuid": "acd13746-e421-4559-9580-d9982ffa3f96", "value": 74407802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783355821, "uuid": "5151bf65-7544-4812-b7ac-57e380ce0abd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783355821, "uuid": "29094539-0c12-4e2f-b43a-671adea8ad8a", "value": "ecore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974d9970-791c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783329912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783329912, "uuid": "03ccccfd-9010-4bb8-a13f-b51309711ec2", "comment": "Malware payload (Mirai)", "value": "a82d418049ea4eb2c1747b20d4da655e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783329912, "uuid": "b4d2d6bd-9a4f-4cca-92b5-d48652260499", "comment": "Malware payload (Mirai)", "value": "10be36fa7a85e6d50c3cd21e8f7c8066b52706ea3bd63f18530a16fa3bbc7ab0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783329912, "uuid": "cc02b343-d82d-4136-b152-4c24aacd2028", "comment": "Malware payload (Mirai)", "value": "05c6970f16f57bda133fc08e28ee896bc9c569ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783329912, "uuid": "df32258c-fed7-4580-8db3-f9541fe2051e", "comment": "Malware payload (Mirai)", "value": "f37917d3b0feca374f000f336481e1f3fb477338c57bd8baae604e6d4d02822ead56c27b245a464271e1c2b325965b4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783329912, "uuid": "475cba85-4c93-4a34-a5f0-372cd503e22d", "value": "T196256D5AF2B370FCD027D030439BDB62A83AF47501216E7B65C4DA352D66EA01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783329912, "uuid": "95598d87-50b3-4982-862a-63c1383c5ec1", "value": "12288:1Z+iQJzYALzjf51mXryImU5vEXEWWmy9x4++L975k:1Z+iQJvzjfbMrHmScXlN+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783329912, "uuid": "2c3b8602-9e60-4fe5-b2c4-9a135fbd5620", "value": 1033120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783329912, "uuid": "93b9cb47-67e5-465d-93fd-80d0a16891db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783329912, "uuid": "6e3f844f-4261-42c8-8904-4f37c3a54f68", "value": "10be36fa7a85e6d50c3cd21e8f7c8066b52706ea3bd63f18530a16fa3bbc7ab0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec70339-791f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AdaptixC2)", "timestamp": 1783331348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331348, "uuid": "dd0f84a0-ea0c-492a-bb1f-ef517c407d16", "comment": "Malware payload (AdaptixC2)", "value": "67135468d9b43e9a87f9d2f33ef9e361", "object_relation": "md5", "Tag": [ { "name": "192-142-51-51--18080", "colour": "#2484F7", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331348, "uuid": "98811add-0ffb-4d0e-b75e-b8c0410c9bf8", "comment": "Malware payload (AdaptixC2)", "value": "11265b15cf310d8b0582883d1d0417891f8456f7ab620690fa0ddfd512ff494a", "object_relation": "sha256", "Tag": [ { "name": "192-142-51-51--18080", "colour": "#2484F7", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331348, "uuid": "c3beddf1-3119-486a-9eb9-2c151970d0c8", "comment": "Malware payload (AdaptixC2)", "value": "2904768aeb8bec47852fe5b064e602dbb8bd90ac", "object_relation": "sha1", "Tag": [ { "name": "192-142-51-51--18080", "colour": "#2484F7", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331348, "uuid": "75da39d8-4e15-489e-afd6-2c0bd7af4d70", "comment": "Malware payload (AdaptixC2)", "value": "26f00f2bfb2a81857f87e5d9e854f812963b2b23186087893bdedb1a5e835c55acae2e927b608d8120736bb63242f5ae", "object_relation": "sha3-384", "Tag": [ { "name": "192-142-51-51--18080", "colour": "#2484F7", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331348, "uuid": "2c745dac-5629-46f3-985e-794f34d10582", "value": "T162564B03ECA555E9C0ADE23489729253BA717C586B3523D33B60F7282FB7BD06A79740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331348, "uuid": "6bf0fa97-4042-466e-bf3e-5d313726228e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331348, "uuid": "e4234c04-e8d6-4cd6-82e9-8205b4bfe62f", "value": "49152:7B45kJ2qL+BGVVS6SOQpDXcuOAHp8XsovYY1jIiTajTkSdah8jFZW58L4rnwKLKL:7BYA0TcbcogYG1kwrYT5eaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783331348, "uuid": "aa15085b-6d52-4dac-ae8e-8d136262fa85", "value": 6265856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783331348, "uuid": "f4edb0fc-4e95-4efd-85fa-c4a2f9a06cd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331348, "uuid": "db8f7ab5-00bd-411c-9b79-a36de72a7cf6", "value": "beacon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8a40b1-7921-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1783332092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783332092, "uuid": "b14da20b-3a8a-4ad1-acc7-23b09aa779d2", "comment": "Malware payload (CoinMiner)", "value": "6cb178572fe453a83472a18a6b112a33", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783332092, "uuid": "4845b28b-49ad-47d2-a30e-514fe8f49208", "comment": "Malware payload (CoinMiner)", "value": "128f48d4dda439d084c90f283d3bd9293a8d22bd86b9b5e2c57afaf5e487243b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783332092, "uuid": "b85b75a8-5ffd-4612-9bce-3dba25935973", "comment": "Malware payload (CoinMiner)", "value": "00c223afd934049bbd23b9743b57bf4fff852f77", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783332092, "uuid": "036d4078-2ac0-4ebe-b74d-019c9ccea3a4", "comment": "Malware payload (CoinMiner)", "value": "9e3b8a49c1ba0ad888c0695162e5d8e725e36912bd8f0c7509375a485270e7fc673f64b83a32b973922c7fb3143f4aba", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783332092, "uuid": "2b8d6ff7-3c8a-4db6-87c3-9928032262d9", "value": "T18A22911E2D4B4321EE5108B0F675464A543D1EE37786FBDBE632D1CB0AD6E4884C1AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783332092, "uuid": "64e08555-6df4-4c48-8f27-d6edbcf05cc0", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783332092, "uuid": "e8764526-a060-43ca-9be4-b69a6c8917b9", "value": "192:WuotWS5BHVxSHO8y5fWsUPFJxTEZmFhqe3:WuoPVsuXxFUPFwZu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783332092, "uuid": "0166cffd-33be-4c5f-92e8-adac097d5064", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783332092, "uuid": "0ac5e8ee-76ca-4391-adc4-cd8cfe3d7e6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783332092, "uuid": "0856cbbc-bc73-4130-bb86-ef8211e50d90", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1584d391-791d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783330124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330124, "uuid": "08979fb1-63fc-4a27-a9cf-17bb3f4ca985", "comment": "Malware payload (Mirai)", "value": "54f8b4b7aac317a3172cbfbeb9305329", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330124, "uuid": "0431af20-2e22-40f2-ab5a-2d108281a598", "comment": "Malware payload (Mirai)", "value": "1292e35315fbdbf3ee2ebe3052b6aff22d3454fa45723ef76bb5e44e466ff471", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330124, "uuid": "b96c70c4-0f37-42e9-ae96-fd612ffe9c7d", "comment": "Malware payload (Mirai)", "value": "6cf2d9828c687d9c8c0677194659360651c936cf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330124, "uuid": "990c428b-620e-4d3b-be26-b09aa2bd5798", "comment": "Malware payload (Mirai)", "value": "00b6dab0af6a7edee4fb58c0a49645c318c253b9d90c063e56b9c823a410d02aa6c3a90f92f8ac52b1aba4cb714f45a4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330124, "uuid": "1260ddca-08be-4c32-b223-a3721b347423", "value": "T1EBB35BB3CC26AF98C655D074B0B18FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330124, "uuid": "e99260a0-d95c-4c7b-9191-3db3d58b9cdd", "value": "1536:WTW/VCxsHZusx2Li62C8XiKTRpP/PVmAVoWWczTW+A1P7/:WytCxsxx62N1TbVmFWWMTbWL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783330124, "uuid": "783fefad-317a-464a-aec4-ff1ea1df3ace", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783330124, "uuid": "a63bf2e3-49dc-42fb-be91-1e530e836ef4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330124, "uuid": "e9bdbabe-65fa-4239-9889-190d5f84aec0", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33e5dfaf-7916-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1783327169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783327169, "uuid": "8e59a6e2-e4d4-457c-9e18-d2c2edd8d8c1", "comment": "Malware payload (CoinMiner)", "value": "4df801270344ab1db66c792f7f4aa54a", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783327169, "uuid": "6c4b82b0-745f-4591-ae3c-a03eb1eb1879", "comment": "Malware payload (CoinMiner)", "value": "12cffa88893c9fabd2ec1153f535886c0dc2a2a786dbbed1dbaed365747d761a", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783327169, "uuid": "5dedc362-47ad-4046-a8a6-5ff91246fa0e", "comment": "Malware payload (CoinMiner)", "value": "7d34e2b5e705d080451692cb6ae00bbd4e742da1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783327169, "uuid": "2d11c8a7-546b-43d5-af0d-511248dc5406", "comment": "Malware payload (CoinMiner)", "value": "38501f8d0684f015cebae7f4f5635fd875c1d2b92b009493e19debd535711cd84eda5ffda70a5198b680af9055a544b6", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783327169, "uuid": "8957cd6e-9477-434e-9869-d420d5e9a095", "value": "T1C726335B99C47EA4D370863F6F6E2C0989389F2001CB74A7C92F4DFA4565E8C4F78662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783327169, "uuid": "9495779f-26da-4659-bc9a-4509aaf0344b", "value": "838ad462f85f39765779831b659cc5f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783327169, "uuid": "a372f070-460f-4587-b8c2-7c9c4bcb8763", "value": "98304:I/vqVYB3pcbAafBs1wMxgTiRi7CILURMvBj7Ph4/+Ckr:IHqyRKAos1rxMAi7CILURMvBj7JIxkr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783327169, "uuid": "59992486-c397-4f14-bb0b-394b4fe25000", "value": 4550672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783327169, "uuid": "feaa3c61-97e4-4609-b665-cd42344b33e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783327169, "uuid": "4e63cd49-f90c-45c4-9576-cfc91f37313a", "value": "SecuriteInfo.com.Trojan.MulDrop38.49463.31331.28459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "879285c4-794f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783351790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783351790, "uuid": "2a2c5614-c4c0-4b0c-bf94-2a79ae0f8467", "comment": "Malware payload (AgentTesla)", "value": "da2120c19795a6eadfa7354a44d69561", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783351790, "uuid": "700fab2f-8836-4762-a0b0-d3cc86e901e9", "comment": "Malware payload (AgentTesla)", "value": "147c897e00c759b643fb5dd6afc05be16433f78ecb5ff563f767721c6b502fdd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783351790, "uuid": "6c2dddcc-5878-4e88-a2ea-3cfcc520214a", "comment": "Malware payload (AgentTesla)", "value": "8a2dcef0fcfab663721d522724c1a40f44dec920", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783351790, "uuid": "237eeb69-0765-4f14-8b9d-881e9242b7d0", "comment": "Malware payload (AgentTesla)", "value": "2ac0f663b7c526e46dddb1bfe72f09868e4473f41192268465aa01865972cf71fc12b4777c8c92526e874515601069d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783351790, "uuid": "13d7bc72-85e8-4a7b-a039-da018d2c88d8", "value": "T1A2E5174157A4A2737331EBAC523ADF34940E900329D9CF48356EE6297A5CD4BA358BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783351790, "uuid": "aad9af7a-8b95-489f-8580-2843dec90be2", "value": "49152:q9agPBboddhXZfcXK/t7w9t19WpTV3z0yQvlybjxbZ1/hQO5zqoYnhcniXlnxOv:aagPBMddhXZfcktc9t19Wp5j0Xvlybj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783351790, "uuid": "5a7b21c7-92f9-40d8-b26c-b163f02786e3", "value": 3139404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783351790, "uuid": "724aa83f-d1ea-422d-9ec6-86e7df469dee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783351790, "uuid": "264914e4-5097-4663-9fbd-e3fbed17ee8c", "value": "Cosignment Note.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5917305f-796b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783363738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783363738, "uuid": "d8f62ab4-b38b-4d8f-8daf-028cf78850e3", "comment": "Malware payload (Mirai)", "value": "9e89d8d5ea68a351a074de74bf79f33a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783363738, "uuid": "cc9eab3c-e68b-428a-83d6-f0c43ddd8c4c", "comment": "Malware payload (Mirai)", "value": "149f314e77e7af60c91767bae27cf199ec60c4ae7a4599aa27f81866f88e0e6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783363738, "uuid": "d0a261a8-fd95-4bbf-8ae4-e510392c8553", "comment": "Malware payload (Mirai)", "value": "bca646fb9f0fd8195359f9bb1a13fc517c3e3e8f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783363738, "uuid": "a0706ac8-ce14-4b14-bb5f-16d789e25e57", "comment": "Malware payload (Mirai)", "value": "3a6e402daa995f888dfe1d203adbc42fcabbeabb368c5461583a3f365529e5caa02f7a53bea8df3bf183dbf0b54b3b07", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783363738, "uuid": "0da6af64-fd06-4078-a36a-9ff415ec5687", "value": "T1E6047D88B74CEB07C19093B79D6F0623633138567B4B87627A19761DEEE23EC9C16319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783363738, "uuid": "aa98e047-4621-4fe0-8e28-dbc65e0b19cf", "value": "3072:UoxgN3Itbsjz6e9T0iYLtKVJ0MDodOM1YQQWuc/z/vG2GFkr:UAgN3Iy90RZKV2MIOM17QWuW7O2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783363738, "uuid": "33430d6d-ade8-4dce-8e6b-6d7fa80c6a75", "value": 189696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783363738, "uuid": "6fa54ed3-c1d4-478c-b371-dfe96bfa2152", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783363738, "uuid": "d1aef84c-bb13-42ca-948b-25e84d813c13", "value": "aarch64.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23b2444-7958-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SheetRAT)", "timestamp": 1783355754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783355754, "uuid": "ca380fbb-1dd1-48a7-8f73-1f199c7211d8", "comment": "Malware payload (SheetRAT)", "value": "a9d455bf907914a8e39cff601299c41a", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783355754, "uuid": "dfaf4533-6762-4f21-bcfc-21c1250ad641", "comment": "Malware payload (SheetRAT)", "value": "14d6cb9a29e993ce5d69c8ca67ea84a6d71c408c6bccc7f1a3610d4b6b95ae0a", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783355754, "uuid": "3632af0f-cf6a-4823-acbb-ee88d12d7253", "comment": "Malware payload (SheetRAT)", "value": "9b20cf4a1170d059db992c1cc327db2e3a596f54", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783355754, "uuid": "d454e4bd-7a6d-4971-9553-493457a44251", "comment": "Malware payload (SheetRAT)", "value": "fd536ba8836012a268b57b0fd642cf695ae1f7b18effb1418c3df704eacfdccda0bedf6898d8d327488556c9f18ba0eb", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783355754, "uuid": "293fee2a-084f-4470-bf17-bda8bd15affe", "value": "T173F7338A6E22F03FF413D473E11856E9625AF194D7338FA6113E91DEE8F2B106B441A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783355754, "uuid": "92a79bf1-f77f-4d24-98a9-6f6b7f5f02bd", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783355754, "uuid": "bc9bae7b-c0f1-4942-82e5-98785b23ef65", "value": "1572864:g22um44Hi+zg1nNHG3cv4JW4/KMYAMvJmiftzjPzcsZM2AWUQriXyL:g2Tm4vH9NYJo+sUifljLcs22/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783355754, "uuid": "583f069b-0e06-4e31-aacb-3a495d81516c", "value": 76679340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783355754, "uuid": "dfb25a37-ffd3-4157-9b01-4d3d9194042b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783355754, "uuid": "aa334ec1-7f26-4d77-a163-ad6f68558263", "value": "Packages.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021f62f6-78f4-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783312482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783312482, "uuid": "00c85f1f-4662-439b-a5ea-743f9bfa2256", "comment": "Malware payload", "value": "b77ebb9d22d3fd4d811fcbff344ebd81", "object_relation": "md5", "Tag": [ { "name": "5-101-81-210", "colour": "#426F21", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pizzariatrattoria-com", "colour": "#D874AB", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783312482, "uuid": "8c8b76d8-9dc1-4bce-9135-6667b7308d01", "comment": "Malware payload", "value": "15baa89a82c5c6055d80915ccec1c4362950ea9ea3748fe8065b6b81dd105bd5", "object_relation": "sha256", "Tag": [ { "name": "5-101-81-210", "colour": "#426F21", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pizzariatrattoria-com", "colour": "#D874AB", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783312482, "uuid": "a08536ca-8af1-4296-bc6a-a3b0702c716c", "comment": "Malware payload", "value": "bf4d23a4662edde4e45938349db8ab2dcdde5232", "object_relation": "sha1", "Tag": [ { "name": "5-101-81-210", "colour": "#426F21", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pizzariatrattoria-com", "colour": "#D874AB", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783312482, "uuid": "754844f2-e775-4f5f-8a50-a95f1c6d3e16", "comment": "Malware payload", "value": "8329bb035dcd7e4505754650b4bba64f308cb44ca810a85cccc311015ca802729833cdd54f748a6a7ff0f0df8890ad27", "object_relation": "sha3-384", "Tag": [ { "name": "5-101-81-210", "colour": "#426F21", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "pizzariatrattoria-com", "colour": "#D874AB", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783312482, "uuid": "a28ffd1a-e453-41ff-b2dc-84fed65d0443", "value": "T1DF85091857B1309214CFD9726AE40A2ADD8E251953FF002A50F72FDDCB8129AFDB761B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783312482, "uuid": "bb81c963-369f-4724-ba57-22a7d53b71b9", "value": "12288:P8whB66O9tlLEPao7uDrwetH5pryhqnpFUs4MGKILTakk8B7UtriD85M:ovM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783312482, "uuid": "f8ad9f5f-fc42-4473-99c0-6c54faccd245", "value": 1760556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783312482, "uuid": "edcb6563-8a45-4098-b2a0-b1f8c07a970e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783312482, "uuid": "17d5da10-9cdb-4994-ae39-1ace3283fce2", "value": "Scanned_RFQ -PO1400008 3968.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d1cc43-7932-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783339525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339525, "uuid": "c48e8c88-0521-4b94-9ef7-55f2740cfe65", "comment": "Malware payload", "value": "e4428816c38db59c54e6fea2e50448f7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339525, "uuid": "b672e6e1-b7f2-4b35-b154-a90ad4d734da", "comment": "Malware payload", "value": "16bc5ae7bdeccaf175f0ac0065e8b205f0b0ceed1cdd3e81c0f0fdb42a579a7b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339525, "uuid": "53a60b1b-0fa3-4652-9898-2d50ea658478", "comment": "Malware payload", "value": "233a669aaf6f49d5aadd23ff61a77ecfef4ea438", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339525, "uuid": "3d0a01ca-11bb-414d-97aa-9d946c33f358", "comment": "Malware payload", "value": "8ca713fba90a0d88148c2faf9aae23dc03d84d47ec58715e30d21d47c3aed87be714bf1ae7d2e9291e7094e7ba8847c1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "f", "colour": "#3E9B70", "exportable": true, "hide_tag": false }, { "name": "PMIX1.file", "colour": "#4BB9A3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339525, "uuid": "b5720765-a053-4f0c-bfab-2877338bc7c1", "value": "T1BCB5025FF69A13EAC63981B8505582127BE0BC074B10EFEF35092DB65D27EA88F35718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339525, "uuid": "308763ef-db3a-4eab-b95a-d6f3a347f7b0", "value": "5a08440e22a99b9fda864d620400de65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339525, "uuid": "1c5d4183-d5cb-47a7-bca8-457e7aab0495", "value": "49152:rfcy5mbuJR/DkpV3B7Utyyd44Gv8YKQSTJXDnoe8ODlZUYEUWM:t44GkYjSTNnoGgYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783339525, "uuid": "2d5dc44d-692c-49fa-b441-0300a235e668", "value": 2318336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783339525, "uuid": "723b4879-a4a7-4d05-8c73-db34d652ce22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339525, "uuid": "a093c0bf-015d-4295-9e84-5e3bfabcdffd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a9fd6c-7933-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783339594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339594, "uuid": "b7e269f6-9fa8-42b5-9ca3-d26d91fa8f6e", "comment": "Malware payload", "value": "f733f471bb3ddd69ef8e99d18f105be8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339594, "uuid": "00904b0c-1510-4d98-bc80-8a8320fcb37a", "comment": "Malware payload", "value": "16c848d03bdcb9244ebf6996b8698bdc8f7c90a07b6d4914a0ab512e01002397", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339594, "uuid": "9d8d30c8-a929-4eac-8fd1-0f29342f59ba", "comment": "Malware payload", "value": "0194f53d57892d3849b2e56585c47690358fb263", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339594, "uuid": "8b79aeaf-5bc3-4304-b592-438e4ef0aeac", "comment": "Malware payload", "value": "d2e3e7813b8a64a1ded074509936b3bcc0a2c2aeb100a2e960c39d7b7e3a9dd90705c9fa93ab69f244fd48faa1b780a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339594, "uuid": "3cbcac12-df85-4184-bd5a-b3bc2717a2a9", "value": "T17902DC356A3898781DAC7E27C453B885F449512A554BCF25F6FFC3C08B210CECB6B259", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339594, "uuid": "96a9962a-4192-49f6-a3b8-0c51422dcb73", "value": "192:FpXTHbWYwd5bO6vPfQ0MoG/li0xFgk9J1OBzcPyWRbWwCf:FZTQbWI0F3eBz3eRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783339594, "uuid": "b2edf22e-b37b-4deb-b5c4-5e13645d58ed", "value": 8973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783339594, "uuid": "15193c53-5621-4c52-a221-f89e8143039a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339594, "uuid": "5ffe340d-d291-4577-9a67-1fb3b439bfec", "value": "weneedbestchoiceforbetterdeservethebestthingsforme.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa3296a6-78f3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783312469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783312469, "uuid": "296f5e54-7a5b-45e2-914e-62eaa905732d", "comment": "Malware payload", "value": "3aae6bc7c41161a47fff7e045d3f5b1b", "object_relation": "md5", "Tag": [ { "name": "5-101-81-210", "colour": "#426F21", "exportable": true, "hide_tag": false }, { "name": "pizzariatrattoria-com", "colour": "#D874AB", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783312469, "uuid": "d828e8a7-db7b-435e-a131-fe0484920d08", "comment": "Malware payload", "value": "16f00f60611439e72d505d23515a7e1d5c9b4261801e02c141c94ec72119e21b", "object_relation": "sha256", "Tag": [ { "name": "5-101-81-210", "colour": "#426F21", "exportable": true, "hide_tag": false }, { "name": "pizzariatrattoria-com", "colour": "#D874AB", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783312469, "uuid": "53308a08-744c-4b47-8618-b4e01ce51893", "comment": "Malware payload", "value": "66fd21729beea137a8af3c238922b8d0faf20136", "object_relation": "sha1", "Tag": [ { "name": "5-101-81-210", "colour": "#426F21", "exportable": true, "hide_tag": false }, { "name": "pizzariatrattoria-com", "colour": "#D874AB", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783312469, "uuid": "8f7fba1a-d668-4985-988c-2689a99632cf", "comment": "Malware payload", "value": "82c9df16eddbc396c4225a158b484c2e28234978d740a1f57d9f999fcbf63a6cc8b50e00ea04f09041095f794ba1904a", "object_relation": "sha3-384", "Tag": [ { "name": "5-101-81-210", "colour": "#426F21", "exportable": true, "hide_tag": false }, { "name": "pizzariatrattoria-com", "colour": "#D874AB", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783312469, "uuid": "4294cfe1-3a2e-4eef-b2bc-38a7e20432a4", "value": "T1FB4423C1D65EF05615FF6FB1A6CF61F61CD001D6864AD2612B289CB29C8386FD4027BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783312469, "uuid": "985549e5-8b39-4613-8950-df431a886383", "value": "6144:SedNbjKJRdHBpGSfnzOAG+5whdBgtTZiABhW:SedKdh5/KAlaPBETwA3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783312469, "uuid": "de4c9612-2bfe-4805-9a89-2a983ba90408", "value": 259089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783312469, "uuid": "58d4c6a6-be6a-4fb7-95c9-29e3f53adfa6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783312469, "uuid": "0fac6e19-8ff1-4c72-9978-54686aae2c47", "value": "Scanned_RFQ -PO1400008 3968.001.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04560c1e-793f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783344698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783344698, "uuid": "345d2567-7ddf-4416-9b1d-65364889b3c8", "comment": "Malware payload", "value": "b162d0785e09355ac7681bea3367a406", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "njgl", "colour": "#E3FCE1", "exportable": true, "hide_tag": false }, { "name": "phishing / malspam", "colour": "#B74849", "exportable": true, "hide_tag": false }, { "name": "tax_theme / ua", "colour": "#5CDCC6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783344698, "uuid": "0735e852-29db-48e4-b00c-b0e0e65a762d", "comment": "Malware payload", "value": "1748ab3fcca2c438488acff130303df89005e68070460a87904458d0beecdf7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "njgl", "colour": "#E3FCE1", "exportable": true, "hide_tag": false }, { "name": "phishing / malspam", "colour": "#B74849", "exportable": true, "hide_tag": false }, { "name": "tax_theme / ua", "colour": "#5CDCC6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783344698, "uuid": "b36d3ace-ed3f-49d9-8208-fb6fa1a9f45e", "comment": "Malware payload", "value": "851b4ea72ca8e4530812af1b1f5caed3a0e8cb94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "njgl", "colour": "#E3FCE1", "exportable": true, "hide_tag": false }, { "name": "phishing / malspam", "colour": "#B74849", "exportable": true, "hide_tag": false }, { "name": "tax_theme / ua", "colour": "#5CDCC6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783344698, "uuid": "f295e606-0c64-44f5-99d2-f8279c8b6b7b", "comment": "Malware payload", "value": "caff7997bf790776f58b3cba1998068eb00c51364633edf7f4a662f4ff371d32a4ca6dc191111c1e90969b7a35c67c14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "njgl", "colour": "#E3FCE1", "exportable": true, "hide_tag": false }, { "name": "phishing / malspam", "colour": "#B74849", "exportable": true, "hide_tag": false }, { "name": "tax_theme / ua", "colour": "#5CDCC6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783344698, "uuid": "4782bacc-d727-4e11-9d1b-3b445f9af30d", "value": "T13B833A07F2D490BCC049C2B987CBA677F236B8861933B79E27D41A112E61F986F4D746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783344698, "uuid": "25ce2c09-764f-49f4-9120-d58d239b33fd", "value": "9fe6ebf0e08482cbfbd4ce5283d27f6f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783344698, "uuid": "e317be12-f55c-4976-9389-28526ed2b804", "value": "1536:r5JDCjKiDqSuVePTfjrWPyM//vN1M8dnt4q7D62f2WWR9JsVJk:vCjKKruoPfrQ/Femf62G/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783344698, "uuid": "971599ab-c16f-4451-a643-7cdf344cca29", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783344698, "uuid": "1bf1a436-1151-4cae-b8c9-1fa3ce4711ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783344698, "uuid": "83915f58-97a2-4fec-a07b-2a15472b4782", "value": "\u0417\u0430\u0432\u0430\u043d\u0442\u0430\u0436\u0438\u0442\u0438 \u041f\u043e\u0432\u043d\u0438\u0439_\u043f\u0430\u043a\u0435\u0442_\u0432\u0438\u043c\u043e\u0433_\u0442\u0430_\u043f\u0435\u0440\u0435\u043b\u0456\u043a_\u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0456\u0432.zip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c092f6-7920-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783331624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331624, "uuid": "dfa4420a-e6be-4f6d-8352-3d08584787b5", "comment": "Malware payload", "value": "bf81b95b611eda337a4d2e0174a5b0fb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331624, "uuid": "cc1aaa71-cd68-4321-a7b3-63a78ba335fd", "comment": "Malware payload", "value": "17bb504dbf02db194433ea136c590d151cf59fb773fd951be48b86a1e3163650", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331624, "uuid": "d5e0e69d-4aab-49ec-ad21-7e92c2f6a4b4", "comment": "Malware payload", "value": "fa1c43a932849e62ad997f38cc034f05d9d739cf", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331624, "uuid": "24d65e68-3fa0-4345-bbf5-53375600b1de", "comment": "Malware payload", "value": "2e74beb396d7049452703e5ffe0366a626752c75d76f7082f4354691f02724ed37b3650c2ae857824a053995eb047d3e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331624, "uuid": "b892afca-2f1d-44a0-b3e3-b6a7cc978191", "value": "T1CA136D6526953C25AE99883B5C7F2F0CBDA983E2300491DDBFCA3CF18C15A9CE718719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331624, "uuid": "4faf653b-8bf6-4f60-9b16-1d97cd130948", "value": "768:Zofr9NyXsZztCO9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:aHusZOco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783331624, "uuid": "6ef32944-b540-4cdc-8639-8a9a6a4ce015", "value": 45505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783331624, "uuid": "5a49b249-b957-4faf-9a6d-071b0d26acfa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331624, "uuid": "98c4323a-720c-4c17-a833-30325551d01d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e21f49d7-796c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783364398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364398, "uuid": "d64d785c-d48f-41a6-a87c-9c11c25e212e", "comment": "Malware payload", "value": "124d42ebc7a39c18a753b1800ac4be2b", "object_relation": "md5", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364398, "uuid": "d89d1bb2-bea8-4364-95dc-603c71872ce9", "comment": "Malware payload", "value": "17f2fa80c561506093fa3f90e6249b7ffa5129386547e9424ec55b0bde269cba", "object_relation": "sha256", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364398, "uuid": "30c87275-24dd-4662-b99c-b167a28a30d2", "comment": "Malware payload", "value": "2aef623ac7d99db553962fe29971ca5dc700ce5d", "object_relation": "sha1", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364398, "uuid": "31dab804-c227-490c-a46e-edb6aac3952d", "comment": "Malware payload", "value": "cab4e91216083f572654f2258ae37514e3416bb64ead11454be3e2a3b9dfe1857b4c30210006e85c334cbd0fc692d437", "object_relation": "sha3-384", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364398, "uuid": "c5d78586-dae4-436c-b29b-2bcb3ed182a2", "value": "T105A2B97732770CFA83D379A988DAE104E69404B7205D6EDCF8DC9255EF21D2593BC942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364398, "uuid": "f0ce1c2e-a526-4b47-94cc-2b260dbe53c4", "value": "192:hkWyReGcc1mhp0e+FGtEbuGg6Bz0T9/T9IdQ5AQQYfDbSIpSIB9F/v6wnyGvMhUf:hzEquwfnXyIcLvoLgo/cJnQr7Kqgolcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364398, "uuid": "e55c0326-08a5-48d3-a601-1eaff6136c66", "value": 22536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364398, "uuid": "fd704069-60ef-4525-9869-b9860b47c059", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364398, "uuid": "aea9b2ef-c87d-46ff-a768-4053935367e2", "value": "17f2fa80c561506093fa3f90e6249b7ffa5129386547e9424ec55b0bde269cba.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8068bbe-78e9-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783308036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783308036, "uuid": "3cb5ffc4-c8c6-4f84-87e4-75591df34c81", "comment": "Malware payload (Mirai)", "value": "1acc0f308c52e820146a09951053fd47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783308036, "uuid": "3d0b2b26-9d98-4e15-8fd6-220dd1e23e46", "comment": "Malware payload (Mirai)", "value": "18b41831d97c38ead9005e522a75adcf645871d6e471846869c9b9fd5726b6d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783308036, "uuid": "042163c7-bac3-43c0-a997-71135facecfe", "comment": "Malware payload (Mirai)", "value": "32124e68e4e5494464fa3ac7947a47a68831cc7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783308036, "uuid": "e5baecb6-f8c5-41a3-af75-9f36ed179712", "comment": "Malware payload (Mirai)", "value": "c1c65c2ecc3387d0622c0df68e9bc8cd3bf72e06009ad2bb784d1690e54f324aa42103954b287e4c7ce326078d865e36", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783308036, "uuid": "460a8e8a-4449-461a-805b-ed89df942ea7", "value": "T116144B8B77508F91C369DA3105F387A3AAEA228217E2D585E36DDD003F5135C686FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783308036, "uuid": "925bc917-8e7b-4eaf-8fae-7be9503d5eda", "value": "3072:Mhiasm6DiuLqBKRtSb/z9yF06BiRH0N6JNa+m0tgAn2s2j5w3:Rasm34tSbLboihxy+m0tgg2s02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783308036, "uuid": "78cb0eec-ecd5-4f60-856d-b07b4ac62600", "value": 200912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783308036, "uuid": "27bb9d83-0f1e-4bab-836c-63d5330d1982", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783308036, "uuid": "de51ff73-9b02-46f2-86c2-3ad54c815d98", "value": "dg.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958bb3a3-7935-11f1-ac1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783340647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783340647, "uuid": "ddaafd37-9031-44b7-9f7b-d6c6718eab13", "comment": "Malware payload (XWorm)", "value": "42f7945ec75544a0474ad1ec9ca57f36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783340647, "uuid": "bd08e03d-9a2c-4576-bbbe-e2e8152f0082", "comment": "Malware payload (XWorm)", "value": "196f53a2d6b267d8ea1e590e1a45d89797df3228fe9de435593df3daa94e8cf2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783340647, "uuid": "bb61c36e-f75a-4b6a-ae3a-c95ef17362f4", "comment": "Malware payload (XWorm)", "value": "146633200b53d65d7d45fdba7d341160d7f8f18e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783340647, "uuid": "fe9de961-2747-4565-97e1-b7fbf2355b2a", "comment": "Malware payload (XWorm)", "value": "e58a8c387c6eb15a695f4c29ee3e7a1852dfb9bae2589d94f958228640444ff1f19b920a305c0fbe7d81133893f66b3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783340647, "uuid": "25a1b832-14ba-4b5e-97dc-8f5f4e514c38", "value": "T10D3541C804BF19D9B0C8A0C87AFE79C6B85F4D05412FBE82E5467A94C2DAE6CF4511BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783340647, "uuid": "87e47ccd-7b1e-41bd-8974-21d2cf8c2326", "value": "384:e++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++z:hu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783340647, "uuid": "e406f89f-5774-4c8d-ab94-3f91fd761d8c", "value": 1127606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783340647, "uuid": "2f42cb89-9dfd-4e9a-b798-45f5d6d67c7f", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783340647, "uuid": "cd43474d-d38c-4ab9-b263-1b3ff697eba7", "value": "OC463971.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e03423-798b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783377690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783377690, "uuid": "49de544c-cc60-4628-80ce-108a3df6967d", "comment": "Malware payload (Mirai)", "value": "0b1dbd9ea84e2e5c7124b70581a962c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783377690, "uuid": "93c8b2c0-5a4b-4903-b8e3-f72890036572", "comment": "Malware payload (Mirai)", "value": "1a79ab7090db6c42752c45524edae6a9c042afc59d6754748a5dd3e3154a6ad0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783377690, "uuid": "cb010e02-c091-4d0a-835d-fb110695d004", "comment": "Malware payload (Mirai)", "value": "9daffe61c8d5bf814eb8c14a51583da7f5b89f83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783377690, "uuid": "817453b6-c19f-470f-a1ad-4186c074ec4c", "comment": "Malware payload (Mirai)", "value": "9eb590fb44a7eac0538053773efaa4ee06e048b9f9170f97b52f004665463a88b1f82b3ad0c53cb70818671dbe006448", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783377690, "uuid": "1f85c031-be55-4aac-a55b-49d346cfe45d", "value": "T1C3932984BC81A622C7C1127BEE5F018D331647E8D2EA3347DD254FA4778A96B0E37B42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783377690, "uuid": "0ad197cb-529f-4d2b-bc66-d308ab883dde", "value": "1536:+RMo0AsDcBr9s5ZrGAS458T3byOwMSI1pX0qAdJ2ivpj4LCvbzUBVkyi5lnswC:+RMo0AsDcBr9sfGA158T3b0ZI1iq+J2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783377690, "uuid": "e0032c0e-c4c9-4ce9-bbfe-ed9c8f37e584", "value": 95360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783377690, "uuid": "5ac64358-8b62-4fe5-bc2b-9f6f45b80482", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783377690, "uuid": "00e3c238-af50-4d38-a67a-f5a1bc688c99", "value": "tarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc96b58c-7937-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783341625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783341625, "uuid": "31761dcf-4fb2-4c84-a172-d403a5ce1c5b", "comment": "Malware payload (AgentTesla)", "value": "2d99c2653fcb461f33979e7749133d4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783341625, "uuid": "1cfaa088-f8c6-47ad-9583-56b5008c7c3c", "comment": "Malware payload (AgentTesla)", "value": "1a9f21532065834e6648a77d0dc646232f254c06a83676d700d6662f0433bfdf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783341625, "uuid": "4ce3b51b-be70-4ea7-9198-c1ca0d8fb650", "comment": "Malware payload (AgentTesla)", "value": "b3dc633c44008d8882b0164816090ecca5055e88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783341625, "uuid": "a2ab5f53-bd67-424b-b8cf-e12597302636", "comment": "Malware payload (AgentTesla)", "value": "f1b557a608eef9aef3de4a9ed74b1a6cf5d9d2d1011695fd8afbaba7b0c9763ef53fffc55e2487f239c0fe1459ab701b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783341625, "uuid": "245c4ffb-d2b6-4ac7-8775-d247b7a2b410", "value": "T111362B8666E9A1137331EBEE452EEF34900F945338068F6575DEEB38381CE86A714793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783341625, "uuid": "6af6146b-5ef1-4152-b1ab-fde371d0992a", "value": "98304:rH6FbPyzZAykrqILoRNBfyTTlPODUgqXo8wpOtvP9QAyipaZXMxVFOl+WsokcYkY:Vziy2c9ynlPODUgqXo8wpOtvP9QAyip/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783341625, "uuid": "3762549b-fe5e-46c9-a313-a7ce81b247f5", "value": 4941844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783341625, "uuid": "1cabee95-901a-4690-b0d1-922988811db0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783341625, "uuid": "2d0df168-5fe7-4dc2-a9c6-b38009e65970", "value": "ORD-202602104.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccce4929-796b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783363932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783363932, "uuid": "54606a91-7340-4bee-b4b2-5c87918a8f52", "comment": "Malware payload", "value": "f075a2451fe813e7eca812d5d14aaf97", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783363932, "uuid": "35c3f78b-ed13-4812-bc18-4684987301cd", "comment": "Malware payload", "value": "1aadc733fea9ca54a2d34fbee60845b485f8e5741d211487f0f533889e6d0fdb", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783363932, "uuid": "289e9a33-e769-41b0-bc1e-70e66d5ff727", "comment": "Malware payload", "value": "32db43405e06fe39cb26ac2cf3502c4555498e24", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783363932, "uuid": "5f1983b4-a565-4d32-8f2b-3059121e9486", "comment": "Malware payload", "value": "98ed477e42f67027d22f08833029353f1a90b891e703bff043ad4bb9bae3c47b33bdad87ddffa3bb702e3b05f9218e4c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783363932, "uuid": "b4adc1c4-ec8f-456b-8fa6-ecfa0458f43e", "value": "T172E6335CD6E012E6F9B3903CB9A19289E8B734A64332C5DF4A985F678E571E14C3D30B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783363932, "uuid": "1522309a-2c0c-4875-95b9-f04b5f60c736", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783363932, "uuid": "2b751abe-a72b-4e4d-9d5c-74c29a1fdd67", "value": "393216:gfJ9OcvbvA+wHbdKz+itMWPXZpXMCHWUjXRscuI3/PGTAI:gfeAb3wHbd47PJpXMb8XR5H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783363932, "uuid": "8fe18938-547f-4259-8323-2e20a385e415", "value": 14270564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783363932, "uuid": "6decde62-c3aa-492a-9f27-8d50eac89d24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783363932, "uuid": "b0a7a107-88de-40af-96dd-5e811079535d", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2793d19a-794b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PhantomStealer)", "timestamp": 1783349911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349911, "uuid": "cf0382cc-fafc-47f4-9cd4-a12ea3f4c48b", "comment": "Malware payload (PhantomStealer)", "value": "80ba9918cb97f6d83d7fda19ba9704a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349911, "uuid": "034ed794-ec59-4cc1-acb4-1920fea2a0fe", "comment": "Malware payload (PhantomStealer)", "value": "1b3421ad62238718702637553f16933d34d0af635e0b9b6c10a0d9706dc75380", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349911, "uuid": "349be481-056d-4987-8645-68eb6c8ba3d1", "comment": "Malware payload (PhantomStealer)", "value": "c0fb95a0f73c8105bed82af9471e8b7bb6dd8902", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349911, "uuid": "e8a4fa4f-0f35-4652-8928-96aa6bfb20c9", "comment": "Malware payload (PhantomStealer)", "value": "53046282d4564921c844344643afb6eba6c8670c1a12c24fd4faf9191f2ec355adeeaeda660915eb0770d31888c49bcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349911, "uuid": "24715092-8d37-4f2a-bc80-2341dfdd6bd4", "value": "T1ED7512452398CA02D56A17B464B1D2B81B396E1AF912E3031FE47FEFBD777124C4628B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349911, "uuid": "8eeb2b1c-338b-4a75-a90a-1dff2fbf58d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349911, "uuid": "de6beb2e-faa5-4f5e-84a8-9b9189b0f0e9", "value": "49152:HATE0AfytjG9N2W5liNCk8ya6cZj1qi4N0L:bf2kgck8dnwl0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783349911, "uuid": "1e4b31b4-9423-40af-bb67-13472362dfbd", "value": 1656320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783349911, "uuid": "a8827bc1-c27e-4585-af6f-5404b2dabcbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349911, "uuid": "ff782e0a-6d28-468b-ab49-b136b849f124", "value": "52772993006654555.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4594621f-7931-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1783338795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783338795, "uuid": "0b886135-24d2-411b-a888-f332e527c0e8", "comment": "Malware payload (Prometei)", "value": "02c15179d4f55ae91eb79b39150f59c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783338795, "uuid": "407c0f15-3a02-48a4-9657-9b28e442f5d4", "comment": "Malware payload (Prometei)", "value": "1c847d3bd3ef4bf7e21a7091f1479e0e2ca432585ebea996653845b9adfb150e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783338795, "uuid": "99f37f06-a93f-4fb0-85d3-f302bc57ee58", "comment": "Malware payload (Prometei)", "value": "49a5e2b634d624e16a47d05658e485a351bb8193", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783338795, "uuid": "945ea388-1f70-46ba-b177-c298bb4b477e", "comment": "Malware payload (Prometei)", "value": "a48d3dda309c9215bb2eb347ce2027665944fdd554ee280d3aa0801cf0d341863368358732b658301840e5910b7589b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783338795, "uuid": "d0c18627-73ef-4572-bb6d-f5993182b92a", "value": "T1CDF50857E59550E4C0EED174C726A223BEB13899073433E36FA196B11F26FE4AABC314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783338795, "uuid": "fe73d038-c50d-451b-a9ab-48f1694d01cc", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQw:cqYUQuVDt0Tw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783338795, "uuid": "1e27e576-1487-4b0e-afa0-b4413de685f9", "value": 3342336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783338795, "uuid": "e62a4446-0424-45d7-9d39-cf0a1132460d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783338795, "uuid": "bf72c786-2bdc-414a-a894-2293032dd83c", "value": "1c847d3bd3ef4bf7e21a7091f1479e0e2ca432585ebea996653845b9adfb150e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ac7b1d-7947-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1783348294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348294, "uuid": "e22502f6-a28f-4366-8a7e-e00917eab4cf", "comment": "Malware payload (CoinMiner)", "value": "396a1abfc314bf2e1c5e7dba17ece037", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348294, "uuid": "6ff4c0d7-b92b-4954-bd36-e8cdb1a84bdb", "comment": "Malware payload (CoinMiner)", "value": "1d8bdf8caa4189017478785b995c242b07b4ebeda272b34af247e398487757e5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348294, "uuid": "51c06471-5c45-4061-a476-8bf954c1d7e0", "comment": "Malware payload (CoinMiner)", "value": "585bd6d0676a62ec9637e2cad8ebbc7b0c68da92", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348294, "uuid": "1b5f5b53-3669-415e-9b8e-5b0fb61d7d65", "comment": "Malware payload (CoinMiner)", "value": "a69e9df7d3b728f588e896d199ee37f3810f0932b2befe1ec96ea2441391f6d8867b4dd56d4f80042a6286e1be25dad4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348294, "uuid": "0aab8ae4-314a-4140-b84a-387a246b47e2", "value": "T16432192A7E490332E3A049B45576838F553C2533A3C3A3EFF77396594B962498400EEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348294, "uuid": "4b374dc4-cfa8-409e-8c86-fe7d04093b66", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348294, "uuid": "bcf897f1-c9d7-4fdd-888e-b7b466f57057", "value": "96:nnKdUo0Yz/9PYz/qYh0EKBaNdC6xDbFx+ZQSlc9dcNeGpg9PFJxGE9mZ2FFhxC7i:nZojWsEKBEx+eSl9APFJxTEZmFhSuc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348294, "uuid": "43fc9374-1bc6-4e8a-8bd0-3315cba730b1", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348294, "uuid": "e2d82adc-51e0-4f77-b1d9-815abed20688", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348294, "uuid": "6ecdb818-2a98-43e9-b232-59b50866d27c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b5a5d1-7948-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783348974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348974, "uuid": "14d09126-aed2-4a25-9417-330e3e574cf7", "comment": "Malware payload (Mirai)", "value": "8ecf193335c4a5e78b17e94d4d6e4206", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348974, "uuid": "3a694482-f4d6-4e32-9f0f-953ceefee52b", "comment": "Malware payload (Mirai)", "value": "1efb6624702e3addeb84913ce6f6f493e0f6184d501f6a084a9cae7ba22ae047", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348974, "uuid": "d044ba9c-de74-40b8-8bfe-69210d71055e", "comment": "Malware payload (Mirai)", "value": "6dfeb12621ae40657ef891eedbb533bf9952e225", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348974, "uuid": "9e060c49-fa71-4959-801b-19282d0533e0", "comment": "Malware payload (Mirai)", "value": "c4e422eadaded650ab34fa10b9b1719c08be73d6920ee726198ce4364a562e91c2c33082ae784cafce64c885fbfa2316", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348974, "uuid": "592d4896-93d2-4482-a062-dcfadee3b934", "value": "T1ABD31A45BC514F27C6D212BBFB5E428D372A1768D2EF72039D216F24378686B0E3B646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348974, "uuid": "49e14083-4d62-4787-b5c9-1a0272355ea6", "value": "1536:OFRuz/y7puhIBwcAB+O8iApeGU4VLxdJqTr0Qg8CkrSLOXe6NWLiQcXVliDwywoM:OFRuyUj18iRJ4FskQg8C0IfW5y0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348974, "uuid": "498fb17f-424d-48da-a34f-f0e0e1be6068", "value": 138016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348974, "uuid": "22b8c8ad-135a-4b04-913a-fadca95f3711", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348974, "uuid": "af31f79a-6c1f-4e46-8567-9905c66dfc6c", "value": "atomic.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f843a4-798b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783377693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783377693, "uuid": "5c65782e-45ed-4443-9685-6c3343696d1f", "comment": "Malware payload (Mirai)", "value": "edc8dc4c24fffc7eb3c1b24e28588625", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783377693, "uuid": "7df7fd4a-26a8-4796-b1b8-1658ff38cf18", "comment": "Malware payload (Mirai)", "value": "1fc2619aa6e2dec3609bb34769017ec200f01b9d2be51a6e3a4c1dae5a148019", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783377693, "uuid": "3469d073-3c71-42d6-baef-a72a7801fe40", "comment": "Malware payload (Mirai)", "value": "869d4c99b5093a4dab74ae1b249ba19e57cc84a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783377693, "uuid": "6f623c5f-67c6-4787-afba-975205e44b23", "comment": "Malware payload (Mirai)", "value": "605a0bc163dbbcd326829122d8e3e7a7ab83ae31647e4e3a38cfe9262681379b6d7b32f58d0f576779d112704ad7b702", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783377693, "uuid": "1afd1d65-8511-427f-86a4-9335984c2b27", "value": "T14AB31A89B841AB20D2D226BBFE5F014E33534BECD3EA72129D245F6477CB95B0E36605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783377693, "uuid": "a6c95aa5-b307-4bce-9963-4832a0737a98", "value": "3072:/VVaNIRMt++3jTgvD+On7PNsJzRk2MawOVDoELOBqxdef1nsz:/VEr++3j8vDrP+zRRMawOVDoEiB9Sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783377693, "uuid": "68e487cc-7e21-43ec-85ab-1463328cd642", "value": 117344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783377693, "uuid": "faec4960-c357-4b21-bdf1-75834b85fe9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783377693, "uuid": "d4f89b29-b8f4-46ac-8b80-6b41c701162b", "value": "tarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896965e0-795d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783357806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357806, "uuid": "d36be875-6f9d-47fe-b2ed-71980cc7243c", "comment": "Malware payload", "value": "11ac874e42b051aa5fa54ee1fef48819", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357806, "uuid": "2dd4f13b-9bf7-4c45-8967-ebc28acfecb4", "comment": "Malware payload", "value": "2012c7af2da6b649bc2bb58f54837b200cafecc44ceda8d5e2e43b0ea205ac97", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357806, "uuid": "68950045-4953-4ae1-ad90-5cf6db64350d", "comment": "Malware payload", "value": "f6a44ae87468d81226dd5ca366e00cd90bc68e7d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357806, "uuid": "05a063ee-097b-4d13-bbf9-7b9ef9ea0ba0", "comment": "Malware payload", "value": "e8966d66cdb84a0c6494a504d0210ad95149309f7b1fa199bc6644b4dd42dc7348aa07fb084bcc34d11003072e50dc3a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357806, "uuid": "720d4782-2639-4dc0-9ba3-f8f245ac301e", "value": "T148623C0BA4818035EBE14474827F526649FEACB623D4F9DBF7E064894AB46E1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357806, "uuid": "5fdadad7-aaa2-41b7-816f-aedae060d616", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357806, "uuid": "49ba4020-77c6-4b8d-a99b-b582a253c7f2", "value": "192:AW/sGnjXgjk8LcRAWIdJDMlIfeF5oIV1BKUSf/zwcd1gJxTmv8U9cthE9ik:AeScqdferoF/Jyav8U9cKX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783357806, "uuid": "6a3d7c38-10e5-4a8c-8678-19354123a7e0", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783357806, "uuid": "777ade40-0513-458c-a4ed-9b80c1d802e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357806, "uuid": "ff870938-b2eb-4c81-9a5b-857e8d25d9c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e448160-791a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783328824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328824, "uuid": "6db26250-4cec-427a-a777-998b9d8dba9e", "comment": "Malware payload", "value": "b735e8aa7c80d4af5aae2e506488caa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328824, "uuid": "e1346028-5d00-4561-9d97-c1e5d253523b", "comment": "Malware payload", "value": "201e7fd5329c3bdbce6c1b0576dbcb15248560ff48410fcf815cd0044f234ceb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328824, "uuid": "663bac12-626f-40c9-b076-dad433ff15c8", "comment": "Malware payload", "value": "69f38a7c752ffab07041e0166580e42e6c599f24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328824, "uuid": "ff9caf83-f0b2-45fd-b7e8-9e2856131c5c", "comment": "Malware payload", "value": "7d586fabe1566c2ee24577b1ae9f894243e9a75bdb68d9fbedc81474d1295a875223f58267c98b59afa1453773ef0bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328824, "uuid": "861afb61-58ca-4a34-8840-22585e9df191", "value": "T1718633636E916D6ADAE40F31B47ACFFDCD1DCAD361104B1FC213E2EEE46009E6902656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328824, "uuid": "86b3d14b-61ea-493c-a9bd-59797fd8ca7f", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328824, "uuid": "6598fc0f-d3f0-4f12-bd03-d75890c1e021", "value": "196608:lJaLZrqt4XU94RMENGD8xBVU7a0MamXxxi:lJAGIUKRM6pxsajaOxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783328824, "uuid": "b85e3d0f-b04e-4fef-a727-bf4a0a3cdbcb", "value": 8296120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783328824, "uuid": "1224f4f0-0155-4edb-a3ab-fe64c0d703db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328824, "uuid": "98fac2bb-aa06-491c-a61f-d8713631da6d", "value": "b735e8aa7c80d4af5aae2e506488caa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "026091e2-7949-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783348990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348990, "uuid": "78bc124f-0411-450d-861a-8407e1bcbcd9", "comment": "Malware payload (Mirai)", "value": "5bc4a2306aba6f902515fffdf2666459", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348990, "uuid": "925b0178-db42-4cbc-823f-bea0ec219535", "comment": "Malware payload (Mirai)", "value": "20b7b179cc24488fb9644fdb15ce925c267a126fb2f429976f70619b42a420c7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348990, "uuid": "7241ddf8-de0f-4fca-b122-6894139c567e", "comment": "Malware payload (Mirai)", "value": "7472353cb75670ebe5fa3d27eedfaf4412ba8efa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348990, "uuid": "719f8e6d-9dc5-45ad-a223-08ef9e6197f5", "comment": "Malware payload (Mirai)", "value": "02e165b2a75aea88d115644b32f05e589e95e6cc0cb2974df69b82a896e67721bf44849cfb8887ab0e9d6b32f13c4ce1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348990, "uuid": "9f16f657-cea5-402b-8eb3-2849e4d551d1", "value": "T14C935CC1B683E4F1FC5605B1A136A7335B32F436502EEA47C769AD32EC51951DB0A3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348990, "uuid": "232e4f20-2359-4748-bd65-b2ce4bf5a3ef", "value": "1536:SmQ1+uiD2g6X5sFCfwaTxT5VFF0t0b3Ye99+HkgSeYVYN63:S71+uiDtYuF6waTxTPHw0boebAweLN63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348990, "uuid": "0bd17577-184b-4af1-9bbb-c9d7cbb3d818", "value": 93260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348990, "uuid": "c91cbf1e-d9af-4701-ab5c-69907b721522", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348990, "uuid": "4071e3bc-7b16-4fb6-b00d-ffa0b30c9fd4", "value": "atomic.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe658a15-7929-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783335669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335669, "uuid": "c5fcd585-0a40-4077-89b1-4c734b176af6", "comment": "Malware payload (Mirai)", "value": "4bb462c3df0bac8b47938ca3e18ee661", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335669, "uuid": "d2bdc1c2-44db-4439-ae44-392e746ad903", "comment": "Malware payload (Mirai)", "value": "21c5f4a04173a5176d60b06095bf5d25e0022ffbe304601e368eccf718587dc8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335669, "uuid": "5c2c553b-7b3d-40d1-a573-1ffefc30cddb", "comment": "Malware payload (Mirai)", "value": "0328ca448e56882e37d9796d17cd0d69414b35d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335669, "uuid": "4e931cd3-db36-40c2-9a6c-0dba5e4ac4a7", "comment": "Malware payload (Mirai)", "value": "bd8a0e62cc0f2bcd5db77754a41a44e86dd531d684758a1641097c62988917ec008a1c1d60a50e778dbfdfe67129d7b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335669, "uuid": "3948a06a-e1a9-4310-b933-3e55d1ba70d3", "value": "T1BCF3AF67B34B5050C4E44AF41BCF5BAD292721008E7B99E77C6E723A6A775CB28073E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335669, "uuid": "9f82be34-b9e7-4e42-9e73-a2d4aa76b0ff", "value": "3072:Xxv5yfUhfN8RtoZnGhTNLhs7LTT+RCQX3XqbpygZCBrWOG4u5qyq:XpEfUhfW3oMJLi7L+B3a9FCBrY4byq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783335669, "uuid": "8695dd70-1b37-4cfb-ad34-d3bc84af870c", "value": 157332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783335669, "uuid": "0f1d2b34-8254-48ff-91f7-f274125eae39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335669, "uuid": "61be8603-8d11-4147-a149-eea8d8c52dee", "value": "iran.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32acec97-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783364962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364962, "uuid": "a7d9b92f-b007-41eb-92ae-5ff3233ba44a", "comment": "Malware payload (Mirai)", "value": "5f3dc43bff5b2d1930ee6eff9d827e3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364962, "uuid": "44275e20-07f9-472d-abbc-3e6172b4c518", "comment": "Malware payload (Mirai)", "value": "224dc35892d3df241b9d773363ccfcb05ff24189cf7de96783069848b786c0ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364962, "uuid": "f4e56326-3652-45a0-8cf9-5c5c21f5bf13", "comment": "Malware payload (Mirai)", "value": "d5bff429ed766fc0714d6c1809a81a64bc12d64f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364962, "uuid": "eba36893-3121-4bfe-9606-f5ced2db6203", "comment": "Malware payload (Mirai)", "value": "b6ffb8490c9862d590aa2a3ea2976b58269af9037e4f08689e1a39a4fc9d5f146efb5d29995a204ffaf30bf292c467f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364962, "uuid": "ea4f15aa-2839-475e-bb0e-12ca804086e7", "value": "T1B7A2D0BC225249EAC887D7BC2BF317A2AD35026895534C663AC5E3076E434F274937E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364962, "uuid": "f4c24cf9-a937-44df-94cc-1eaf12783369", "value": "384:LGLz5nv4juxf/0XPPKh3z4VRlaITdIV1+Y5AsbBVth5P2dFJgGlzDpH7uNj1Jgw2:Lczaju1qblWrb39EFJgGlzDpbuR1Jj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364962, "uuid": "7a02094d-f15e-42f1-ba2a-a9bf299cd827", "value": 23080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364962, "uuid": "e66adbbb-1e6e-4c2c-856c-5c41d59ee066", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364962, "uuid": "1c83f7bc-404a-4bb4-a7ac-50bc9e14a3b7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2830bfef-7954-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1783353778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783353778, "uuid": "eb71541e-f856-48d3-b717-ace8b58bc441", "comment": "Malware payload (Prometei)", "value": "fc87dee33af77f91cfdd947841f78efd", "object_relation": "md5", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783353778, "uuid": "e6903b1d-be46-4ce4-871a-a193396d1632", "comment": "Malware payload (Prometei)", "value": "2313ed2b7cb450e33d6f6d3ea968b560cc3efec87a958259a05b7750432cc029", "object_relation": "sha256", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783353778, "uuid": "ff99dd92-829a-4dd0-850e-68e88dfa894e", "comment": "Malware payload (Prometei)", "value": "01fc8f4d91b9ff95d63c04eddcf76ad90a3e6302", "object_relation": "sha1", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783353778, "uuid": "ed092071-19ac-4283-bdf3-edee24e21eb7", "comment": "Malware payload (Prometei)", "value": "5c319e95c3e6ef16a81528a19d55d00058278e66f93e0b136ed483ee6e958cb40a3e13bc04b7208ab203ecb6f49de985", "object_relation": "sha3-384", "Tag": [ { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783353778, "uuid": "ebe2ede1-cde1-46be-8d37-17de5e6445e9", "value": "T148F0DC08F401D0A0B70E0639898F98E53502150BA89C6F30300F00B25F3EB8120EE6AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783353778, "uuid": "3a711195-9cc9-4f9e-82b9-2831e225121f", "value": "6:h8HfKlAFDYswedNt5/kj4gMNiUm9OLK4CuKREKzidNMFh/FdFZWnkdN5Fny/vB5H:yKlgpYj4OVOLFC4KzEyFbZuyNnGZQ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783353778, "uuid": "cbaa0796-af02-4203-aa85-d6266b87751a", "value": 488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783353778, "uuid": "98d4ec66-c551-4537-a68d-bf52b6fdbb2d", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783353778, "uuid": "92cf09a1-6b15-44e3-a244-96be93820678", "value": "2313ed2b7cb450e33d6f6d3ea968b560cc3efec87a958259a05b7750432cc029", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60abaca4-78f0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783310923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783310923, "uuid": "266f8bba-d110-4301-a07d-b0997177536e", "comment": "Malware payload (Formbook)", "value": "e79877758e0833d88229d70098bab678", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783310923, "uuid": "db7a133c-bcbf-4ad3-ac64-7f58bac173b4", "comment": "Malware payload (Formbook)", "value": "247094bc1f9399f2d9d9576644281f1aff32e27534d531083e11acebab3cfb89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783310923, "uuid": "3036a19c-b200-4734-806d-80c508cc1eeb", "comment": "Malware payload (Formbook)", "value": "e59feee7b9e7f36323ebc8d6c148bc6d268f167d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783310923, "uuid": "7313fe4e-adf9-465f-af18-2da4365402a7", "comment": "Malware payload (Formbook)", "value": "d1956c9c9203c8a49372d599c0e5ffb3f8d86c73726f31ed80600142acf86e7f2bc93620b9f10cf877ed906881ac213e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783310923, "uuid": "1cad3509-2d72-46bc-8ec1-7300db872f04", "value": "T1D735124433E5CE02D0BA1BB06971E27157B46E58E862D30B5EF7ECEB7C69B521824393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783310923, "uuid": "8c9eecfb-9630-4e6d-8854-1a86285e1dae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783310923, "uuid": "d9bce2a7-911c-4807-97d6-88e246b1884f", "value": "24576:JpZkYeJaIIVLUfxM61E51hOOBzoxXEpcBWGw2smbc:XZgVItUfxRE51hOOP0WV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783310923, "uuid": "8cd773cc-bcce-404a-b455-988992c1b4c0", "value": 1132544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783310923, "uuid": "1851465a-2bc5-4b54-b8ab-6b783fe5c2f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783310923, "uuid": "6704a774-2370-44f5-8389-92bde735081d", "value": "Salary Increment.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d198422-791a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783328822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328822, "uuid": "27a673fd-d2ff-4b33-b0be-ea71d6cd66cd", "comment": "Malware payload (Vidar)", "value": "aded3c60373e26d7e9648cdb78c280de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328822, "uuid": "7d8227b5-1cd3-4a75-9907-977e074265e6", "comment": "Malware payload (Vidar)", "value": "25d34c70c29605a0a7ebeeb836e8fcf45ec0ddff29dd0745b844b8ea39d0d9cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328822, "uuid": "8f382122-2af5-4fd2-9fde-726f0c19fadf", "comment": "Malware payload (Vidar)", "value": "72ae58765ce3ef8777af4ca8bedeb725ccc4e55d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328822, "uuid": "0b9ce21b-2e9b-4628-9430-5599ac86b45d", "comment": "Malware payload (Vidar)", "value": "d7d8356ac2642599f6f8b530ea7fd410c7d3080b80b7f233aceb1dca67f721c9becfe67616ef87de41e723835768afed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328822, "uuid": "568ae1d1-809d-4799-be08-81f11f18d5ef", "value": "T1C152F6CA72C3F0BDD1A9C3B4D3A71AA9DA963090171A5AFF1BECC90477C3142297DA14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328822, "uuid": "28f3997e-4b77-4aa2-bfdb-3dadfa3733de", "value": "a6c2466568aae347b94e75c85d9c3820", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328822, "uuid": "32396527-a51b-4ec0-9b16-49dfba266292", "value": "192:ONFgpTQoe20LQwajqKRdkmSCfeHpEfpXfP47FfYVN3Vfwq:ObgpsoejcwajSPHpEBfPKFAVNl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783328822, "uuid": "274797e2-6993-424a-8786-82c9610c5205", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783328822, "uuid": "53638a64-7c52-48e4-a039-f77a0f65fb93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328822, "uuid": "e52ff5ef-ee65-404b-ba72-6b9de057d976", "value": "aded3c60373e26d7e9648cdb78c280de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13bb2213-791d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783330121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330121, "uuid": "cd0b29b2-75f2-4119-a178-f287958ee0a6", "comment": "Malware payload (Mirai)", "value": "928fc8683253dd344a66ba80885ca938", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330121, "uuid": "907ca87f-2dc3-48ac-818c-64bb9fc85c5b", "comment": "Malware payload (Mirai)", "value": "26f4d026abc6d49d8ea08f18a707fb725d60f86265b95cf16b23a65780ee968a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330121, "uuid": "2884297d-78e5-44e1-a7af-d5d43446fd24", "comment": "Malware payload (Mirai)", "value": "9637e3227242569507b6e92daac03784eb29f7a7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330121, "uuid": "de229d2c-f7dc-41bf-bd3c-28912a5b8428", "comment": "Malware payload (Mirai)", "value": "9b2b4f948f175b52d617217bbb5209993e65b4bebf3d166740b8139c6e4791aac847c6c29f26fde207603ef5a55bc758", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330121, "uuid": "154a5985-fb6b-418e-a507-8547048d2276", "value": "T196E30A46F8814B12D5C111BAFE1E528E37131BB8E2DF72029D246F647B8A97F0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330121, "uuid": "5e6acca0-ae3b-4e32-96d6-0ca0851c1613", "value": "3072:yneaYC/fUau4JQXkDHTz9ai5oudNV0/4fLk:KevC/fNBQXeHTpaVC0/4fLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783330121, "uuid": "d5bf00ca-5cac-4773-885e-55484fc7aa1c", "value": 144124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783330121, "uuid": "37eb7fdb-e176-404c-9cd6-3a99fb249456", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330121, "uuid": "19a33812-4e9d-4aef-99d8-9cc248b40c49", "value": "main_arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e915b739-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783365268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365268, "uuid": "d381d856-ed69-4f8a-b077-a81a8bce1397", "comment": "Malware payload (Mirai)", "value": "4979bf9dd91f16d5447638ec5106df62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365268, "uuid": "1c9b77ff-73ce-4a89-a666-fb72ec922ec0", "comment": "Malware payload (Mirai)", "value": "277e1e7a41cdc47542136aee56cf6850cb940baf9f4d9d7250a1672b1771f204", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365268, "uuid": "680d2a37-38cf-48ae-ac84-757ad1a1cb65", "comment": "Malware payload (Mirai)", "value": "d64926edec35318a70bfe4f57631ba9bd247196b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365268, "uuid": "1da4a441-34d4-43fa-b7d7-72cdb9e25992", "comment": "Malware payload (Mirai)", "value": "033827b4746173ecd3280b8d5624617d86fbbaaedc6a7b00aa87ae386601bb361f0a5fdb408b4efab5741e03f76ff7cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365268, "uuid": "71729cd3-f58f-40f6-a3dc-e5010c1d4fa7", "value": "T15653C605FB511FF7DCABCD3746AD1B0134CC695A22E9AB367234C868B50B25B1AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365268, "uuid": "5743ff5e-f888-49e8-b2c0-128c5e74c0ef", "value": "768:CpT92U1MMcsX9FUdKhVGOeazleJx7oh84XCZKydXiuS9mJrfw:qT92U1MM5//7zl+x7oh84yZKyKB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783365268, "uuid": "7b56ffbe-1017-486f-822a-080bc69b5730", "value": 64252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783365268, "uuid": "95e89e9c-4e1f-4f27-a3fb-fde6782960e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365268, "uuid": "47eda07b-4fdf-470e-b079-c366cfff73d2", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f827c38-7921-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NetSupport)", "timestamp": 1783331940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331940, "uuid": "ff3ca648-0ac6-44ad-b953-35664db37eb8", "comment": "Malware payload (NetSupport)", "value": "91d417cc5ad3f901802c3d67c588ad39", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331940, "uuid": "54f8e466-df6c-47e0-afd3-0635b28ff732", "comment": "Malware payload (NetSupport)", "value": "27c86c87121dad687db0a1f817fe70b341349e43af9b8ec01a74dc29364af988", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331940, "uuid": "7b64250c-6f3b-4bea-84a1-25344cec9a4f", "comment": "Malware payload (NetSupport)", "value": "0813085bc09d7aba0c924549391eb1bf4ff0e0db", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331940, "uuid": "daac23cb-3172-408f-9c46-86b5f2b7e4d7", "comment": "Malware payload (NetSupport)", "value": "c2def5d8434aa9e69a745492c53dd262bb8fd58cffa27a0b45bb5240c58432825a0f81b899879c36e2868c462bd68ce5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331940, "uuid": "325b2970-6f35-470d-8bed-1bdc8e9b4c2f", "value": "T12CF63321E4E3F909C19EC4B1524AC32794FD9C6C312A11226E22F7EE66F368E67537D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331940, "uuid": "5104ca66-9005-4972-b5cf-5785acb6b38a", "value": "393216:ryMPDocHsOWjGqNXgx+QRFuaBB5DJN387TLJB9m0LbDVlLO4:rNoKRWjG5xvDukPJRU5m073", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783331940, "uuid": "c4b72e1f-60e4-4f1b-8ede-6584fe25c1c3", "value": 16539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783331940, "uuid": "7a0b8010-ca1d-4e0f-abac-3ae3133b3745", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331940, "uuid": "7475d327-4c52-4ce0-8ce1-1b1e0d5bc48a", "value": "rufus-4.15.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba730108-7908-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783321381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321381, "uuid": "42784740-d45e-4aca-a4fd-f7fd75035a85", "comment": "Malware payload", "value": "e224572993529637b6af47a231bf5295", "object_relation": "md5", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "hoteljune2026-blogspot-com", "colour": "#3B4D50", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321381, "uuid": "29b77a0b-ea64-4d1f-b902-c959ff444d84", "comment": "Malware payload", "value": "28da307c640b70761f56bf08c3469829ad866ce1159f1ab340c6f640cd356e93", "object_relation": "sha256", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "hoteljune2026-blogspot-com", "colour": "#3B4D50", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321381, "uuid": "28de70de-a32c-4ac1-8e96-278fdd3bcbe6", "comment": "Malware payload", "value": "4722b745c9aa2b15e3a8750a4f45e22f5a92c4cd", "object_relation": "sha1", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "hoteljune2026-blogspot-com", "colour": "#3B4D50", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321381, "uuid": "0217a61b-4218-4b4f-8470-f2a4af89a572", "comment": "Malware payload", "value": "90b7a2f5cce884c451c5f45e73f80b1c5cc0e83fb3582e815b03591c405150926243442486a01173c875da62c9ef619e", "object_relation": "sha3-384", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "hoteljune2026-blogspot-com", "colour": "#3B4D50", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321381, "uuid": "e587a39e-56a7-4d95-a549-03fcf4f1e48f", "value": "T1B78187613D6BD8E6C7E68058C4C67440DFAC100B99AA2844FADF92D09B8B53DD3EA25C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321381, "uuid": "49795744-1f11-46b7-9ea3-251e3318fa7e", "value": "96:LyiZQgjgK7DqBj08F3iyMRI2s4A1ziMzdi/xOfECkIK/a:+WQgjgK7D2089iySI26pNzdisfEC/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783321381, "uuid": "4d0c1dfe-bece-4662-95b4-606bb5732377", "value": 3846, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783321381, "uuid": "8a1e69ad-ae7c-430d-a4e7-8e8e0e70207b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321381, "uuid": "d437755a-f8fa-4b02-8c57-1928d4af9c85", "value": "28da307c640b70761f56bf08c3469829ad866ce1159f1ab340c6f640cd356e93.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6572413e-7977-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783368913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783368913, "uuid": "305898d7-7f4d-4843-b4a3-2f6100390df3", "comment": "Malware payload", "value": "68eafb9dddd7562e46a0e30c9593848e", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783368913, "uuid": "e7f1a44a-6fcf-435d-8166-275a7294b3af", "comment": "Malware payload", "value": "29e90df3f89e343059d0925b933b09237457401a1a1278fb1275fa3c5c80ef29", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783368913, "uuid": "01c7b612-0e33-4d9e-8077-fb7c2f7a5b52", "comment": "Malware payload", "value": "181e08e7771394902aa70fe29c481d030783bdbe", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783368913, "uuid": "738d3e29-a006-4a76-aa83-ba99db45da09", "comment": "Malware payload", "value": "3536b701dfa5b1ffe8eb210450801f3ecec099f7807c15a9df3d6af3ef7a6762c1b66408ead998d27861cab476e8b175", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783368913, "uuid": "3e740c0e-f1a1-4135-bb5b-baa8163d5d89", "value": "T18F524ACE33D040F5D8BAA274C876B51BE3B1BC5A2655970F877842A72F23A63660F351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783368913, "uuid": "ccf3b5b7-22fa-47ca-a969-ca4654463157", "value": "384:5tutOLIhxmaDNKfly0l8+UqlC57GXOK5A9Sf4EEdMTfT:2OLgYfly/+lAFK5AUf4JMTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783368913, "uuid": "fe30c7a7-01e8-4d8a-a66f-ba73d75ac676", "value": 14336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783368913, "uuid": "08a2bb78-82c3-49a2-b81e-763ad794a494", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783368913, "uuid": "9d4d99fe-9de3-42a5-8b0e-4c5076706ce4", "value": "29e90df3f89e343059d0925b933b09237457401a1a1278fb1275fa3c5c80ef29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d856c7d2-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783365240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365240, "uuid": "0319bbda-1f17-48a7-9ee5-df589410b70d", "comment": "Malware payload (Mirai)", "value": "af3df0763365b756a3455222bf0cb93f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365240, "uuid": "fee9080f-4c7b-4257-acee-1afad3b109ef", "comment": "Malware payload (Mirai)", "value": "2b9fa53f8372c4413775650e9383d4f552aab63ffe298c21186674c3a4527f7e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365240, "uuid": "43354a59-ca36-4569-8133-ba638021c098", "comment": "Malware payload (Mirai)", "value": "70b635d8269a31dd1cbb1cdbe9574455e614ff1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365240, "uuid": "32b9b4aa-2f2e-4cdf-8d4a-254466af44fc", "comment": "Malware payload (Mirai)", "value": "a82baf8b18153211ceb8fa528c3fa410af5c2f61889420baaa04aed7d4c508f19628f683cb967e3d4d5a541382be0e97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365240, "uuid": "a6aa09f5-59d3-498d-85a1-2e69262fe8df", "value": "T163C32A46FB414B13C4D61779BAEF42453322E790A3DB730699286FB43F8679B4E23906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365240, "uuid": "ee029536-4841-41bd-98da-ef0ad72f92db", "value": "3072:V+iATXVHT+nK4UrNaxnlR+39WM/9lk1Yj:V+iA5T+nK4Upa3R+3AM/9cYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783365240, "uuid": "07df7c70-4b79-4ef3-ad14-9c169bc383a7", "value": 123722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783365240, "uuid": "4c96d087-c0bb-438f-8d7d-fc5205c0fd93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365240, "uuid": "a948c918-9f8e-44c1-b420-10df420dd9f3", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c19307-791f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783331297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331297, "uuid": "ddcec778-79f4-4146-8c35-8fb0c2b76b6b", "comment": "Malware payload", "value": "619e05a23825c5e4e147dd07a1ab4913", "object_relation": "md5", "Tag": [ { "name": "192-142-51-51--18080", "colour": "#2484F7", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331297, "uuid": "e74f33d3-fc53-4b57-9b69-f19f302bf47c", "comment": "Malware payload", "value": "2e957ee476a88c09fba84b1efe9dd3875e2e015961320b7e1ef72dc1d2477838", "object_relation": "sha256", "Tag": [ { "name": "192-142-51-51--18080", "colour": "#2484F7", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331297, "uuid": "fba3e3e9-4aef-4382-9fa5-e49018313f90", "comment": "Malware payload", "value": "150c56b976b3a77dd320b61e1d6ed92a7c19a5c7", "object_relation": "sha1", "Tag": [ { "name": "192-142-51-51--18080", "colour": "#2484F7", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331297, "uuid": "8cd3b155-5752-4603-9275-5eeba725d927", "comment": "Malware payload", "value": "936c2fe5f724f0e25be870650eed318bdaa68282f523ff35de3ef0c0c41a9c93fd89a174062ceb1e573fe14fb2bbe71c", "object_relation": "sha3-384", "Tag": [ { "name": "192-142-51-51--18080", "colour": "#2484F7", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331297, "uuid": "42420eac-d9ed-40a5-bbef-9733fad90cec", "value": "T171564953EC9555E9C0EAA23086729253BB717C496B3123D33B90F7392F76BD0AA79340", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331297, "uuid": "13c5dba4-07c3-4c79-b8da-2b76346592b5", "value": "49152:lhZ+Y/WdGmRnczhyxM9IwDvk+HTcSZ+qHB1yzcnlzL6MV4cF8y3LQ/hwPKOKDKB/:lhnuJwFHBTB4wP197cM9REU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783331297, "uuid": "37c34138-8805-4002-bf46-71fe36c4a41b", "value": 6062228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783331297, "uuid": "52868f6c-ba4f-4d3e-887c-dc5204557bb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331297, "uuid": "96300046-df02-49af-a70d-7270f0a8c787", "value": "beacon_linux_amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3171db4a-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783364960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364960, "uuid": "fc64f7f9-36f9-4c75-b4ef-720de7f43d24", "comment": "Malware payload (Mirai)", "value": "dbecbd8d7c12cb97233d0856eb8553fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364960, "uuid": "f1a95c37-951e-4d28-b87b-da46a62fb1df", "comment": "Malware payload (Mirai)", "value": "2fab0ae2bcb1f7d031ae3e6112c82532e2f1b1b3999c462d58f2e599f681a2b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364960, "uuid": "440c20de-979e-4aa6-9a0f-afd1578e72a5", "comment": "Malware payload (Mirai)", "value": "0cdd3e3eb128cc51e1de4f22374be58bc4b38e0f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364960, "uuid": "1835ef69-b28e-426c-836c-2dd8a6532c4e", "comment": "Malware payload (Mirai)", "value": "f074ad4415a0bb4aa02f30be5fd0e5cdbdd5273fe8adaa53534fc3d3b5eef07edb3ed8a2c091857acfb257b07afaa4ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364960, "uuid": "3d37b094-4bcc-4264-b794-0ca09769a84f", "value": "T17092E0A5AE5BB88AD1EAAB75112E7033B2A20593030DCFD9B3AC62D5F0C1017857DF5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364960, "uuid": "c0c75f64-6f75-49e4-9e4e-b9a78ad5808d", "value": "384:MX8FoU1J/5eCVxNUa2HL//KTdq9qGOgy/0Cpe4+v1RFp:tFl1J/XVxqVr//eoOBVsFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364960, "uuid": "1e712f46-b8fc-45a7-8722-ff89859e3487", "value": 20452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364960, "uuid": "a21745d9-e9f2-4ca9-90c3-17e5617744bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364960, "uuid": "ef39e430-6a00-4d47-945b-daf7cedf6bd5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35de0264-7909-11f1-ac1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783321589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321589, "uuid": "ae12cdd5-176d-4ed2-9940-efebac7b5aa9", "comment": "Malware payload (XWorm)", "value": "21d4c35427d4263cc00eaee312f3525b", "object_relation": "md5", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321589, "uuid": "4693f5bd-9e21-44d0-ae2e-bee6e98307b2", "comment": "Malware payload (XWorm)", "value": "30bb8c480731c16e49a2b8ad59b17ab924a6c1e3c8062c615b4f237b1e4acacf", "object_relation": "sha256", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321589, "uuid": "503faf82-65d2-4e09-9fb8-45e70370452f", "comment": "Malware payload (XWorm)", "value": "b3bb57393c23b1c4e7baab70803abee4881b314b", "object_relation": "sha1", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321589, "uuid": "0c4027c3-7f8d-448f-90d5-38dc46420e44", "comment": "Malware payload (XWorm)", "value": "6f84d1d68021fe688aae5de2cc72922780c41e57bbc9f46777016f10f4248f4921fa9f6f69e1cf657d268f6573bd6aeb", "object_relation": "sha3-384", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321589, "uuid": "1772e2d3-a0f2-4293-b298-27596c24a994", "value": "T17562F78A7F43EDF003A537E69DDA10B6DC24B45628251845C6EFF3B125353826C26AFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321589, "uuid": "43e03f41-8b7f-4860-a731-b4c071a391ca", "value": "384:CmREtiWxQAeZ3lSW7c1jFQAybwka0UoV86wWBuArHlQUYey:C5tiWxQAeplURQAybXKoOKuADCUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783321589, "uuid": "007fc918-35f3-4ee3-a765-e87abc754d6d", "value": 15192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783321589, "uuid": "844e1788-9216-45fa-9d34-e6af0a86584d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321589, "uuid": "f667789d-faed-403b-a829-d3ae40977db4", "value": "30bb8c480731c16e49a2b8ad59b17ab924a6c1e3c8062c615b4f237b1e4acacf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364d7e8f-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783364968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364968, "uuid": "aa518ea5-1df3-4668-9832-b1c733ee0dcf", "comment": "Malware payload (Mirai)", "value": "1dd36b1119fe822a48650802beaf3702", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364968, "uuid": "85e8eaab-fc9a-403c-9507-4b6d39baa39c", "comment": "Malware payload (Mirai)", "value": "329a84a476ebb1c17958dacf6a19488150038b955f8b66a0c241748626c75b89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364968, "uuid": "529c37a5-8007-47b6-9455-fe75a64b23c7", "comment": "Malware payload (Mirai)", "value": "4cfe81da194bd51e4bd4a5742c08fac046424db9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364968, "uuid": "c13b506c-9972-4fd3-94c5-88bdf6ff8456", "comment": "Malware payload (Mirai)", "value": "d7f910a0954d2b29aacea7e2e4c2f64d04cac0fc923e3b38f2016f32977d5989936df50dcdd81cb6b27a849bf94d47d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364968, "uuid": "9f921ac3-107b-4a81-940d-2edfbd5a9eb6", "value": "T1DF82CF74A51A14F1C3B1CE37FA2DC99636C38EBD11DB32723294226256A74C63AB47C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364968, "uuid": "493522db-7121-4fb2-95e3-3c2de2d69571", "value": "384:fg6WkVgGBj1fl6jXS52uJau1dGtNXyTIebBzWhymdGUop5hI9:YigGB5tuVuJl4NidNWs3Uoza9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364968, "uuid": "8292e752-0b3e-4354-b523-8a86e50fb77c", "value": 17636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364968, "uuid": "404cc0ac-984e-4660-abd6-456bf6351fff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364968, "uuid": "ebfcb663-f383-4c7c-b4ba-309f78b6d041", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f500cbcd-7949-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783349397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349397, "uuid": "62768f37-9610-4edc-a9f0-6ce687d89387", "comment": "Malware payload", "value": "affbf800afd1c8d74f20441fd95554b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "windefnot", "colour": "#D287BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349397, "uuid": "49f85ea5-13d7-4336-b152-851f06cc357d", "comment": "Malware payload", "value": "32fe3fc3bf693e2239d804c715ff3da09bae962ec2445956a2a6dace69ceb7ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "windefnot", "colour": "#D287BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349397, "uuid": "84712ebf-7629-48a2-b0b5-440e44e0e1fa", "comment": "Malware payload", "value": "2a5ce45f76fcfa5c74dc042b5226e3ac2d8826e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "windefnot", "colour": "#D287BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349397, "uuid": "3056baff-6e1a-413d-962e-29d9fd23b75a", "comment": "Malware payload", "value": "db88a09e2654e307300af706d1286a849df190477c575d4a069b68b9b4860838452b2aeb9c8d2d6e163ce73b005ae4cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "windefnot", "colour": "#D287BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349397, "uuid": "50febf2a-0e27-4b63-bd74-251b0939f3cd", "value": "T1AAC34A5BB2E941BBE037C27C84934A05EBB6B8210770ABEF076406562F177E48D3DB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349397, "uuid": "68c6fa1d-5a9d-4234-96fc-84d62b33dc1c", "value": "9b6fabfb85b2114464d9f0c54ba97a02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349397, "uuid": "a6c1f9c5-cc7b-4111-9e5b-49807f2b9ed0", "value": "3072:zuMpC/odwwoO+sl7BiyFvMIGznD3Hd7Wo8PTG60:z/CHwoO+K7BibIGznzA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783349397, "uuid": "d537eae6-1524-449b-8489-e2de99f57dc7", "value": 120320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783349397, "uuid": "17a67c45-b36b-408e-a238-f4d195292296", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349397, "uuid": "7348938b-d425-408c-bacc-f3353360ab62", "value": "windef_com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5863b4-7948-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783348924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348924, "uuid": "87ad2b19-12bb-405b-9868-40cb54097978", "comment": "Malware payload (Mirai)", "value": "6a5ff50c426296c900b30ccd6da5f554", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348924, "uuid": "0fec1e25-0ef8-424b-85da-594c707b4213", "comment": "Malware payload (Mirai)", "value": "3328f56e085f13f5ab448c0f5f40c0fa52e722468ddd05370f1f807d64093ad7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348924, "uuid": "0fac07c0-c3d7-4752-a213-0bff83850aad", "comment": "Malware payload (Mirai)", "value": "063b33b3f9b05f3b06256a73f9f16823125be479", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348924, "uuid": "80aaab55-ce9c-4c15-96b2-e8468cf87b07", "comment": "Malware payload (Mirai)", "value": "45bdfedbc8765abde960f9f5c649ec08a6c8fffd2a9ef4b4f9a6f792e20fc3f9e490c4686b7958ed7974d03375b5e8f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348924, "uuid": "e7219d50-6863-464a-b4ef-e0723f6f74ca", "value": "T10BC35BB3C825AF98C555D0B8B0708FB95F53AA1481874FBE15B7C27A8043D8DF64A3B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348924, "uuid": "a7783078-79d4-4b1f-8590-b4869fa5430d", "value": "1536:DGUh/fveE6Z3KB4bJeQIk1CjDkKm9UkKa28qZ6gKW1G3kDmBB:DGIXve62V6k1+/mf28qRKWY3kC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348924, "uuid": "aa51a5ae-9adf-410b-a00a-5cdcd57fc9de", "value": 121664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348924, "uuid": "adf63fce-2fe4-4bb0-af9d-41c78457f717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348924, "uuid": "82f7a00b-2860-445d-9f9a-b0351055b1e5", "value": "atomic.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1691729c-7949-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783349024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349024, "uuid": "698cecc7-c905-4b35-9851-6c13eead6283", "comment": "Malware payload (Mirai)", "value": "30194799ce5c86602ee8b6e133b1077c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349024, "uuid": "bb3918ad-19c5-4506-bc64-0b714bd144ee", "comment": "Malware payload (Mirai)", "value": "337d6fb5cb3633c4b905906f4c743fbf6078f421d74f77c11c344965ed8e94ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349024, "uuid": "6900184c-023c-46d3-bb65-feb78823002c", "comment": "Malware payload (Mirai)", "value": "3ce714d8b2475d4a3222e079babbb639f0671291", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349024, "uuid": "826bd7ec-7b93-4ff2-8184-b6b1a4c52943", "comment": "Malware payload (Mirai)", "value": "1bba36edea49311f0a81a606f7bc7695c3fba978db46074201c6e4abad5142a19a221466aab155799dcf4782a5849eea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349024, "uuid": "b9dc50b2-1ba7-4f6e-b071-149ac6ea6522", "value": "T183D33B06731C0A47D1632EF43A3F27E0D3EF9A8121E4F644655FAB8A9271D361586ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349024, "uuid": "513563ae-25b1-4ab4-a452-ff4ed6cb05a4", "value": "1536:TsgHJadEn5SBbQfBBkkpxfsfM3mGUO7OEn2WB9YFRvAkW6K8KQsnGqz3Ikw8:T52kfHkkpx33862WjYckF98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783349024, "uuid": "7a5e6c4c-5545-4c76-8177-9f20c84d7b16", "value": 138132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783349024, "uuid": "c71d344d-725d-4947-909d-f792347673a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349024, "uuid": "c908e819-3c7e-40d0-97ad-bf02e0e610c8", "value": "atomic.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86e9b8a-7948-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783348920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348920, "uuid": "2d77f0c7-cbf8-452c-b5cc-86b3875d3785", "comment": "Malware payload (Mirai)", "value": "69d88782028d30fe923a3529e4b322a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348920, "uuid": "6f6d8979-7e42-4949-8d45-b0a963a66027", "comment": "Malware payload (Mirai)", "value": "33a014823af4c7ddb7cae13c4ff7f6d970057f63c037441c86359d92ccb6b6cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348920, "uuid": "cd9ee1b6-d3a1-4453-b1fe-0b6f9106a854", "comment": "Malware payload (Mirai)", "value": "831cf38eea8695adeac8b9d9419ad5396ac96545", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348920, "uuid": "ca0086ae-ea55-4707-8bc8-e4e01adc6cd1", "comment": "Malware payload (Mirai)", "value": "da707df44a46996cd749ad35fb25cb2439aecc3b167803c9d52f64f356bf1ae9b0f11376fcf5317b0c69f5a15f968913", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348920, "uuid": "6047b61c-3c6a-4479-b3db-314ed756ae0f", "value": "T1DD13E11476C02A58C35F82B75DDF3A471E3490A1D2D28CF8BA86591EBCB1F3452B8797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348920, "uuid": "e5ddc1f9-baf4-47bb-a8ea-8183ce820f1c", "value": "768:V4sJXREyPZBUuL+GHSq/0wmleL14yashAr/nMnbcuyD7UtQRjh:V4sNRE6EuLXHSKmlI5xur/nMnouy8tyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348920, "uuid": "7c5e79b8-af0b-4530-b1e4-4cbb5603cea5", "value": 41876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348920, "uuid": "629422f3-d6d7-497e-8346-fc198d6e4dc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348920, "uuid": "2778c3b8-7f3b-4751-87f9-9e34b7cd6862", "value": "atomic.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b84bf8-7948-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783348918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348918, "uuid": "44eadc9c-c2da-47da-89f3-165b8b78cb84", "comment": "Malware payload (Mirai)", "value": "660ed7c15176fe5720e03d06f1d7878a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348918, "uuid": "362ca6ab-f672-4481-84b7-a3ec3c5fd560", "comment": "Malware payload (Mirai)", "value": "33f82b1f0dab96b6585ce88f2fc3d767a865515314a8ac1e1af842b0a60c6165", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348918, "uuid": "7b96cfee-74a8-469a-989d-a3520580c207", "comment": "Malware payload (Mirai)", "value": "b9439b0ab1c03ed1b2dfa28e114e8cf004931758", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348918, "uuid": "4691f65a-4006-4304-ac3e-b6b8c561cb56", "comment": "Malware payload (Mirai)", "value": "406a8b463dcbffa07a6892b1bc5e3c5ce70b7c23f8e08c7450a8aa60bb93b8d53770010122bdcd652900f69b30a05ba6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348918, "uuid": "2ae6298a-3fcc-4f9d-bfd9-4bd0c6076ad2", "value": "T10543F1993E0110FDE943E7FA04B2C7912E738BD642466C9430958EE39EF556D24633DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348918, "uuid": "7698fc6a-004f-41ec-b707-df5e00de4035", "value": "768:8YqYhELv9ZeTrUyOuIxlhD5U57lVBEaakZp9He/7IBopQopvZ8TIrP/uJgGlzDpu:8ehELmX5RiYVSazpVgLF7yVJuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348918, "uuid": "cc4b7c83-b4e2-477d-bc5f-0f515bee975b", "value": 55316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348918, "uuid": "7741a00f-b601-402d-82e0-78e9a2a11806", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348918, "uuid": "9ebc29f9-1455-4fbc-868a-d1cde14cd9ff", "value": "atomic.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f459c0c2-7929-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783335652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335652, "uuid": "f2fc6b79-4f1d-41be-bd37-937ada260f57", "comment": "Malware payload (Mirai)", "value": "d1e53fb1ceeb4c900fc4650b8f1e68db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335652, "uuid": "594e44a0-ea11-4e1d-ab20-dc2ae554c409", "comment": "Malware payload (Mirai)", "value": "376004bdf57e17122b9bb61c057e81a15292292737d754c43dc15d81b10fd5e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335652, "uuid": "0a8b68c9-ae7d-4afc-ae08-58c3c479e2c1", "comment": "Malware payload (Mirai)", "value": "43ad5aff15ed2dc42f1264ea3a6ffe9608fb78a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335652, "uuid": "f930c2b6-8d2a-4d1f-9998-1dd6b43f2b02", "comment": "Malware payload (Mirai)", "value": "729025c467b0561a444cfcf07c685d9a66d710dc57ae9393a3f9b5d08f0cd887ae260fb815f72800cef627e94a4698c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335652, "uuid": "e9b74201-9103-4236-9c81-6523a628c7fb", "value": "T163256D5AF2B370FCD027D030439BDB62A83AF47501216E7B65C4DA352D66EA01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335652, "uuid": "65731513-9232-4b48-802f-912c72153a60", "value": "12288:+Z+iQJzYALzjf51mXryImU5vEXEWWmy9x4++L975k:+Z+iQJvzjfbMrHmScXlN+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783335652, "uuid": "2eb01ca8-c8f1-4b25-963b-cef5176a2d5b", "value": 1033120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783335652, "uuid": "addbd0ab-9540-40cf-a5f9-d7c33258b27e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335652, "uuid": "1b09ef64-5d07-471e-b199-cbab47fed8f9", "value": "376004bdf57e17122b9bb61c057e81a15292292737d754c43dc15d81b10fd5e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cf1e2c6-7920-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1783331398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331398, "uuid": "e77ade8c-ed80-44aa-b974-8ffdff116847", "comment": "Malware payload (AsyncRAT)", "value": "5053320a66a5c4989c44a932a8720b7d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331398, "uuid": "6eba3e5d-8971-40c8-b65b-a9196eb7c786", "comment": "Malware payload (AsyncRAT)", "value": "37f7127bcae8388c61432dc2d46b0df36cb33690ebbc5b725b28b33dfb145d4b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331398, "uuid": "46f42d7a-7c72-4165-bd1c-c8d11f3d3b09", "comment": "Malware payload (AsyncRAT)", "value": "f63c54193c17199031d7826b5ad0660db4ffb6e5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331398, "uuid": "a0a442dd-38de-47dc-9398-1fd06b0a9f83", "comment": "Malware payload (AsyncRAT)", "value": "52fd944a9984ed5431945c28e78d0ac734c54a933d5ced586775a30413e5c1d81b7e42d3cc9bcd58bfbaa96528ea002a", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331398, "uuid": "a9c0d4fb-5ea3-4a64-a642-4a1698593c4e", "value": "T1E3050168675DE801C8210735ADB4E6BC16693E6DBA11D3171FECBEEFB9367168C40382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331398, "uuid": "f7ba68f1-4383-4e14-a99a-49d6500e1fac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331398, "uuid": "91d6df39-eb6c-44a9-b82d-e5e9b3e18d63", "value": "24576:DRvV0Ldy2hY+QY/4WeSGQ2LRXv2QEfP5HVLotL9p:DRN0LY2O+QYESH29/bEJdoD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783331398, "uuid": "7fc16ca6-5919-4618-8f64-968f7930d904", "value": 852992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783331398, "uuid": "1cb249f1-49c1-4a66-b091-2cd4f5eda96e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331398, "uuid": "b16742c3-c4c9-4449-b3c2-fc910073d2b7", "value": "Contract9021_06_07_26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57f0e2fc-78d2-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783298023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783298023, "uuid": "abbfce81-0285-411d-8956-0e7db1688408", "comment": "Malware payload", "value": "09000f389ac0975e6e5ee1f31193686e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783298023, "uuid": "4a1a54ee-8e28-44c0-a130-666702ba5c67", "comment": "Malware payload", "value": "3888f2bd1f97dcb4df53c622479010be225d60a3dd9e5daef67e5c78fcbdd520", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783298023, "uuid": "a397e1d3-ed7a-4c18-b3a5-9f4326995f1c", "comment": "Malware payload", "value": "7a7da154c9a7722296d321aa65ae5fcd0af5cd2a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783298023, "uuid": "99945e14-ecd1-4522-ae40-158bdd3e180e", "comment": "Malware payload", "value": "ddec158b33fc84fea0ab645c9fb835f36166986cbb523f65c4a878b0c8af74a4f3196a2921d4a93a5e7ac2e88a653177", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783298023, "uuid": "bc9a4097-7106-49d9-a12b-1fba7fc5cae4", "value": "T112D097A2B12301B110565D64F2C2B8A0F50487BE8EBC990ABA0334B09F09B09F8D2A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783298023, "uuid": "13b9289e-55d8-494c-a970-29d925b66cb7", "value": "3:TKH4vLYzMOhxFhpEC13Vom4qQ9hqn1icsFZAutDMFsMLONFYqGSrP/c5c/DOOdK5:hT0Fh6lTasAulNXYq9DG+NjVsNXYrkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783298023, "uuid": "906b2423-318e-4e30-ae3b-f3ec5b9cdc1f", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783298023, "uuid": "463b242f-5754-4863-8bb0-3c21e05d0f02", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783298023, "uuid": "13b94357-ed93-452a-8e72-e579669a3fb5", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da81475b-7914-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783326589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326589, "uuid": "6a9cf8fd-6f7a-442b-a659-90e112d686d2", "comment": "Malware payload", "value": "8103c315d26f07e30cb3d5f09ad37e19", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326589, "uuid": "71f66faa-ad33-4d6a-9898-a2e29befabe8", "comment": "Malware payload", "value": "39b5ef87707d3a0078d583fb1fc0597818c700ee7635caa321136e18ba027b57", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326589, "uuid": "f2ecbb9b-8670-4085-bc71-fc42c978d906", "comment": "Malware payload", "value": "aa7f72cfdfdaa070c56946c1fde1b556b6aae6de", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326589, "uuid": "924be3bd-eca6-4640-91cd-f2e81eceb0e9", "comment": "Malware payload", "value": "0e92bd06f4106a13721013eeacb16bcd91274cd8fc19805dde7b79f48e4e4f25c70211303a857bf91adfeb5515a34245", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326589, "uuid": "9ddb5368-ef12-48f2-a4bb-433ae4a68d59", "value": "T18F54B81137E94A16F6B79F354DE25257AA32FC81EF22C78F3180730E1DB19809962B67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326589, "uuid": "4711bf75-c21e-4848-8eda-5491f3d4c507", "value": "6144:oOYtyk1fws1ZxEtjPOtioVjDGUU1qfDlavx+W2QnA2n:HY0k1fws1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783326589, "uuid": "04a9b636-9b2f-45bb-814f-b05863b08bfc", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783326589, "uuid": "7b915f14-ae65-486e-9a93-31eb6ba8716e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326589, "uuid": "39995b9f-4905-42eb-9ece-a3c4a24cc20a", "value": "REC Bid format.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da9b4fa9-7948-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783348923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348923, "uuid": "543278c5-64e6-4683-ad5b-cf66154d3a69", "comment": "Malware payload (Mirai)", "value": "ec081b98280a56f09620abe79767c60c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348923, "uuid": "32659469-dd41-4ab9-90c4-d9298af8dc78", "comment": "Malware payload (Mirai)", "value": "3a001971474671191d29b01c31253f17ceebe522bf6dfca76d0f9bf81ca89a96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348923, "uuid": "ba2dec05-b976-4030-a785-edab55477ceb", "comment": "Malware payload (Mirai)", "value": "c9e831c913634381e9a475373f26d9d3c22fb94d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348923, "uuid": "dfce3285-a249-42e2-aea0-d0f6db5aaf18", "comment": "Malware payload (Mirai)", "value": "29c91831aa3adfe12de844bb9df1b0aa16755722acf4e9aa53100a8b08e2975ee7229a434cc3246a01eb1dd488216d93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348923, "uuid": "db28d83d-cb11-4e1f-a367-44fc2f87ed05", "value": "T1FE330194E61D488DDFAE7AF41E26E7C736C36F3633AA0570A195FF135514283A962C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348923, "uuid": "238d612f-732e-47a7-bfae-1d6f3af3a5de", "value": "1536:raLifIkscLMkt87rjJMZTQaXxg2b44u+qgw0+2:DIQLAPeZTQ8tE4u+qgwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348923, "uuid": "ec1cf332-766a-4e12-9309-284009a9b499", "value": 50304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348923, "uuid": "eb5d31e8-2bbb-4eb8-850b-b2988cb5019c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348923, "uuid": "7dd349c1-0248-42aa-a13e-1d2950e17bd7", "value": "atomic.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3320b90-7914-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783326604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326604, "uuid": "b4f5380a-c0d8-4d0b-84fa-a59504dfcf25", "comment": "Malware payload", "value": "83a58050b223c84fb5b73ae99e64cd95", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326604, "uuid": "c78a5dc5-5376-44dd-9b83-124b2c15b9e1", "comment": "Malware payload", "value": "3a17bb28cc14e337caeb125f002bbf85d4ee7e49f3cb7a1da5c66be96c1b5505", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326604, "uuid": "678138cc-a6e4-47e6-8253-91c6a1f7e788", "comment": "Malware payload", "value": "6706717d65da99366bf2690185f670bd56070ea6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326604, "uuid": "554e7797-9554-4a87-8289-b7df44dd2f8a", "comment": "Malware payload", "value": "5c7bea92dba4f9e894befb89ad6656dedba07f1e14d39a4c24fa47c6469fc8dd05ca11208b4a3653a1be2d07a3e651eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326604, "uuid": "24cd821f-2d56-4203-9298-38e94c11f81b", "value": "T1B23421932306EA78E3CD0AA2FD0B1915A1F8C815F99F9149BBB1ADD7775B9801434FC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326604, "uuid": "942ed86c-4634-48d5-aff3-47bcb2ff5bdf", "value": "6144:v7c6cibvpOeWaoHK2k59PDS22/qgLAlchVG0WWH1ieoR2Z4HG:v75DXe/MKN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783326604, "uuid": "2f1cdca1-bb0d-4971-9bcd-fdb67c9af94d", "value": 247132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783326604, "uuid": "6db99b57-3e30-4024-bbd4-a089de32c3bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326604, "uuid": "de916d86-d191-4ea6-a662-7ec9729ebe73", "value": "Office_Release_Daily_468.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "195a645c-791a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1783328842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328842, "uuid": "18051f93-fb9b-4f63-96fb-a1734f03adb9", "comment": "Malware payload (AsyncRAT)", "value": "1c7f26661343a771c692dee9c2233830", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328842, "uuid": "ab459a3b-3e7a-4e42-9cfb-53c6c2ec32e3", "comment": "Malware payload (AsyncRAT)", "value": "3a69743c2e6248b3cfd9ed4b1f24d411aba3a5dc7cd2b787e23e0a77094bfc19", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328842, "uuid": "d6aebd5b-7049-45fa-a49a-1de7742135f2", "comment": "Malware payload (AsyncRAT)", "value": "c80369f63f57eae5b7574c445093b2f5b1c90c5e", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328842, "uuid": "40f083c4-22f6-456b-8372-f16095f809db", "comment": "Malware payload (AsyncRAT)", "value": "d9bf189fc832878d09cac2a60a8690f3b907f56688b70e50ceb36d987392ba85f584d5efd935ad46b6a634c5abe2f79d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328842, "uuid": "5b28b649-f913-4823-b506-4b34db1ce75d", "value": "T13D05E0C03B65B716DDB41A359978EEB543B92D69B024F6E61EC93B8B396D7008D08F02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328842, "uuid": "e8d2bb21-2efc-4b38-b7d1-84e607cefbe8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328842, "uuid": "bf6a3383-100d-48ef-b53d-0bb5f73cb876", "value": "12288:6/PNVllXILuLmaV+u+Xy8IiEhmnGlNmtvbAzEiFFifXzOT:C/l0uFPAy8IiEYENmtvbdfXiT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783328842, "uuid": "05185337-11e5-4285-85b2-655357019c4d", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783328842, "uuid": "c87dc91c-9fbc-4fa4-bc58-7d35e51b51cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328842, "uuid": "f22db77c-5640-4b8a-8e53-f895265e940e", "value": "Product_Specification_Request 20260629.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49f8a850-794c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783350399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783350399, "uuid": "44a8edb1-0286-44a8-bdb4-202969e9abc0", "comment": "Malware payload (Mirai)", "value": "9eddca74d5ea0984055f4fed790b1c3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783350399, "uuid": "fc42f4ef-a94b-47dd-85f5-ff9a7134ec33", "comment": "Malware payload (Mirai)", "value": "3abad5c03cd186cc420fdf8b52a757cc2c6caef60d261b813a9cda39baab3977", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783350399, "uuid": "faf9637e-20cb-4ad5-a14b-2297e95abac6", "comment": "Malware payload (Mirai)", "value": "049939cd4efe136ae4675c5465ef5ae7cc57f354", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783350399, "uuid": "9dbc9180-a39c-4d12-9f8e-e00f2e93cb1c", "comment": "Malware payload (Mirai)", "value": "e36b38de457de82fdd719406fb4706eccab0515fc77ec8c6e9c71b4c680f94307dbe63aa592a0af81a6249cf9d0e01ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783350399, "uuid": "ebabd36d-4e9b-4e7d-a5d3-017c13bd47ea", "value": "T156A36DC1A683D4F3F81605716137E37B9772D03A112AEA97C7299D32ECD1A80DB2B25D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783350399, "uuid": "aaaaa156-c03d-43c9-bf4d-db5acfe5a7d3", "value": "3072:pK/dz3irMahZJjz32i0v5NMubjODaKCvX/yl:pK/93irphZJjzGi0I3Af/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783350399, "uuid": "dae1eb99-5ac3-44a4-8aa3-89a916176dd7", "value": 106508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783350399, "uuid": "4a7aafa2-29eb-4d22-9906-cf37f61c3414", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783350399, "uuid": "f228922e-af5d-4049-8b9a-756526e49f05", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84ca0623-795c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783357369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357369, "uuid": "cc8a2e8a-2d11-4732-bb37-de34fab5fe1e", "comment": "Malware payload", "value": "a99086e2d4dba9f741373bae9e897c94", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357369, "uuid": "87216462-0f40-435b-a7f1-ac672450d0ed", "comment": "Malware payload", "value": "3af2f2b356d0699d2fcebbe777a1558e36ce98e4952740f7de793de01cce1f84", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357369, "uuid": "47dd6ca6-11be-4d67-a88a-e5deb649c590", "comment": "Malware payload", "value": "af7eb6c594f212be514f5c55f99a140d0d532e3d", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357369, "uuid": "45f0431d-ea44-4b8b-83bb-52c24905c72c", "comment": "Malware payload", "value": "bfc7664a28094599ce209d257996cac1cd78fc6f6ca28147fb774c1e585ee051fb6d9fa42ed9fbc597d5ca55a2acf40b", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357369, "uuid": "84f334b3-0be3-443d-9b79-c0ea124afe6f", "value": "T10E0833407BF9ECEBE8E1C0FD32249E4D4B6DA61517D3C51E02EA30D6C291895BA6CF94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357369, "uuid": "5ad2804b-9202-42b3-9bbb-78861b6fb0a4", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357369, "uuid": "30a46e5f-5d35-4930-8c31-4159a7062860", "value": "1572864:SIejOYf7lopqyblLJ9m7qQDqyBRQNc+Z5/0L0NYMcFWRfe8Obchm5r:SI4TgJeGtyzQzZO0NvKXbchYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783357369, "uuid": "b38be4c1-0d91-4a7a-a70c-028dbb0d062c", "value": 77161772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783357369, "uuid": "f164fa07-80e0-4467-8d10-26ef70268129", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357369, "uuid": "f76acdd6-f6d2-438e-9a50-48c25d675bfa", "value": "SpaceWars.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0ab8a1-7955-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783354212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783354212, "uuid": "6120fc45-4107-4290-a29a-388f027a41c7", "comment": "Malware payload", "value": "b52d381c2a92fec89f6a78232f36d58a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783354212, "uuid": "f80ce674-3334-4055-845a-c86c058129b8", "comment": "Malware payload", "value": "3b2466d82fa7901766556b9f64fc16440477a2791fb9df01ee9d9c7c4b016c06", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783354212, "uuid": "ffe69128-dcbf-414e-b01d-5ccd5a1d9540", "comment": "Malware payload", "value": "0bdaaae5bfcd7861bfdfd8faa8fea425bd60e9e5", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783354212, "uuid": "f0ee99c9-c0a3-466a-9ebf-c4f3974a07a8", "comment": "Malware payload", "value": "26a7c8a795d512042297b8e7a6bdbca6b06d71dfc42b9ba829dd11631ceb33b05e56d8ee6834a7472bde39ae351018ae", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783354212, "uuid": "64f81a91-4cec-468d-bd78-f380c0f2621f", "value": "T126623C0BB8818035EBE14474827F526645BDACB623D4F9CBF7E0A48A5EB46E1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783354212, "uuid": "7ae6aa26-e09a-435e-bf9c-fa8455d5ebe3", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783354212, "uuid": "7e93d57d-d9b1-4f36-9dd9-890261b8bb93", "value": "192:AWQsGnjXgjk8LMRAW4NJTMpJFeIFFBKUSf/zwsd1gJxTmv8U9cthB9ik:ANSMqYUl/Zyav8U9c7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783354212, "uuid": "5b095f4a-fd1c-4478-9d08-5bf8b9d64926", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783354212, "uuid": "ed16a46d-ae64-45f2-a2e4-14c051cd6885", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783354212, "uuid": "b2480b1d-90aa-4c32-ab66-8b278336c636", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4eed6c1-7914-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783326526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326526, "uuid": "0f7fca32-cd37-42dd-9e4b-638ac46453a9", "comment": "Malware payload", "value": "2c5cca48deffa38d05cdcc649e5d1fe5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326526, "uuid": "fe3a5a0f-5f75-4dc4-b7b2-a23757ae33b5", "comment": "Malware payload", "value": "3b631b3ce7a5971b30db4171b4c0bee3a61f14686edf1b26471d8143675d8c59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326526, "uuid": "eced9349-5e00-46b2-a2cc-f4ce5f084079", "comment": "Malware payload", "value": "d488ab1dcb0a53757fd746d2c376c42b815e96ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326526, "uuid": "df89d64a-2c0a-41fc-b477-63ce986bddbe", "comment": "Malware payload", "value": "17e019c21170323f59418cf6ec5d03f5e48f8bc59dd8f7a696e45f46657d3ec8489c7e429e996d1b939f63b1cecbc13a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326526, "uuid": "04ead611-52d7-436d-b43e-1957e43c58d2", "value": "T12F072211BBF28036C5971A308D1B97F96276BF154E249C977BD03F0E6F35A81F229286", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326526, "uuid": "a9a37ec9-341d-4882-9eac-c7ac8af92dc0", "value": "f8fe9f36c4c1307a10970d58ff3f640e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326526, "uuid": "e1226934-929b-4526-b8b5-9424d2df1a69", "value": "393216:ggsiC/2vCuoKibPhf9wQu8cAv/bFeHyIc9r6st5:gLwibPx9wteuyIErF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783326526, "uuid": "c52efba0-6310-46ad-bb92-89ddbc982dc3", "value": 18223500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783326526, "uuid": "a904113e-cab7-44d6-97c8-c27667cb26a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326526, "uuid": "7aaec544-4f04-4573-80c3-b78ec8191939", "value": "2c5cca48deffa38d05cdcc649e5d1fe5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76726e4-796c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783364380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364380, "uuid": "863accbd-92b7-4f2b-aa2e-7d82abd9eb97", "comment": "Malware payload", "value": "a5551ee32a3acb4d1546331749489006", "object_relation": "md5", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364380, "uuid": "144d0ddb-5714-4af5-a359-fdf3aa7756a3", "comment": "Malware payload", "value": "3c3912eb86c12e9f7a0b6d9770dcdd398964154e53b18ba144912a666bc423fb", "object_relation": "sha256", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364380, "uuid": "f7b0f1be-c082-4de8-ba6b-66ac897dc187", "comment": "Malware payload", "value": "6341150e6a1301bc16fcbb888c4b754171335d69", "object_relation": "sha1", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364380, "uuid": "6b26c382-ab96-43e3-93af-9e44ef3ad123", "comment": "Malware payload", "value": "6b0e3083f2b62c55be1799f333826ae5d6d743bce828ac5098e70ae66bce3a59f793feb94c760f0509c7a8d9e5993eaf", "object_relation": "sha3-384", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364380, "uuid": "e9f22412-7c99-474e-aec7-7c3c20582891", "value": "T1AFA012404A5063598BD3490D85C282B0493B30021311838935305104BC009D4C00A144", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364380, "uuid": "bc839f3c-5cea-4a0c-bdac-ad836ae8e438", "value": "3:VSJJFFSoM3KbQqPJH0cVERvhPPFLfgliXn:skR3KbQO0csPVglo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364380, "uuid": "10677152-b489-4258-8150-3d3d867d0ec0", "value": 86, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364380, "uuid": "cb15d30e-ab80-4995-ab53-ed5af62255a3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364380, "uuid": "aedcba36-5dda-4498-a01f-7fd53dc3fbdf", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02ad98a-7967-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783362247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783362247, "uuid": "bb1455c7-4253-4455-81c1-4b71258c565e", "comment": "Malware payload", "value": "689b2ae3d716e7f296d4964892be9f4e", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783362247, "uuid": "219424d9-f041-4b6c-9d98-4af2af28caff", "comment": "Malware payload", "value": "3cb8dadd0ea4ff4b70d3e9c9caa024fcf171a8434f42fc7e977e4f3a63b23594", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783362247, "uuid": "e1c0c2f5-6e98-4e05-bd62-3c8d765b5eb8", "comment": "Malware payload", "value": "08573a60fb23ae6ef63457a6b610cf1c143b5aaa", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783362247, "uuid": "c780d804-6ca8-4fc3-9ffa-109c77f85c77", "comment": "Malware payload", "value": "acfb794e1236d50cb1e4e4c8206ca94ce5ed4091dcc5d422a26ebd77e5ad0b6fdac1434dc890778e8d2d8dc3feb51dc6", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783362247, "uuid": "a9c2fa15-2174-4e3e-af3b-0ed6d7637d65", "value": "T12751EA212BF61314F3B38B3AACB6F3014532BC95DE129BCE0240925858B0624E8B4F2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783362247, "uuid": "f99a9051-e77e-4c6d-b9ad-1527aca1a059", "value": "24:894mmE0OVmDvSwajKDZKW6+ACt8PWkp+/CWP5/CyRiyjfRyUMkWQhU+1OBzzFpKJ:89FmkVgMmF6FwHcHCUUSFBr/q4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783362247, "uuid": "c8899bb6-9fd5-42d0-993f-5975fde6f60b", "value": 2938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783362247, "uuid": "ce8b6d11-13c0-4a00-9cf1-0b13f349545c", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783362247, "uuid": "4df4b46a-ae14-4246-bdea-4fa7bfcb3298", "value": "Acknowledged_PO_Confirmation.xlsx.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41eaad8f-7901-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RCSBotnet)", "timestamp": 1783318173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783318173, "uuid": "f41eb50b-efb0-400d-88ba-a9c4c7501d19", "comment": "Malware payload (RCSBotnet)", "value": "c23d75ede72257bd64c340c4178b9af0", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RCSBotnet", "colour": "#3662AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783318173, "uuid": "e2742010-d641-4426-a93e-fc1d084c2c6d", "comment": "Malware payload (RCSBotnet)", "value": "3d4f34812e0cc01496db866db3109134a962d6148a8f2c5d392807df29089d7b", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RCSBotnet", "colour": "#3662AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783318173, "uuid": "4638a489-3d9b-421a-b033-2bdfcb66be2d", "comment": "Malware payload (RCSBotnet)", "value": "bc6e7fb434644f1ee91e2ecfa168877f531ebddd", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RCSBotnet", "colour": "#3662AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783318173, "uuid": "ef2ff8d1-52ae-4d3d-b5b8-6fec41879f11", "comment": "Malware payload (RCSBotnet)", "value": "11b079af6390f7eac2e14120c1dfeefdf8b991df8a08b36508f9d886e30fa965dd90d9f6a48066d45824c5bc31bc706a", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RCSBotnet", "colour": "#3662AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783318173, "uuid": "74bedccc-10f5-4977-8119-be3028cd3f0f", "value": "T1BE86335DE07E5E53F77A557DB3A82488E298E19A8CC81E2332DCBB96057B1203C4C75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783318173, "uuid": "3d5aaef2-eeb4-4885-ae98-9e2aa1faca63", "value": "94990d48d8288ff267b55d7ba19a7fd4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783318173, "uuid": "0e2ef6e3-40aa-4485-b4d1-848e8b2c1330", "value": "196608:Psv+1kYyiNxLbrayk+FWRxsUStG7eUpH8faGzgqK/:PQ+1kWCyk+F0qUSGeUXGzgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783318173, "uuid": "fce3680f-4291-4035-b2c8-4f8574311149", "value": 8232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783318173, "uuid": "a3d0feaf-dc87-468e-b831-24b4168f8ad7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783318173, "uuid": "b3593b23-6462-4559-a638-d8c283a414c8", "value": "Windows Helper App.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6348bf-7960-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783359078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783359078, "uuid": "a7aa717b-fef6-4230-ba2f-1ddab22975b9", "comment": "Malware payload", "value": "9672440cee20c63046cf144760c9de5d", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783359078, "uuid": "101dc72e-f4ca-4ba7-881e-2c16c557df03", "comment": "Malware payload", "value": "3d681ca349e4770e359b067428f742d5d34941d9d59bb9cc1b373e5c2fa37a1d", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783359078, "uuid": "c7e21311-4dce-4a91-8732-b28a503880d6", "comment": "Malware payload", "value": "c3de5c3f529eeb8f6ddac2db8cf6493a27d8cb60", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783359078, "uuid": "82b5d72a-49ec-495d-b6fa-5beb33de0474", "comment": "Malware payload", "value": "400f1b3f0f5bcdc2412da62fa938bf526c5300f244ca268c080ae35830a1688b53351bb9cf62ba3cb0394123705e52f9", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783359078, "uuid": "700d6c64-2619-4018-8fd0-5276f34ee109", "value": "T12F0833080255C6C9E01BDCFA3460366EB7948EB79A767AA7B3CCD2667052CC1164C6FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783359078, "uuid": "d198fcfe-d3af-444c-a75b-9b14b1b68b1a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783359078, "uuid": "27f85d31-d55b-4a84-b411-45556cbd1155", "value": "1572864:yt9IKPbn/SPRWYzGxmzJGvDOsq5BQLnLH8jpFEA4OL6NonZSK7:yUKDqPRWNxKJYYm7LH8jcXNK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783359078, "uuid": "8f6be3fb-e658-406a-8e49-ce5fda673bc0", "value": 77583068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783359078, "uuid": "0a649390-b525-4c4a-89ce-6fc3bf654f50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783359078, "uuid": "a7def916-5aee-45c6-98a2-2f09521e7bfb", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0e9507b-796c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783364423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364423, "uuid": "1302d35d-fdc5-4b29-9f85-606ef4f14b11", "comment": "Malware payload", "value": "87f456559c2aaaacf762b7e4fae67547", "object_relation": "md5", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364423, "uuid": "61837ac1-34cb-4bb0-a4bf-ab0004b947d2", "comment": "Malware payload", "value": "3ee6743541857a15df54cb62cdb44f492031824d284a8e5ccc5faf43cc21873a", "object_relation": "sha256", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364423, "uuid": "a812ec45-2c51-464e-97b2-ed7c2a6b4eee", "comment": "Malware payload", "value": "8de79ee55a4dfde719b4c1c3050c6351dada7e85", "object_relation": "sha1", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364423, "uuid": "963343b9-75d6-40ba-b721-471f78f58760", "comment": "Malware payload", "value": "d99e8ca3c20f70b243f672d34df36f0eae5c197f494d37ea1dc16c1100f7d024523a406f96930cc2f0c588f1f444e052", "object_relation": "sha3-384", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364423, "uuid": "f6635175-4365-45e3-bb96-32d1b1ff8015", "value": "T19916BF02B7D41A94D467CA30C61FD732D2B2BD260731E28B1996D7492FB3B914F7A722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364423, "uuid": "5132a973-4d95-4291-86dc-295cbfed721b", "value": "8017092fc768a78ac8ff054ccfcdb949", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364423, "uuid": "e2588222-ad04-4246-acc5-9ae9ef6e2d6c", "value": "98304:NR6GYB2WGYTaXiQDPS/If8pC5WwxbXfXBIeOW8CgLZ8MxpL5:N6GB7DPSicq1uR9CgLdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364423, "uuid": "c6f7f645-9795-4ebf-9cc8-ba5b75699f12", "value": 4037632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364423, "uuid": "515aa341-217e-449e-aa83-bc61fd191d75", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364423, "uuid": "a7abd77f-8a57-4c21-a49a-3cf77102acf6", "value": "libpsl-5.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092b7f6b-795b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783356732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356732, "uuid": "a8befd1f-c4e6-4376-b8d1-4d87bc84ccdc", "comment": "Malware payload", "value": "33e4ceb661df328c0f66701aae971fa5", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356732, "uuid": "2e9763e5-ff1e-4927-bc50-a7bb06e2ec2c", "comment": "Malware payload", "value": "4071f6835d657d83c739cc1e909af5d1ec3abd44d2a74f5380719b16e60388aa", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356732, "uuid": "ab850d8a-d1c4-430f-8982-9d62e4904e02", "comment": "Malware payload", "value": "d7249c48acadd2a17e0f1068ede06218227de00a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356732, "uuid": "6b84a00f-7392-47be-8673-faeaaa2ebce6", "comment": "Malware payload", "value": "b4dd30958f4ddf94336f438d2560d6c35d25c560f1fdcd830e4fa25fe84ba0ee985d7ce97d5afd3442f02112a509380c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356732, "uuid": "552c1618-a314-4cf6-abf2-afe2e26698fd", "value": "T13CE6335856E102FDF9A3503BEFE05A56E1A578B65F32C8DF178407B26E972A04C3A703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356732, "uuid": "7abd962f-3c48-40a9-83b5-71475319be5e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356732, "uuid": "3935c54a-5de8-491b-9bd7-d4d1ae68e152", "value": "393216:coDHVXNxN34+/TiX/2LXMCHWUjXFcuI3/PGTAI:cozVdxms5LXMb8XyH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783356732, "uuid": "54c063ac-c5bc-4a25-80e4-752b73bf617c", "value": 14313067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783356732, "uuid": "ed2e2f18-ec12-4981-805e-487e1201b7b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356732, "uuid": "40f221a3-d812-4bab-be49-7894cc0cf814", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85e7c7a-793e-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783344571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783344571, "uuid": "ccb0cb66-e724-41a2-abfd-a779ecaa7f3f", "comment": "Malware payload", "value": "580f3b3145c207c9711636f545746737", "object_relation": "md5", "Tag": [ { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783344571, "uuid": "8929b083-94b0-4a9b-8014-23c75df5fa9c", "comment": "Malware payload", "value": "41c335937e9ee691c7442d8c89b3233b3bad19e346a00787c1aefac0d0b1a1ed", "object_relation": "sha256", "Tag": [ { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783344571, "uuid": "a6f272e6-9d00-4609-9dc5-93fcfccbd73b", "comment": "Malware payload", "value": "eb762a951aaff51b1935c5192bc779b462bbfc27", "object_relation": "sha1", "Tag": [ { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783344571, "uuid": "245454d2-caec-4be7-a940-901e6fad77fb", "comment": "Malware payload", "value": "7942a6c336b4ec8e8168b7fb78f28c7034481362133eaf434f690fc0bc9c5745faff277ef58df881dbb9af3c24b897b5", "object_relation": "sha3-384", "Tag": [ { "name": "IRAHook", "colour": "#155CA5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783344571, "uuid": "3b246ed1-ff9e-4b5b-ad9a-270c1737bdd8", "value": "T1639702677DD5E1A9FA2BD43A5642803378391ADEE44B901B2DE849894C72C8D0F13FDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783344571, "uuid": "808301a0-1c4b-434c-9430-f692944a6afa", "value": "786432:1FiTQk6cnpOXj1Y80r4Ieij4VdvA6H0S0ErFFvTPbaAcM:DSKYtTvGdo6H0S0m9DaAcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783344571, "uuid": "176e28d6-1e21-4128-88f3-1d2bd966f8ef", "value": 42920662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783344571, "uuid": "0ca44bad-a527-4217-bdcb-6f8a3b507900", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783344571, "uuid": "f1b618a7-d7a6-4a76-81dc-bec36a9c8712", "value": "halo.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1868857d-791a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783328841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328841, "uuid": "2a8c0d27-31a3-49dc-a3ae-75ad837d1da8", "comment": "Malware payload (AgentTesla)", "value": "f07826cd8101059cbab00ca5244d70d7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328841, "uuid": "f36451f4-9190-45fb-b3cb-8fecc3ccbf10", "comment": "Malware payload (AgentTesla)", "value": "452a92a4ff9639259c0aae08fcb4fe30e93c8843a4cf301b9746e8e6b899bb74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328841, "uuid": "0d84a465-718e-498a-939c-111854cfdbab", "comment": "Malware payload (AgentTesla)", "value": "5c372345876f52e89d82daa10a778ea6674c7a61", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328841, "uuid": "60bf192f-2131-4a0a-aff6-bb4490173ce7", "comment": "Malware payload (AgentTesla)", "value": "c10ab4d8f40ad403bb3b5e582862d8ce90ca04b44ccdf6dbee59482f82ed0ce39ed6527496c3b68256d268d63e28876d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328841, "uuid": "9363b97f-c0bc-4281-b475-69603cfe360a", "value": "T1E135BEEA7B79D582DC2D2B7454234E6716A4F88C412DFB0E6F87E7AA5E217783413083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328841, "uuid": "4b99c50d-8f5d-4220-9bdd-62aacae3f75c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328841, "uuid": "42c45f5d-9b2f-4d51-b6a7-345b17c0b6b9", "value": "12288:ikqNZvt1339JCzll10/MLR/3a5py716bCMGPOr+e4ggVqcxNagXMPIl3/EwJ6l:iT13NJC5HPxaXywIPOr+e4ggVqGXOIN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783328841, "uuid": "defdb664-25b3-4bc4-b8e5-004a1ea13a2b", "value": 1063424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783328841, "uuid": "a6d40a73-2752-45a4-9729-db26743c82f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328841, "uuid": "dce651cd-50b9-46ed-b316-ea74f9a935e8", "value": "PI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38bbb15e-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783364973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364973, "uuid": "eae4c1a4-37d2-4927-b163-eb48f8b6c888", "comment": "Malware payload (Mirai)", "value": "01a233c285edb607d81ec40afaccb657", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364973, "uuid": "6e358ce7-ae9b-4ea9-80e9-74446b22a42a", "comment": "Malware payload (Mirai)", "value": "45f9416fc1d42cf2f14a381346665e8a8642aa10c47ee554770626b7fdedd2c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364973, "uuid": "a840a890-04cc-4181-9bfd-d9bb7c93060c", "comment": "Malware payload (Mirai)", "value": "849d86304bd903b644169f1fe7369ffbd5072333", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364973, "uuid": "46797dd8-2bae-41e5-9472-18f9feaaaf32", "comment": "Malware payload (Mirai)", "value": "56b8ed32b8d2334bfd826fefb7b74c00fae1c62d4a35e8b6c0385bc912f2420bdabd6a6aef3993c382e2109c79da51cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364973, "uuid": "23183c78-cba7-4db6-bb21-f396a9ab47cf", "value": "T16D23189AF8029D7DF94BE37E5006490DB92163D512931B2723BBFEA3BC721591D22E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364973, "uuid": "51ef0f06-2850-4dcc-8b1c-c31cc4fa6fd1", "value": "768:0peS55dx5Sd+5cdg5Ld35+dy5oIiYa1rz9lHmsZ/j9Asrq6WjnmDS4qA08am8rDQ:+v55dx5Sd+5cdg5Ld35+dy5ohrz/Hms3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364973, "uuid": "6f9619d0-c7c3-41e4-81be-463d660eb2ad", "value": 48608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364973, "uuid": "546dd000-6eb6-4fd8-b890-0833febf5eec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364973, "uuid": "3a66860a-bbae-40f0-84cc-702d30a66f6a", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3e1ef2-7908-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783321408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321408, "uuid": "769a9f72-d535-4087-83b9-902b4edd203c", "comment": "Malware payload", "value": "2557353656b4f2e170a322465966f374", "object_relation": "md5", "Tag": [ { "name": "hoteljune2026-blogspot-com", "colour": "#3B4D50", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321408, "uuid": "5209b89f-0263-4919-95a2-7ed3a69d8392", "comment": "Malware payload", "value": "46d0c7a4434f061d16d794f1e331a02dff3db8de74130fbcc9c6390d50edd019", "object_relation": "sha256", "Tag": [ { "name": "hoteljune2026-blogspot-com", "colour": "#3B4D50", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321408, "uuid": "40f27697-5fbe-4df4-bd2d-9ce069c69a39", "comment": "Malware payload", "value": "45bbcf53fba73686251e304ae6c4ac80b0849506", "object_relation": "sha1", "Tag": [ { "name": "hoteljune2026-blogspot-com", "colour": "#3B4D50", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321408, "uuid": "0729b753-9ac4-4d1d-a6d2-2946e0927894", "comment": "Malware payload", "value": "4e96fff61019b277988436c613304dd7de3077257456f052050701483a0c1e0d5e2e269d194e62d8b6da8a0cae515c70", "object_relation": "sha3-384", "Tag": [ { "name": "hoteljune2026-blogspot-com", "colour": "#3B4D50", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321408, "uuid": "c1062237-d0b5-4b5b-be65-af622deacb7e", "value": "T195F0FE12BAFA9709B772AE2EB9768411487B7752DC70DB5D8150010E1C25F41ED74F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321408, "uuid": "8ab3b64d-ea27-4825-9e7e-f764a1bba953", "value": "12:7wAs7clW4wAG8UKHQRyE/TTuDUF+iniLaB5:7wAsAW4wAG8hwgEmDUoIOaB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783321408, "uuid": "7d9e8826-6b20-49b6-accc-479d760ac66d", "value": 550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783321408, "uuid": "94a6f94e-4dd6-47b2-a073-2214f2d6c26c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321408, "uuid": "b85220b8-88e3-42d5-adaa-4a1f000ae0ff", "value": "46d0c7a4434f061d16d794f1e331a02dff3db8de74130fbcc9c6390d50edd019.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb0a006-796f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783365358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365358, "uuid": "9df96307-4c24-4b87-9d83-bf51aeb4ac6c", "comment": "Malware payload (Mirai)", "value": "38323ec18938e26093001c72587e8f46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365358, "uuid": "b3149414-d794-4058-8afb-cbffb9df1b41", "comment": "Malware payload (Mirai)", "value": "474179770124402269511865d3b4677e9ccb7e0423049df67e937936888a96e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365358, "uuid": "60333336-17c8-40ac-bcc7-fb4810f73942", "comment": "Malware payload (Mirai)", "value": "a178d220588b3fad68502a40095e5d418a515d77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365358, "uuid": "1fd61082-e27c-47eb-9403-320ab671c41d", "comment": "Malware payload (Mirai)", "value": "71e6daa3f658fc481139d30b331d6cd3b2761d7b4466341c31ba13a0c721a4904d3bf6f45f74df6112e667b0df6dbc56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365358, "uuid": "918bb469-638c-4d56-aa61-b4fe893f8259", "value": "T1A7141842EF414AABC45ECF31411B838A13EDD48643FB571B6178C95E7E4AA0E2DC7E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365358, "uuid": "c76c2c91-8dd9-4f77-97ed-59f235ec31a5", "value": "3072:o8yNtGGmOt4Eq+JLxxFJUgyyJifx6I96ox1t35K8e2nVxua24XbeWD4hfgEpnNGv:oMKxFJUgzsp6IooLh5KUD47G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783365358, "uuid": "e0ff933e-3056-4b18-b15f-4c90f4755f7f", "value": 202380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783365358, "uuid": "19caf8dc-cc3f-494a-98e7-03c984eef5be", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365358, "uuid": "25fd478d-b578-48e0-a47e-af1fc80903a6", "value": "mipsel.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9221a8c0-7971-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1783366411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783366411, "uuid": "13eb30bb-b806-4446-a2c8-60bc0b8c7da5", "comment": "Malware payload (Adware.Techsnab)", "value": "74b52f4242957dc94230fec4839eec17", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking-customerhotelinfo-com", "colour": "#822B93", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783366411, "uuid": "9ec5e0e0-09ab-4aa7-94f9-025592b84ba0", "comment": "Malware payload (Adware.Techsnab)", "value": "47575a1410088886820cff310c133c2501874381ea30174cc05077b3c208ad4d", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking-customerhotelinfo-com", "colour": "#822B93", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783366411, "uuid": "60b09393-cf1e-4347-a904-6d186deef9ea", "comment": "Malware payload (Adware.Techsnab)", "value": "ec601c0b2ed4ad0daf2b0dc8e4c4d7cc359c9d28", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking-customerhotelinfo-com", "colour": "#822B93", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783366411, "uuid": "c3563db4-c0a7-4a8a-9775-6f77e2563833", "comment": "Malware payload (Adware.Techsnab)", "value": "a1f389759a8497ef618961670a9a5e628702e50f020db83d13a989c0a358def384d59ff97ca5fc3c7d49b9806bbd9f89", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking-customerhotelinfo-com", "colour": "#822B93", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783366411, "uuid": "21e249e1-6e83-4ae0-a5e9-445b2f175670", "value": "T14912192227A10D7543D396D7EAEEE20879A60177210AFDCE709D9719AF2347013ECB5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783366411, "uuid": "a19af375-c333-4b10-b2c8-1e1d9275feab", "value": "192:E2AElcocWIiCzR0DP5JiJ65AMeACKriB+mHNeoAONhx:hxzq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783366411, "uuid": "52c84354-76a3-4980-b2f5-5541d2c834c8", "value": 9485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783366411, "uuid": "a66d5913-8b59-4bed-8c18-7c19bb1014e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783366411, "uuid": "c715381b-3bff-4357-9402-5f5b712a245a", "value": "47575a1410088886820cff310c133c2501874381ea30174cc05077b3c208ad4d.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba282b04-7902-11f1-ac1e-42010a9c0009", "comment": "Malware payload (NanoCore)", "timestamp": 1783318804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783318804, "uuid": "7cb9f03a-eb2c-47ac-b978-1e44ccb3fb1b", "comment": "Malware payload (NanoCore)", "value": "50b37fae2cce85b287d059b9f57c56d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783318804, "uuid": "c6a37d99-3552-41ac-9a0a-b56508964968", "comment": "Malware payload (NanoCore)", "value": "4815a117b6c9fe07059b27922fee1b9b2be3282e056df08bd9f9f1bc3aca24c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783318804, "uuid": "cbfbcecf-d0d7-46dd-896f-96420bc645da", "comment": "Malware payload (NanoCore)", "value": "96d0aa5ca17676c61af16d93fa242c89779c1a49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783318804, "uuid": "74892200-de5b-41fc-9612-f57a804a6474", "comment": "Malware payload (NanoCore)", "value": "6bfa2cef08b75607ca561f9a1586d1dace4bf6b6e83e3b5d810f7be224fb7384105cc88086e679698ba7e2c3bef7fab3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783318804, "uuid": "1557925c-28b6-4bcb-91f3-8f3a86ff6460", "value": "T1BD14CF2637A84A2FE2CE86B9711251129378C2E79CC3F3EE18E455B78B667E507070D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783318804, "uuid": "dccc72df-b031-4f82-819c-6f66574218ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783318804, "uuid": "4d12b19d-bf94-458d-8ca0-20567c68f49d", "value": "6144:MLV6Bta6dtJmakIM5Hn/kAflqT1une7R0s1ect:MLV6BtpmkY/FU5eS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783318804, "uuid": "e9a9aacb-9aea-4b9a-9958-26da8d5596ec", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783318804, "uuid": "635034c3-606b-416b-9708-5a4e4f865ff8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783318804, "uuid": "890cd288-41a6-4ef4-ab49-848b0945a29e", "value": "cakhia-worldcup2026a.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42494080-78d6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783299705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783299705, "uuid": "0815d50a-50cb-4c1c-a575-88192843c8da", "comment": "Malware payload (Mirai)", "value": "b228d31b6630a892200b4be0a4396c0f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783299705, "uuid": "3f75ba5f-5ab9-4a20-8b65-1b1a41135ef0", "comment": "Malware payload (Mirai)", "value": "494f4666fe448e63d37a3d62b1a008aa8f1e2b234469703d321bdd877baaf38e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783299705, "uuid": "89aaa156-902b-474b-a5a8-3f99bd1309bb", "comment": "Malware payload (Mirai)", "value": "712f8dac62d790602b7bb5c9e026ac53ef3ee2bb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783299705, "uuid": "fa0c99cc-85e2-458a-bd1f-055d61404972", "comment": "Malware payload (Mirai)", "value": "383da35042e504889a4c91b9a4e59a732ba308586eeb10506138a5215918d30657ad9714ac2f5f66ca5b45936e9d946f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783299705, "uuid": "d25c1f98-cc0a-4167-bd5f-80d58acfef77", "value": "T156312ECD3170D211C288FF01F3A18BE65A46FDC97A940EBAE4C11DB988ADD4D3425A35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783299705, "uuid": "f9ecb7e0-3791-404d-9d7d-6db5c036e023", "value": "12:+kfc0dt6hrNaKOOE6KODOqiDU7f/MGyK1Sk1ZSVbVVb1LBqSN0UN0KvtIQFe77X6:TfxcfFO0DYb/KUkK3D2U2MtwWAhYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783299705, "uuid": "31f41f04-8290-4786-8cf9-77a966f0dde2", "value": 1875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783299705, "uuid": "f5f00f93-bb6c-4d5d-b8f2-5c3f4a89282c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783299705, "uuid": "3b073473-af91-4a92-9b11-bb32885a6fa1", "value": "run.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ac5dae-7948-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783348970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348970, "uuid": "39d68dda-ae6a-47b2-8ed8-33e6ba6c0bc3", "comment": "Malware payload (Mirai)", "value": "43320f6839b17804f3debc6514b18365", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348970, "uuid": "869a5505-3e46-423d-bf1a-b1417b6fefe2", "comment": "Malware payload (Mirai)", "value": "4adbc81c0b1893b55102ca4e467f7802b63e411f722341a1f04c9a7b5f12b6dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348970, "uuid": "9d823d02-8a42-464f-baa0-9f82fe288018", "comment": "Malware payload (Mirai)", "value": "dddf04d5d02b08b4b0b1b37e821ba7a2c7de995c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348970, "uuid": "e044e68e-939d-4ca5-8ad9-48e44fafc70e", "comment": "Malware payload (Mirai)", "value": "dbeaa93dae74f706f672556a6ac5ede526dbc79c744b51033adacb54e0261263741cb530535a85b8a1de12cfa10ae9de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348970, "uuid": "b99e315d-7b23-42b6-803f-88bf6e53f23d", "value": "T1C9043B46AA418B13C0D627BAF6DF42453323A754D3EB73059528AFB43F8679E4F23606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348970, "uuid": "7f9ae15d-1384-4190-8217-6770afe3745f", "value": "3072:WK2EHpPsAzDr1dXas4d4tTc1wsUilu+1Hf/JoYM/RVYmT:mEHqAzf7Xas4d4tTc1ru+1H3uYM/RymT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348970, "uuid": "f0f7d71a-df1b-47bb-8f51-b207d404682b", "value": 189179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348970, "uuid": "d5ae8605-5bb2-4e14-b9b5-0db34c86be34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348970, "uuid": "9da56e96-a39d-42fe-98c7-c8c7d5103281", "value": "atomic.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0cff091-7978-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783369549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783369549, "uuid": "a747790e-327f-4be8-a500-b29e12c1d4e4", "comment": "Malware payload", "value": "399705c07d18922e905baf255aee15ed", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783369549, "uuid": "d1a48f97-0dc5-44a3-b206-37aa1b89ef23", "comment": "Malware payload", "value": "4b06e4c33a3ed62617c059ef47629b426971f2796f486449e19ae421f229fc16", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783369549, "uuid": "a6b029d8-82ee-448f-aa3f-fed18353e5a4", "comment": "Malware payload", "value": "2a11606de451c734115180696a7d1dc5531fce2f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783369549, "uuid": "6aa261c8-7eab-43b9-9502-c9c860abe984", "comment": "Malware payload", "value": "f2657d0e6c78fa64ec8557bbeec8b8cde5c0c774e9120daf3458e6063ff5831aec608592da840b16e91d5b5f697f146e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783369549, "uuid": "62878645-89e3-4d42-918b-b43c073e02f9", "value": "T11A453360DE2A7E690AE8DA3470B71F1A0FD18DD8D4297073BE8636C35736AD06C27C59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783369549, "uuid": "5615380e-4bff-4453-b908-eb8649b8d35a", "value": "24576:FoPcnZQuCGU2vPpGmH3fpm/9IGnpYs59+OhQwnPEQFQadQuQDj8:lHvsmvoDBhdIadxl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783369549, "uuid": "806cef49-71c0-475a-8cc8-5228bd421ea9", "value": 1278599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783369549, "uuid": "f8d8acb0-ac4c-4f28-8e19-b58066707a17", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783369549, "uuid": "c8735c47-280e-4fe7-af63-e8343848a426", "value": "Swift ref. TT 810-363295460.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c49eb97-795c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783357301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357301, "uuid": "b805cf69-bfc9-40a2-9f9f-c678682dbe30", "comment": "Malware payload", "value": "0a38a5a7b52a32f20599dfe4ae276ab9", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357301, "uuid": "5da0db1b-ffce-4edf-b7be-6feff6662ca1", "comment": "Malware payload", "value": "4bf7d834fe3a018692e15958e1e49131b359cd3b81cf3d1c23dd593f79ab7f47", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357301, "uuid": "9758a0d2-dd86-43f3-8ba1-6a46d955f9cf", "comment": "Malware payload", "value": "a675b61182c25deaf219d5a086c31bcef28fc3b6", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357301, "uuid": "3313536c-dfba-4dc8-83a6-69a920d89c4d", "comment": "Malware payload", "value": "9ec698d6515a4b76d6f606d9ceaf335cc235d6692b32fe7da96097c4415e50254c2761fd521e9c50be3cd874bdbb4348", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357301, "uuid": "509159ac-9f27-45a9-9705-fcad59ec9630", "value": "T12628334807C8CB1AD1D3883B3AFF62A164B0192F9200B99B57BADF57D3989FD5438497", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357301, "uuid": "b1bc4ac2-5363-474e-9fcc-bc9641dedd8d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357301, "uuid": "1e9454d8-a7c4-4b65-89d9-dc6cf65b1403", "value": "1572864:hI2/TWaHY+6vq/5sazgdPsc9TI0p7+/gA+FzdN6V9jWlbUO:hVHY+6AsMQW2i/gtd3s9jnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783357301, "uuid": "6f4c0661-0fc1-47b1-ac45-6e73f52585a8", "value": 93491370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783357301, "uuid": "e77f7833-8ce5-4b42-9265-65707b9da016", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357301, "uuid": "83199b53-4a16-4f61-a57d-34cc1d7f7ef1", "value": "Spacelash.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa56b4f2-795f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783358855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783358855, "uuid": "eab98c0c-5a11-4c53-aa49-39579044895a", "comment": "Malware payload", "value": "d79896661a9ce7a71ec5833eb3f6a768", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783358855, "uuid": "4733e443-4df8-487e-8452-6d6a33776eec", "comment": "Malware payload", "value": "4da1ad20dd78cf747ac77045d93a347bda68b3f577c31149b10819c0a2cf96eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783358855, "uuid": "50533055-0c8b-46b1-b482-ee0d4c87205f", "comment": "Malware payload", "value": "7ebadb0458f581974943a77fb8a0c0c1f9f9022b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783358855, "uuid": "a5f04bbf-210e-40a1-a5ab-9b995e9bebc9", "comment": "Malware payload", "value": "759543864b3e9d0aefeb2aa5f92d4f598352c23d1bc753f1312588c224e6315735eda468de340cc3fad0d61395770018", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783358855, "uuid": "34abbb6b-520e-447b-88b8-b3bc08b51a97", "value": "T1EBF7013662A105E4E5B7D13886AB9507DF73B85707349BCF21AC46522F33BE06A7A730", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783358855, "uuid": "930c1861-4475-4cc8-824d-3c2554ae4ca4", "value": "14093b6eb36da811d11633279d29c3d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783358855, "uuid": "a0933c4c-0734-400f-b6f5-33ada33c6212", "value": "196608:cUtdI7NtmGbR2FJSkSSSSSSSNCRW5ySbLodw8+DtsDtiF2JsB2Jy7H+Awmm:UmwUFJS3CR8LoyhDtsDt928JHBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783358855, "uuid": "0a3bb5a6-85cc-40f6-853b-be93ddc5b7fb", "value": 75872680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783358855, "uuid": "25b2c476-bacd-44fe-b075-8c6744a864f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783358855, "uuid": "c6e44d73-69da-4f7a-9d45-80809bb43acc", "value": "Elina.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e8085e-7914-11f1-ac1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783326528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326528, "uuid": "c1387698-5a58-46f5-87de-86176df6e754", "comment": "Malware payload (XWorm)", "value": "24779f6968918aa1b7573b85d2c6aa25", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326528, "uuid": "c25594e8-71a7-471a-953c-e58ceb5b91bb", "comment": "Malware payload (XWorm)", "value": "4db042001a8ed51a7b1a675820358bb2221b7e353b9194bdecfb9b780a3433ea", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326528, "uuid": "97531cf9-b5fe-487b-9436-29a8cd7ce539", "comment": "Malware payload (XWorm)", "value": "6802a6d0cc1a99652d879b65efe07fc57d67dc33", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326528, "uuid": "ef2a8c83-51ba-4235-8ffb-887bd59e87e5", "comment": "Malware payload (XWorm)", "value": "5423c2d19081184fffbc4c7e8d881c19427be94bd8801d6b1f2a0d4c6fa0a87c355fea1d1d542cd7e36d825866a374d0", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326528, "uuid": "0946b7d4-8d94-4253-8bb7-6cc97ef1be7f", "value": "T1A7E4238AB721694AD12273FEC0C8F0F0E5473CE65106EBD1E185C2D6A7F82B25715DAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326528, "uuid": "20618365-4700-438a-bf43-c8061a902028", "value": "12288:w/5taQxMPzYkKD+18+GYIoLcsSA2G5m9mUiJErl9Lh5x6R1UsbyJDjZ:NHIa18lOyBGM9mUcErlT5x6oJDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783326528, "uuid": "9c19f04d-9ba7-44aa-889b-22385c917f73", "value": 661218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783326528, "uuid": "1efa7832-a3f0-42c6-9069-837d05dbf014", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326528, "uuid": "55b34327-b8a2-42da-9bc8-77065029ce3f", "value": "Price list.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caa829d7-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783365217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365217, "uuid": "8fb681e0-c040-4051-9ddd-3437d1cc1d77", "comment": "Malware payload (Mirai)", "value": "7883b90652285bdd7c3286f48456872b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365217, "uuid": "098e53ab-8b2c-4cce-bdf3-b52247acc17f", "comment": "Malware payload (Mirai)", "value": "4e753042b8710bff8c99e045663b43c907c1a2dff5c1a3fc5947af0525978f33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365217, "uuid": "b6be671e-d2cd-45da-8a26-2826a05fe919", "comment": "Malware payload (Mirai)", "value": "e23c59848c5833fb829cc4e328a2cd0da4ead605", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365217, "uuid": "2907a0d2-3037-4d3f-a049-12a147107c9e", "comment": "Malware payload (Mirai)", "value": "07fac7e68930f718ede7d9c9ba1446d1f554163161797054c47bb381bdfb3b1e2365d9524e7d3595c3f477c37d264be7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365217, "uuid": "7d31feac-765d-4744-8771-b1774ae8b6fb", "value": "T1A823F707B54681FDC88AC174476BBA3ED92275FD0238F2A67BD4BB222997D215E0DC48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365217, "uuid": "34833df4-1486-4dbd-a0f4-ba23ef0b1ca8", "value": "768:PsxkeNSDkPQ/xPpTk3jA3dxMi75QD9Bt9+Vj85e0PIgGC1ue+v3SbI34rP9ms:MN8DkPQ/Vpg3jA3dxMi75Q5BtUJQZn1N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783365217, "uuid": "692ecd7f-1aa9-4204-b2a1-c2f0115cbee2", "value": 46688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783365217, "uuid": "fd4c015b-7b1f-4155-9b4b-c3f33a27b78c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365217, "uuid": "7183147a-e249-427a-b181-21b9fbdbcaef", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3093d937-7963-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783360234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783360234, "uuid": "5ee2c8f0-b895-48c0-a8c6-ec8130b9a0df", "comment": "Malware payload", "value": "c10bc729267344b93e07c80bbc762d82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783360234, "uuid": "c8585089-b1ec-4933-82a0-cc59b50cf033", "comment": "Malware payload", "value": "4eab52778134487a4233915f30ddeeff9d165a4312a2d8c5256c20072cd8de53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783360234, "uuid": "0b2b2a9b-1447-4452-8244-0e27cf51a323", "comment": "Malware payload", "value": "592f2cc7b31e849981dd4ede582b789461917729", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783360234, "uuid": "d484fa5e-cfe4-4d48-ab70-049cd4fff16c", "comment": "Malware payload", "value": "df45ba30755edfe2c24cfa5f36afdae847c26f88e55cc2a02867622e349866e6efe9ff0b1f4aaf303aba663b19f10f3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783360234, "uuid": "e1428e1c-186a-46db-900e-bdf706be6800", "value": "T1F766330D7D0448B1CAD36AF2AECFA69D1037A5118595093EFECF5505FF2A236E2A6343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783360234, "uuid": "122cabe3-e627-4f8a-848f-edfad552c21d", "value": "518389a51ebe7151754deaef2c344c28", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783360234, "uuid": "1b5e67de-186a-4b38-acea-0ea81420b243", "value": "98304:98Sw6AhvD266M9urdMNJGDB4o4T0H8fkpwljAoJeej+MZlXpJyR9DH84tru:9S6AhSJZDO5GpwljA2hvZvsR1cKu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783360234, "uuid": "fee37503-f614-4a6c-a2d5-0fa6f3d445c4", "value": 6508368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783360234, "uuid": "b0ecf612-4a3e-49a9-92df-fa1d6a134084", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783360234, "uuid": "272ef8e9-af92-47b9-9687-d8b3139eeb55", "value": "download.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef69ab6a-7961-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783359696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783359696, "uuid": "cd55c2c4-8677-441c-a9e1-2a183e8bcfb8", "comment": "Malware payload", "value": "ebec559c9e63f6e75d847ce7334be45b", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783359696, "uuid": "8511daad-3d11-4cc1-bf1e-cbeabdb65493", "comment": "Malware payload", "value": "4f87b1d06d435b14a0cfa45cae09a78af86b52346bf0e056937aec16e4ff8c9e", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783359696, "uuid": "f47e42fd-0c69-45dd-847f-363dbd278cd7", "comment": "Malware payload", "value": "7d0973de05f0bc6b86f6fc81bcd874d9baff7339", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783359696, "uuid": "1524b8e6-adc5-49ec-a731-dd821c5247df", "comment": "Malware payload", "value": "e24874e9a2b87364e9ae4fd32765f0ed607cc1c75be50c736a04a37a7e3ce512b9fbefe82a7101e5cf2e01b67c2b08c3", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783359696, "uuid": "d81f0e1f-f253-4d71-80fb-d9cfb334ee6a", "value": "T133C208012DE724DEF33B6BA14BD9BDBF046BE8B9191C61F410019E95C7B0984C5A2B7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783359696, "uuid": "360fec8c-4d1a-4067-bcec-1abfd7d2239b", "value": "768:yPcYpcHAHhvn4P4cEcLcdL1N/bsByLEYZaDoCcSzcrOAv3fCN3cSNTNI5NoVQp0I:Q+qgSTbVv3aNVa5C5ry9HeSEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783359696, "uuid": "4fbc0a0e-10e2-4378-91d9-e1b03dab76c2", "value": 26281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783359696, "uuid": "7235848d-cced-4661-97b9-0d639d791663", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783359696, "uuid": "f9f14f6e-636f-4952-a062-ce91d1d44dc9", "value": "Game_3D_Assets_Project_Requirements.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c095aa22-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783365200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365200, "uuid": "8e1b6877-6162-4c30-8a33-564010e0446d", "comment": "Malware payload (Mirai)", "value": "9221b3c732a3fc85f2c38961c083a7b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365200, "uuid": "defef2f3-6006-4c99-b6c2-59d7628c8746", "comment": "Malware payload (Mirai)", "value": "4fc8c90b927b80081134e6ef7c3b471b6d6679270a9705a90ed1a9fcd1cc6979", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365200, "uuid": "01e24f44-6187-4837-8916-04fcac4c8df0", "comment": "Malware payload (Mirai)", "value": "e82f84399986570ead185890b70006be4ae83dcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365200, "uuid": "42f45693-4c19-44df-ad07-29015ad5e9d8", "comment": "Malware payload (Mirai)", "value": "1ee29cebdc3df98715f87b424878dbf4946e07af4b5a5631a4a1be442ec96b81c371fdfe0c78bfa19e9b8ce2054ab1d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365200, "uuid": "f8f47b4b-acba-47cd-9326-8ed2b1577f0a", "value": "T15723F741B8815A23C6D1137AB56E46CD3B3563E8E2DFB21B9D225F6037C682F0C67E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365200, "uuid": "2463f332-f0be-4e5e-970f-8aa9bdf59386", "value": "768:XwsEiiF6sw2qzKVWGMd2f+ur19/m/e9CE4v3omnE4rPu0IIyEJvw:eiiF6x2qzSv+0f9Czvd2JiK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783365200, "uuid": "9bf2bee2-8dfc-4d87-8e83-48c6f09cda47", "value": 48140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783365200, "uuid": "7db45f7c-1c00-401a-9f2b-42420b4fef33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365200, "uuid": "a7d682ed-f46b-4f00-8264-14c1c32de1c9", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5297673-791f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783331332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331332, "uuid": "ac5ba1f0-53a4-436e-95c9-c39c1cafc706", "comment": "Malware payload", "value": "29b876f3a98516a0029f4666760e6c6c", "object_relation": "md5", "Tag": [ { "name": "192-142-51-51--18080", "colour": "#2484F7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331332, "uuid": "386ea0e9-b8ff-4f06-901b-517e49c5cd50", "comment": "Malware payload", "value": "502d7eca58b9d3ad3018e12b11a92ca5f3bd3f069eeae59793be3b6e901aa88f", "object_relation": "sha256", "Tag": [ { "name": "192-142-51-51--18080", "colour": "#2484F7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331332, "uuid": "68a6e1f3-0bcc-4b1e-8627-8a142ea99a50", "comment": "Malware payload", "value": "c401dba41fd1fc32723fabed09ae449fca21ab4a", "object_relation": "sha1", "Tag": [ { "name": "192-142-51-51--18080", "colour": "#2484F7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331332, "uuid": "914f3a6d-89cd-4145-9779-ef95a671bb78", "comment": "Malware payload", "value": "f42238147cf84edefc5ce3d39ad4406c1614e2d9b47f8f3b7a414ef0123e9fc174cd27ab2b2704ab47a01cb0fd8ac656", "object_relation": "sha3-384", "Tag": [ { "name": "192-142-51-51--18080", "colour": "#2484F7", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331332, "uuid": "6718186a-9a34-4a73-8465-7c62914d7613", "value": "T1850115C96433C22D121EC1DF93368C5BD84704A5841DFC70E564D4056935464D8FD761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331332, "uuid": "df783bb2-0e77-4f58-aa76-8149e53ca448", "value": "12:q1iIS6oB6y7gPLv/STwNaFcF6uvBu9YQ4bDmMCCTlalMuuFr1M49g:qpOBZ7gPLv/SsoKJkCtDmM9pU9HJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783331332, "uuid": "ddf0165a-09ef-4837-9943-30e67a5e174c", "value": 715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783331332, "uuid": "7d89de17-55a4-4a02-85b9-b16dd47adf37", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331332, "uuid": "757853b7-abac-4b67-bdc5-e6d45d092328", "value": "stager.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71592ec2-7959-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783356048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356048, "uuid": "7774963e-3953-46ce-b8c7-8acb6528471e", "comment": "Malware payload", "value": "83ad922ab5cb8524ce3ebb2f4772ad61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356048, "uuid": "f37ffd6d-c4f6-4e65-bd57-c197f73d9a30", "comment": "Malware payload", "value": "507b83e920cc500779125e8862eb9fb8fef6440256842ba0b49c6d018a0e4e21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356048, "uuid": "05f69bb7-4125-416e-b0ea-a15b2b13a54b", "comment": "Malware payload", "value": "b2adc042ae38d86d758e50344dc7d8659dbbff86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356048, "uuid": "e631fe76-ccf8-4dbc-8d66-da4ade4c9181", "comment": "Malware payload", "value": "60c0b2c02abe24bc58a3bb9b38615f33fe3b8265b3db3419f0145bd9948f26de772baf6acc3a00afc6708601a33459a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356048, "uuid": "07017c97-989b-4fbe-9388-b24597ff52b4", "value": "T1C708DF0763E216AAD577D138C6AB6503EA72B4071330C7DF729C43612F63AE85D7A7A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356048, "uuid": "9dbb57c1-cba4-432e-a9dc-606da7acb101", "value": "d93981c937e9414a759323e9d6924115", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356048, "uuid": "f2151848-dcb2-47b8-acc2-cc3e74c83a81", "value": "1572864:ksZBjaKgmX0ICugRVH6qREpYd0Htsc2HPY:NB10ISVfRaI0HKcP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783356048, "uuid": "ac96de93-ea72-4f56-bb93-4ae77d3d42f7", "value": 80793757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783356048, "uuid": "ab3e12f0-9716-44ab-a4ae-60cfcf4c3f39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356048, "uuid": "3aa03203-889e-48b3-86d5-24049651c17c", "value": "Install-Kerusa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f2a18a-7914-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783326578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326578, "uuid": "3cd011c4-9d3f-49d7-b716-bbea8bee9751", "comment": "Malware payload", "value": "87ce871f3580df0001c3a5930ae9525d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326578, "uuid": "c7bbaacd-cf00-4c82-b090-da575e0796ae", "comment": "Malware payload", "value": "510306415765f307509191f72cb3e73d83e3fdcc17abe176159a2fde10fe6b06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326578, "uuid": "fa0f144f-de98-4179-84ac-db7df5972bf1", "comment": "Malware payload", "value": "e031a2654219d3fbb08793a2542b0bc480c35cc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326578, "uuid": "20337705-0138-4e92-b986-d84346333d05", "comment": "Malware payload", "value": "4e4cc6fea0202ac58bdf0bfee21583ee3e06bd1fadb70def13f0bce3212f0fb83cd341c6014a3abeddc32d75f84eccf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326578, "uuid": "d557d518-2b03-437b-89a1-2801ce990afc", "value": "T19FC6336823E01DE7EC57D73C97A7C2969763F8522721DEFF5291423A5F636800839B88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326578, "uuid": "ed8c4946-2607-45ba-ac6e-d09475112777", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326578, "uuid": "7241b97a-73b2-4b23-ac60-eb5c099bfd24", "value": "196608:wzzRwK5LKPsBZvrsW4gXySntTFqq8N3tFELXcSDDzVj8PvLuuLsnNW+9us0E:wzGOLKPsvrNtZq5X7SnzGPDpSNf9c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783326578, "uuid": "7d9e1f5e-43fe-478d-91c5-9fd110087bbb", "value": 12484096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783326578, "uuid": "079353b5-31c5-43d9-87a9-eb8dbfbb831a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326578, "uuid": "e39bbf4e-fad5-458d-b101-131529b6ff75", "value": "87ce871f3580df0001c3a5930ae9525d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "461e1af3-794a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783349533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349533, "uuid": "261c9a01-9bdd-412d-a0b6-eab84403998a", "comment": "Malware payload (Efimer)", "value": "c09c4b35cd68e644dfb97e5f5b082338", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349533, "uuid": "604d4a16-c35d-42d7-850e-e6af65f0afb6", "comment": "Malware payload (Efimer)", "value": "528c580071eba38ba1f480a289724935b3fe6fa121217605de3fca2081d96c4b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349533, "uuid": "da2fd023-23dd-4b13-b28f-6f4d1af00016", "comment": "Malware payload (Efimer)", "value": "114e03ee0b2b6869004cdf5defcf8028ea33e335", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349533, "uuid": "c46a507e-007a-4e39-b85d-66469d6fc52a", "comment": "Malware payload (Efimer)", "value": "3e89dd679f0d6e5588976fca977e3ad23fab46fe74952d7c953494422032cb4e64a79c8b3d1f26b0c081ab3f3553658e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349533, "uuid": "b60efba4-a9d7-475d-9133-3ec495d83bb0", "value": "T121E63358A9F012FEE7A7D07CDAE159A2C8E4B4644771C8DF1B5893DAED532E00C3DA12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349533, "uuid": "5dd6d3af-9389-4348-ab3f-2ca80a07f79a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349533, "uuid": "5f076cc7-59e7-4fd3-b024-0333db92c8d9", "value": "393216:Gydh6Da8Wwl7Qc+YXDhBXMCHWUjX1cuI3/PGTAI:Ga+H+oDhBXMb8XCH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783349533, "uuid": "fa487217-1ac7-4687-870c-6c7b0cbb371e", "value": 14306449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783349533, "uuid": "6918d6d7-41fd-4637-994e-bd6c0ed5975e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349533, "uuid": "b0df2697-b2cb-4264-b28a-d011c73ea367", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a650d612-793c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783343682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343682, "uuid": "8b604fea-38fb-4a7a-97c4-f967fd0ef576", "comment": "Malware payload (AgentTesla)", "value": "a177a8d93b97174b5f01b34b14ed716a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343682, "uuid": "671cbc5c-76ac-49f6-90dd-45bc87399a0b", "comment": "Malware payload (AgentTesla)", "value": "53f74990bfd6bf39940b96e2bcf1ae5fc435d1a27b492b8fb128291b06f53b72", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343682, "uuid": "9ee85464-d20f-425b-b502-6990a3f1a8af", "comment": "Malware payload (AgentTesla)", "value": "3dbfe076ab2535774a40e2fbc4fb5b84d94ef1d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343682, "uuid": "b8762de3-15fe-4f22-a45f-5c93fbfb6853", "comment": "Malware payload (AgentTesla)", "value": "8b33aa9e31c5d987cb867091117b5f9917e2fa1cae823c85ba2cf24c40d4e81e2d89dc17a6e7486589833531b7b83903", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783343682, "uuid": "04777679-37e7-4b31-b217-4fbbbda18b27", "value": "T1F9E53A10672995B2A52DEB3CD136EFF8090E20031599DF1D30B983647A6AF47A75CAF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783343682, "uuid": "470c5c04-60b7-4862-b8e5-de5a307e6780", "value": "49152:zcsmnW6xVseMGFkZNtvA3ZLIf+V8vipCuD/ZHQ7IpRPDcPNRkIYMx4oYO8:zcsmnW6xV/MKkZvvA3ZLD8vipVD/ZHeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783343682, "uuid": "b92388d0-c75a-4e81-b16f-8c21fb3dce53", "value": 3121212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783343682, "uuid": "1f4af0d1-e6e8-467c-a401-ff17c9f72271", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783343682, "uuid": "37a41e6d-e8a5-45f6-9f73-ed0350479681", "value": "kkwwzxds.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14aff571-791d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783330123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330123, "uuid": "bd2b5a2b-bfa2-4cc2-a29a-542a3af50840", "comment": "Malware payload (Mirai)", "value": "82920e6157e381fb7b5a8b861459a474", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330123, "uuid": "55621bff-dc6c-4e47-aad5-ac412016346c", "comment": "Malware payload (Mirai)", "value": "55362508e0d4a7204d6270882fb59eb3faf9e329abb4321d9f3c3c04dc5f8f79", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330123, "uuid": "72d60d04-45fc-4301-b149-03c00861a010", "comment": "Malware payload (Mirai)", "value": "bc049dd376d5c2f4ea5429a4b5cceb50ffe7a074", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330123, "uuid": "4bba82ed-1862-480e-913a-45fb2246517a", "comment": "Malware payload (Mirai)", "value": "3d79ed700293cdec7e19c06f2e69ccf4260d2d9e1662a37a12a10d75db6d87eac7e63227986ef9c1126795d6bfd24373", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330123, "uuid": "e9083d14-5f4a-47f4-b5b6-f0bd3c4e00b5", "value": "T1CC042945EA404B13C0D627B9F6DF42453333AB9497EB73069528AFB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330123, "uuid": "1ed833c5-2959-46c1-b9d0-1ae32fd95650", "value": "3072:OzeSvtfV84oALv2eEQakGzORuGMzw99Lpd38YhTfYo+M/RM+FDhdLn:2eSvJdoA7TEQakGzORuBGLpd38+x+M/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783330123, "uuid": "39e0f0b7-b747-40b7-9960-8090319c6b18", "value": 181466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783330123, "uuid": "e99c4139-4450-4fa0-a25c-f6a5cece556e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330123, "uuid": "6fbf2045-5774-48f5-81c3-58c7040d9195", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a0f26a-791a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783328802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328802, "uuid": "7b1eedab-2007-4a66-bff9-85bd25e1c3f7", "comment": "Malware payload (Vidar)", "value": "6fc63bf4876ca827731025e5afd8576a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328802, "uuid": "f7b8f7a9-9375-4bbe-8f00-8060ed52ce2e", "comment": "Malware payload (Vidar)", "value": "55dd76488bdd3ff9530bba5d8a6d4fcb8c67f9a40eb72ab4b48465bfd03a0387", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328802, "uuid": "0e40f74c-90d2-4ecf-9aee-e70f4448d481", "comment": "Malware payload (Vidar)", "value": "6acc17e81f0870543faf5bd4b3ae35f7614a5ca6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328802, "uuid": "a98dd770-fda4-4d78-a57c-df4df0147416", "comment": "Malware payload (Vidar)", "value": "b81e2757948df7a654623c64e7b768ac9498699cdbb434111aaf1b258da32e06cf5eee3488d77488d8301c4c03994d15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328802, "uuid": "58fdfceb-ee1e-4864-9065-4f4555954f25", "value": "T1AF52E9DB3197B0B8C16D8379C99B12A68F76709A121B4FFF16EC899075C3205B9BCA50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328802, "uuid": "fee6a711-fada-4185-8b49-86e4f8403b00", "value": "26d19d8b256971ee26a63a1573b9706b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328802, "uuid": "f7722bc6-7517-48c9-9a26-43d591745edc", "value": "384:O5rP3cYEpHRe9+wgJF5Y6N3Wl8PR0EdXKQlC:IAYEFReJsuKC8J0VG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783328802, "uuid": "db23ef26-d41e-4ed7-961f-b82e3b39e2bf", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783328802, "uuid": "d66e5125-eee6-4371-9102-bc6083908b49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328802, "uuid": "b4d5b904-78fb-42c8-97c8-7471264a0fe6", "value": "6fc63bf4876ca827731025e5afd8576a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9376dac-7932-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1783339526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339526, "uuid": "2f900388-bbea-4af6-a794-f2d495f8580d", "comment": "Malware payload (AsyncRAT)", "value": "1f349ad4656e91f8d62f497585365b9f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339526, "uuid": "7ee4b566-cee9-43a4-a931-a314c1a027e6", "comment": "Malware payload (AsyncRAT)", "value": "56c1f7f57b3ede16315b84735bef589df8c00804d194f726489bb053af9dbf9a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339526, "uuid": "4015f30c-1979-4ad8-be3c-37f127847e0c", "comment": "Malware payload (AsyncRAT)", "value": "0e9fcfc6c319439f6681749fa1d0a57023e736e7", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339526, "uuid": "b25a8763-a797-4793-8117-dba10cf1692b", "comment": "Malware payload (AsyncRAT)", "value": "0e58cdab01fbc6395402b68338b494c878be917e03dc3e209da326b735bf6e7044cc34307a634293f91f85be562391dd", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339526, "uuid": "3beb696f-2e60-40f7-8c98-dc71205757c8", "value": "T169D56C07FCA118F6D0AAA3318A36A9527B31BC481B3123D76F50B6B82F72BD05D79754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339526, "uuid": "7e162473-e727-4930-813c-02edcc292cb2", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339526, "uuid": "04383726-0e0e-4ae1-87fc-cb0dc1716dcc", "value": "49152:Ro73Rz3Dwre/YKdmv7WMT7US3NsMuwQuOchgOgnHJ:Ro1TcSuSXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783339526, "uuid": "20e31b6c-fd03-4b79-ba48-fbacd308477f", "value": 2919936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783339526, "uuid": "b895ee1b-e3e3-4c38-839a-27d7c641f152", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339526, "uuid": "688ef86d-2d42-4c87-a4f4-bc81e801659d", "value": "PO#158082.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "733267a1-7909-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783321691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321691, "uuid": "e5123d21-f5f9-49f1-8a24-846d9e39120a", "comment": "Malware payload", "value": "474e2506c0008d1bf89c397982f102fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321691, "uuid": "58569163-45e3-43ab-89b4-320692db3384", "comment": "Malware payload", "value": "56da124b78bce88e419638fe3361ad1c92cc5a82ece3d6b60fbb695efb1c7fd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321691, "uuid": "543e57fb-3430-4520-9c53-41bbdbafa56d", "comment": "Malware payload", "value": "c412350bbd5ff455c9a274c1d1abbbe2c47b1356", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321691, "uuid": "f72a2503-09ba-4d69-b7d1-09418ddebe68", "comment": "Malware payload", "value": "f4a452ae7b1891c5a2383a94b8aadbd3fd83b1676199b009ff0f95e305698c2eec88384dc83c62660469cc891d429443", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "honeypot", "colour": "#93CB46", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "shardlure", "colour": "#754FC7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321691, "uuid": "07443f5a-0926-4cd6-9f0d-fdbfa297e5d6", "value": "T13E57CF7792067CEDE9B98CB4D01025816DA878874778E3C7BAC471E666EB6D08D3DB30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321691, "uuid": "d4e5d18b-e949-40c8-b328-ad7f9a4437d7", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQR:cqYUQuVDt0TZEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783321691, "uuid": "4e3dc635-3e60-46a0-abed-984585ef0605", "value": 28278784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783321691, "uuid": "df4886de-0ba6-4055-87d9-ac234a76cdf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321691, "uuid": "eac30125-8965-4a72-9ad3-4997e00acf34", "value": "20260704-035654_sftp__root__5916720983772645971_sshd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f772eb04-796f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783365722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365722, "uuid": "b3875059-9d68-440a-a303-00c746e46ba5", "comment": "Malware payload (Mirai)", "value": "875ad8844a200f9db41a093c2b84b24c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365722, "uuid": "bdeaf6c7-19a3-417e-bc7b-a692fa691e0b", "comment": "Malware payload (Mirai)", "value": "576d30ad74e1b571446c130d5e2fc440f422432cd8b2df8f1a1de9eaaf1b580a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365722, "uuid": "914e88d3-d9f7-4fe5-8ccd-d26ea642adfd", "comment": "Malware payload (Mirai)", "value": "911256ef355462d4707f891bc954e319a8ca01ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365722, "uuid": "9e4d0ed3-bd80-429e-ad95-7a1e7a1a3300", "comment": "Malware payload (Mirai)", "value": "af493a8c1e96cd01afcd6b87c3183ef09381a81f3c92be1450654eab68e07f5d4c4ecbd925662a4256be7273476a7f94", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365722, "uuid": "afc9e808-098c-4166-b87c-7688250f3702", "value": "T1DEF31A5CF9518716C6D0257AF69B128C33735B24FFDA3B06DD146B283BD27299E2B201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365722, "uuid": "af4e7cc6-4f00-46d1-a424-9b264734c6da", "value": "3072:gFrnevRROKunMFOXW/+ayDED3zp/Vi7h26xt/goQMLX1:gFjevSnMFOXW/+S3z5VZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783365722, "uuid": "10eb5489-8574-4855-b876-817b6c91b115", "value": 159176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783365722, "uuid": "2bd075e7-365f-483c-ab88-a760f10adabf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365722, "uuid": "e8714e76-42b0-4554-b60f-bf8ac44badaf", "value": "armv7l.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2343266d-7922-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783332295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783332295, "uuid": "b11185bc-32f5-45d1-86ef-a4a928a8b9a9", "comment": "Malware payload", "value": "5f38543ae3994e9535bd744303d93c63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783332295, "uuid": "2a33ba8b-7655-4146-8e20-791f126f9aad", "comment": "Malware payload", "value": "58ad6244d597fdf822932aca58abc31c073f7150eb9a2dcbec011b6711e1c2ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783332295, "uuid": "d7bd437a-e8b3-418e-bb54-cc63054ede1a", "comment": "Malware payload", "value": "73ff3557cc1a1ebce06b45e1407cad6e14f30fcc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783332295, "uuid": "6f18366d-d340-4998-97d7-dab45d9f1591", "comment": "Malware payload", "value": "3c2176563a8b999f8e2b4fe445301a621dc87d0dddc9a8dfe2e11becd46ccdce1d6c553c89b9bdc56df053c433893209", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783332295, "uuid": "e3339d9b-cc37-487e-89b4-9b329b25299b", "value": "T11D1523848D2BA5AFC7750EBBD88B28048D6F7CC5C965764AF3852DE85868DA4DF0D30C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783332295, "uuid": "926403ff-c64d-4e8f-9153-2553d71cab2d", "value": "be40dba63640a6d230f0324458585e33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783332295, "uuid": "c26c6a06-90be-4a50-9408-524a1cbaf8db", "value": "24576:ETggL/58h3GHzlMogU8rGl0BZeU2hcjMJ:Xg2taBMoFO9zAh/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783332295, "uuid": "ca0ac501-3a0c-4cd6-a940-4721c48d49bc", "value": 929280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783332295, "uuid": "ed59bc6b-9dd9-4b61-b897-ffe76028a977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783332295, "uuid": "96e3fb14-1ed9-4f28-9e3f-5c9dbc7e252b", "value": "mupdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831e0747-7920-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783331597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331597, "uuid": "2b4578d8-1d94-44a7-856f-1d878a2bafab", "comment": "Malware payload", "value": "7ebf2fd69de6e8e276e79b48db09812d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331597, "uuid": "83339ecb-b3f7-4218-9cd7-442a625012e0", "comment": "Malware payload", "value": "58e5a9ac8836442d1de0393466613b54c79d0da0138c57ec0cd7e72662cd7c57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331597, "uuid": "82e192a4-28d5-4e0b-8705-f1dfec45994b", "comment": "Malware payload", "value": "a6b763f1b29d7f9c9de68b1bdabe3c90fc01cc35", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331597, "uuid": "58cff74e-d0d7-47e2-8ff3-b0a0868616a9", "comment": "Malware payload", "value": "1375a5c4b2438ce7e8328c7cf536f420cce48f203348288da21d53981be8c6f982214900fedca3a55cd8db641b2e7555", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331597, "uuid": "fc72c471-2979-4633-ba7e-753b2bb0d70a", "value": "T18E08331B1C59C886C67F4AF7BE523076E304D92F2CB4542A1B1A1BECB595E2304F9A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331597, "uuid": "adb7eb1c-f108-4aac-a9b4-e02b8d7a14c7", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331597, "uuid": "a6a2053c-2f74-46d9-90c7-fea1025e93a9", "value": "1572864:nt9IKPlK1ZNKuHJtRWYBJImKljUoEkB9dNDsMLXgiMZrIuEtpZSe7:nUKNK1ZIuptRWqImKljUvOhLXMxIune7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783331597, "uuid": "33c7c7c6-fa4a-4c25-bedd-9a5f27a66570", "value": 81845072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783331597, "uuid": "23601011-e5e9-4eb2-b9ee-af65fb129c35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331597, "uuid": "33fe6bb2-08b8-4953-9671-ab9f785b18c6", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60b8c47-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783365210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365210, "uuid": "557e8a8f-a7fa-47fe-8860-9201ff3e913a", "comment": "Malware payload (Mirai)", "value": "f47b41ed97de32c7c3aa6e1f0152bcf0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365210, "uuid": "e7a41091-76f3-4693-9c84-0d1b56384840", "comment": "Malware payload (Mirai)", "value": "5a1100bac5fa923697e05864a0c8e362e5c50638421f572fbb4abb3b99f10c73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365210, "uuid": "9c53cab1-252c-4445-b341-c79c58b14a1f", "comment": "Malware payload (Mirai)", "value": "d5ef235de9c61159fd7ebae0929ce5541b4c353d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365210, "uuid": "d805cd65-4aef-4768-a244-d82b01ae1bbc", "comment": "Malware payload (Mirai)", "value": "7d586b1c207ebfd1d1f0aa6c779df2f96092c1fab17eecbb15b3f8f215b9466a48a38b6f658dbb96826c929256bb7719", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365210, "uuid": "2081a474-af82-4cfe-83b5-bb6edd471b21", "value": "T1A503E895F8825B27C6E0137AB6BE968C376063E893CFB61BC8115B247AC591F0C63F51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365210, "uuid": "0fd61373-911f-441b-8b15-51c79eb3bc7c", "value": "768:5o6wGtK0G5ijUddkRBKLeIZdMPMZqb/wm9d0+Chw/W5oPoDw:bt1G5ijNBKS8dMHMKlChwWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783365210, "uuid": "7634dcb7-d423-4042-a2e2-eecaf6296a43", "value": 38540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783365210, "uuid": "5f09e13a-0c4c-4635-be24-b5897340c209", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365210, "uuid": "09f25168-3a25-4ef9-9e2b-2c0a8c23ab88", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "288b86cb-7955-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783354208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783354208, "uuid": "6ec5e637-edef-4ed6-91b7-5012f0e600cd", "comment": "Malware payload", "value": "51cc8cf534985359bfd1802472d10a79", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783354208, "uuid": "09b696b9-5d9a-4591-8d56-ac15538776e5", "comment": "Malware payload", "value": "5ad4fbf16c18e012d7a5f98b4900b45531e134ccbaf2a21d0b40d9066550f92b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783354208, "uuid": "480b3630-1ac4-4972-94c9-c22a10b693e8", "comment": "Malware payload", "value": "20870739bb86b262fc75b0f3ee18e7add5099e09", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783354208, "uuid": "d4371ccb-177f-43f3-8e95-e8ebb10c8185", "comment": "Malware payload", "value": "43e6683e9347e6f198f1e5b19a195545f188d9b06a99dfd44c0c9d10072d6765bc97fb7a01c9d2edfda024e8a2fb9047", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783354208, "uuid": "0c8decec-f1b1-4abe-b1c3-928fde283f8f", "value": "T1FE623C0BB8818035EBE14474827F526645BDACB623D4F9CBF7E0A48A5EB46E1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783354208, "uuid": "cca0615e-9ca6-4c8b-8678-22b978cab24c", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783354208, "uuid": "58f6b854-7ffa-42b3-a51d-5a9a2d046802", "value": "192:AWEEsGnjXgjk8LMRAW4NJTMpJFeIFFBKUSf/zwsd1gJxTmv8U9cthO9ik:ACSMqYUl/Zyav8U9cQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783354208, "uuid": "e0695ea8-88e0-4299-b1ba-700dff9f9073", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783354208, "uuid": "a5284d94-9ec0-41a7-b6cd-d79a7896fdec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783354208, "uuid": "8a96a946-edee-4a8a-9d1f-172d184913b1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ffff51-7979-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783369899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783369899, "uuid": "2507374e-d87a-4b66-9d7e-deafaa131c0a", "comment": "Malware payload", "value": "5a1798dde285e6d3139cb85808f95658", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783369899, "uuid": "041c1689-17f6-4054-b22b-7487b72d6da4", "comment": "Malware payload", "value": "5b64550c87fc3a579694133117a265c756fe36cd31de5ef0b87a6f2faae7f791", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783369899, "uuid": "7d80140b-c2b0-43d1-aef6-1c784d301a53", "comment": "Malware payload", "value": "f6593e0832f2ac7bd81a73883fd9a1703fad5349", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783369899, "uuid": "597db2bc-24d1-42de-9f6f-201966d0c3e9", "comment": "Malware payload", "value": "da3cff08b832f769f815228eaf94dc42ea28c1e6a391c5761449a5c3c10b0b3fa976b924918b8df8a7a0ae1b9d5eb4d8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783369899, "uuid": "c834497b-dab2-41c5-8f6d-d937d12a13cd", "value": "T18FB022E822028030B88CC00800A3C030828288A8AC02AEA28A0808A2A208B82B00CB38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783369899, "uuid": "5213c3a0-a411-406a-aecb-f0e318accb75", "value": "3:TKH4v9+gqRqFg2TP7XmhYVxQpqquAwWV0v:h82u0D2hqK0PW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783369899, "uuid": "ec0f6acf-7672-4024-b26c-5d74f69aae62", "value": 121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783369899, "uuid": "074f3c63-28b2-4b1e-9b1b-58707692df8e", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783369899, "uuid": "781124cd-9155-49a6-9323-83f2e0d6e565", "value": "5b64550c87fc3a579694133117a265c756fe36cd31de5ef0b87a6f2faae7f791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b5e9dc-78e1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1783304385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783304385, "uuid": "a76e3222-f242-41ec-97be-4ee66c9f81a5", "comment": "Malware payload (SalatStealer)", "value": "8a65f22dbdb86335dd4146eddbf8c243", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783304385, "uuid": "6d87c732-7a10-4f2f-8990-739bfe4d424b", "comment": "Malware payload (SalatStealer)", "value": "5b9eba1a7822d95af75c31f05d9d4483bb72394f9101d36a6f0a1e01c5a02f8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783304385, "uuid": "eb8b605d-0a72-4506-833b-2f2cd7795877", "comment": "Malware payload (SalatStealer)", "value": "7be9dba16496068589173e868a9473d7aded8fbe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783304385, "uuid": "d7c7ec19-9d68-48c9-a827-c62cedd4e6e7", "comment": "Malware payload (SalatStealer)", "value": "97fec241b3e73303172514b0c81f7f54968437ad21a9d8c2268e1f16ecb237d8a20beb307aedd54d5e6b81cf59ef0a69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783304385, "uuid": "e32949cb-3bf4-45dc-a80c-4ac6d40161b2", "value": "T155C65C11FACB54F1F903583140ABB27F23315D048B28CBDBEB547B6AF87B6A1196A705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783304385, "uuid": "03a62ca4-b9f8-4efa-8829-da5fbaa3e8b6", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783304385, "uuid": "322c5b3a-c3f5-42fa-a1e9-76d396228fc1", "value": "98304:wo/UkrAlUr2piSTwis2Yt4l71A4fG2IflEk:xAJxTF44l5AxOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783304385, "uuid": "e9ad3388-d7a0-4439-af13-89c4f5f06cd7", "value": 12572160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783304385, "uuid": "9262f328-b0cd-4e6d-9f91-b07be309a877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783304385, "uuid": "d87af882-94d3-405f-8e61-eb79937bb536", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b0f8c0-7910-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783324697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324697, "uuid": "ac0882a8-0f3d-491b-b01d-c75b76813fd8", "comment": "Malware payload (Vidar)", "value": "c4efd778f8f8fd0dc5dfb95c98a91ce5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324697, "uuid": "93141c88-690d-4547-b934-2b175e4c66cb", "comment": "Malware payload (Vidar)", "value": "5c38822c4c7a09ff1507b5371b954133968963852a2b81934a563389b2556b01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324697, "uuid": "78762b90-e054-4f31-adac-38193fb7b217", "comment": "Malware payload (Vidar)", "value": "a0f6bd1d0bf3232b07b15a7ec166ad69f3db4e23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324697, "uuid": "7e2c7ece-6759-45a3-ad1b-d5c294fd96f2", "comment": "Malware payload (Vidar)", "value": "2e39e15159a4cf39b0b77a3ef58a56995bef5a388fa15f23e9d07bf39bbdfc69589076dfb9c3f515c11ee7fcdfe302eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324697, "uuid": "ac1e56cd-f5ef-4137-a518-b74125cb5071", "value": "T1CBF56C07ECA148E6C0A9A33189B7865A7B35BC191F3227E72E50B7782F727C06D35B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324697, "uuid": "04a07470-1e49-4a34-b994-7f2d574f4786", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324697, "uuid": "60ccc1f6-8aed-41eb-bdd1-a9171234e5e1", "value": "49152:mrK7/N5xmxOSRLrIa/+2wdYoWkROIjplew84jHVm/nRtlC:mkgXIa/+PqoWksIjpgwh8/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783324697, "uuid": "86b5934a-47ca-4607-974e-240737965ee3", "value": 3544936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783324697, "uuid": "b2f85ca2-0523-4ae2-92a8-6853763f6212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324697, "uuid": "595a2132-a698-4357-a2ee-624f1deb899c", "value": "FPSBOOSTV4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "190b1d9d-7959-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783355900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783355900, "uuid": "f614365e-87ad-4236-ab81-7a04430b0ea8", "comment": "Malware payload", "value": "a6328a1f02a6df4e4dda55056f4b710c", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783355900, "uuid": "860c0f79-308b-4851-9ded-f27db526ab46", "comment": "Malware payload", "value": "5c550f4c2aefbe36483133aecac707a8b7c924e4ea3ecc6e80377e1043f27be8", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783355900, "uuid": "0f097ed9-c23d-49d6-8f1a-9e9ba8b6191c", "comment": "Malware payload", "value": "3150033141df6d8671a506f914b70304b22e85b6", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783355900, "uuid": "2a485fab-2322-4c0e-b347-5683347c4f20", "comment": "Malware payload", "value": "045d40d1959cfd531357331922d7c633c0033ac1f9ffe86de962341b076d040a8d22e4d6415a82a38f692346c82f15c1", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783355900, "uuid": "a7e3a7d9-b275-4b10-bca2-a3e429659407", "value": "T17CF733345ADAC5B9F86BD9F20B51F373FA47C329906B989F099E21C9789548E00F9313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783355900, "uuid": "057a5fe1-e21d-4267-8afa-24286160d196", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783355900, "uuid": "072d37ae-ecbd-40b6-bf10-5b219e411713", "value": "1572864:Yt9IKP8Kz15cTRNwkT3rcKf/4TubHBTTHhuwWdrADoV0KFm2Kzo+Wp7:YUKU01OVukTL/R1HhuddskpFmIXp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783355900, "uuid": "baa8d405-336e-4052-ae5b-b5a92b236788", "value": 74291290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783355900, "uuid": "57384caa-cb74-4233-8815-a2df03cbf5b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783355900, "uuid": "eaabcb39-9905-4997-8e03-6d0a63af5067", "value": "free-claude-app.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e32f117-795f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783358512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783358512, "uuid": "8e32b746-2cf4-4e92-ab8b-37f5705312a2", "comment": "Malware payload", "value": "5a4eea64f0bf23960ba620c283316001", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783358512, "uuid": "e3b3685e-33b5-4a03-9386-6b8dc3f06830", "comment": "Malware payload", "value": "5e1e742b71db901d1afd0d72d0a6572f6b3555e4fdd3267bebee5ea2dc143579", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783358512, "uuid": "a685b60e-826f-444d-9997-58050ad02431", "comment": "Malware payload", "value": "4bb6db011d05028a97da08319e60480ab935033d", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783358512, "uuid": "1dd0876a-b9b4-4da3-a347-2da73471027d", "comment": "Malware payload", "value": "a4bc6a675f841072d5665c7483839c15fecc687b43ca5384a5ed55aab06abfbec849b29ef8ea650f144b0a66e36e348f", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783358512, "uuid": "d0b32ef8-2c4a-473d-a2a4-e551a140af03", "value": "T153F7333B1135E356D3E18E7021F92276F320932D77329D8DF20D50AD7BA924676788AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783358512, "uuid": "8620ca29-0c68-45a1-a4c8-f76adb03b889", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783358512, "uuid": "bf63f3da-215f-4068-be8c-53efb45edbfa", "value": "1572864:st9IKPRGRWYo4ZRyxMlMcGBc3kdUF91CAnpbOu/h7:sUKJGRWh+LlMJBSkGFGAnJOu/h7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783358512, "uuid": "4a9f3bc7-0b11-4864-ae1f-3146ca172d97", "value": 74951457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783358512, "uuid": "8aac78ea-e7c4-41c2-9dd0-c12708ed9ef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783358512, "uuid": "bc171892-dc20-4690-a39b-d172cf8386c9", "value": "ecore.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d295f170-796d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783364801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364801, "uuid": "b9cb4a4a-5842-440c-ab71-04facb2542df", "comment": "Malware payload", "value": "50514b9b645b6115642ac19bce164eb1", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364801, "uuid": "4a24239d-1969-42b1-b2b9-d7da083562bf", "comment": "Malware payload", "value": "5eea3112b54a03056353f435e042c331073427d2cf4401829098c3e9cc5f19ab", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364801, "uuid": "3a7b33ea-a01b-46c6-b91b-cd97b88cbb38", "comment": "Malware payload", "value": "b4a7a1df6ba304cb458f6e3fc8e6cea54f7ee555", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364801, "uuid": "8737e0fe-294d-4c43-b186-dcaaa43b4b8e", "comment": "Malware payload", "value": "9cd56ebbbbabd1cba885fed586923cf1aa0ac39b83344843dfcddfaaf1b13db09e9c71c55f47994202ebd22dff8ddf2d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364801, "uuid": "ca92d0d2-b07a-47bc-8978-c35ec43866a2", "value": "T124137D6566813C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C59A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364801, "uuid": "ef67ffd8-8852-4d70-8127-f63ef55ffe55", "value": "768:TXRWNGxVi89GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnp:tlxocy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364801, "uuid": "79a65ac2-bd74-4845-9c41-5752156ce455", "value": 45530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364801, "uuid": "ba832dc3-0386-4817-abb8-4fd7c317d4c5", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364801, "uuid": "687ceb09-7a76-40bd-8978-7d8fc2d30fef", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f02a1d-7932-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783339458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339458, "uuid": "b9df5479-c569-4ead-8c94-e1748a361354", "comment": "Malware payload (Mirai)", "value": "14ead90e69a65023c6f185e6fc50725a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339458, "uuid": "4e4413c2-c5cc-43b2-982b-ed03da9b0bf7", "comment": "Malware payload (Mirai)", "value": "60627b17b9b4c6b777d4d5c1d6fe4d1a0402b147f5e12e10f46c58f13b9ef7aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339458, "uuid": "8c28a495-806f-4597-b4fc-298e863a5688", "comment": "Malware payload (Mirai)", "value": "ef16dd8af4f9c7b7192de12e2890ff76b84ec782", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339458, "uuid": "d94b6896-f4c0-46b0-83f8-512dc0e591fc", "comment": "Malware payload (Mirai)", "value": "2ed7acda8bd64cb8811fb649baba5aa014e885b96958617dc1b27992aa4aa77dd47c5a32ca6ba8bf35ee90babe6545ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339458, "uuid": "2b095a8a-f00a-4afa-ae96-f002064368c8", "value": "T1F3256D5AF2B370FCD027D030439BDB62A83AF47501216E7B65C4DA352D66EA01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339458, "uuid": "382e1feb-db12-4db1-9f1f-60235a16f5cb", "value": "12288:wZ+iQJzYALzjf51mXryImU5vEXEWWmy9x4++L975k:wZ+iQJvzjfbMrHmScXlN+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783339458, "uuid": "cfe18a28-d01f-487a-b2bb-5f5c366f7fa5", "value": 1033120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783339458, "uuid": "e69bbe64-fff2-446e-a7f5-85c80ead1584", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339458, "uuid": "f70f8a9d-a743-4718-bdde-bd49eecb4706", "value": "60627b17b9b4c6b777d4d5c1d6fe4d1a0402b147f5e12e10f46c58f13b9ef7aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3775cc29-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783364970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364970, "uuid": "b1ebc26b-7014-4a78-8073-83e5ec315245", "comment": "Malware payload (Mirai)", "value": "92e018eb7fa1898845ba5bcd882cc8fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364970, "uuid": "60e67379-a3d9-40b4-97c6-6e6d7f5d4794", "comment": "Malware payload (Mirai)", "value": "60e17abbe2312405cda7ea5de18b632abcb7e4e20eed09ec1bec9c7351e90884", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364970, "uuid": "e3eb4944-5bd6-4beb-9471-46a8507dd814", "comment": "Malware payload (Mirai)", "value": "778e3fa4c2c4412b5ab5ce10e99099843fd87f09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364970, "uuid": "33f43d2d-5385-486b-a240-d601f7564f87", "comment": "Malware payload (Mirai)", "value": "74e4d9d045357145fa227107fbe02d79b68b78d8bfef65b8e222b5b0544d3273eb17e274b24d2a5e3381f5c4e187f3eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364970, "uuid": "11c0a1aa-5dda-4df6-8538-77fb0ddb3b6d", "value": "T1B7A2E13AC31F5A66CAB2C63A40233EEB0AE9EF591F9D1C39E58455D7016311A3A32631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364970, "uuid": "750dbe72-bb01-4668-97e6-9ed34068ff29", "value": "384:EKEIEdCUUnLyusfDh1liQWFKvZn9kuYfAFRUiTVekMOYzuk20PR+d+YcSiFqcJE:BYck/fWFon9Uf6RUWDYK0PRc+YvsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364970, "uuid": "9ae568d9-bdcb-48cf-a27f-f9960c624c2c", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364970, "uuid": "92eff7b8-6264-4457-ae36-fc95af6c0332", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364970, "uuid": "f1d1168d-cb2e-4764-b2ba-fa29693d0490", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47f7087-78fe-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783317130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783317130, "uuid": "5e94023a-3c82-4259-98e5-7ce1c9aa8cfb", "comment": "Malware payload (Efimer)", "value": "ac82239caf7bd65618ef7a6f19ca2e28", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783317130, "uuid": "ae7fbdee-944a-4b48-978c-06312c28258b", "comment": "Malware payload (Efimer)", "value": "62624a2e9ecc79ab8d667acdf40bd42f1dcfcb2a746b468ba115f09c1b698583", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783317130, "uuid": "6d4df818-be1a-467e-a9a9-4d17a761a740", "comment": "Malware payload (Efimer)", "value": "9b63c74f725b424b3cad0c34579aa9495f817ac0", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783317130, "uuid": "4fc0007d-18eb-40bd-aa19-2e15243e1c5c", "comment": "Malware payload (Efimer)", "value": "c3a3ba0a5475ee50b83c7b53c6b25725fd24c934d1bb74f41f610dbd9d08ec89292b23a52cf0f1a1f6d3e5c94dc84e31", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783317130, "uuid": "fd08ef83-cdc8-45c1-b106-fa15be77bfcd", "value": "T18EE633546DD213EEE9A3D03CAAF15675DCAAB0A20732CADB0728C2A1BE171D45C7C717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783317130, "uuid": "88febe93-6e65-4708-a784-fea7bd0e586d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783317130, "uuid": "0e9900bd-7ebf-4f2e-813a-d0b7ad85b422", "value": "393216:BTxqj+mQOsiAwUQY5zjffD4bvhXMCHWUjXicuI3/PGTAI:BUj9QOsiAFQY5fE7hXMb8XfH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783317130, "uuid": "183b62b8-d68a-4549-a702-64698407dd58", "value": 14285681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783317130, "uuid": "b73a0e89-b88d-4933-89a4-c86c1b1524d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783317130, "uuid": "fda1bf3d-b8a0-46d2-847a-23a32f839b50", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a8203b3-793d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783343930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343930, "uuid": "f20f56c4-96ec-4ac0-aed3-5a1bcdaa01e1", "comment": "Malware payload (Mirai)", "value": "a4ae57995d5a2416995da0346f09a26c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343930, "uuid": "987a5cfe-9c0e-4d18-b5d9-3e54d3511803", "comment": "Malware payload (Mirai)", "value": "626fa3593ecd3aa4e6769b29d216ed5b45e336fbbe63cc0f77adec4a095a1341", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343930, "uuid": "1c19b38c-9123-4afe-8992-af41c6ad5a75", "comment": "Malware payload (Mirai)", "value": "06a768be7e384e3a899e5c22c936a864050bd428", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343930, "uuid": "e809eed0-262f-42d3-b793-8c508ed07846", "comment": "Malware payload (Mirai)", "value": "687784f01d0a0e0ee8de928d551793b9bb6a2b0b710eb2329af0a0b0adb6a4b9a1d616dca3330b47fec729f51a6eeb6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783343930, "uuid": "9a61b1a8-2174-4d52-a90b-7822edbdce9b", "value": "T1188423E468CD65E7D94E7E3741088B2FE9C0E5B0B78B49AFEB86167BDC66C214443138", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783343930, "uuid": "5296959d-3212-4ae6-887e-c5cb8c051a53", "value": "6144:RZYVts0iAq8bhQNYDJqluKqfStIb5Rxy9/B61OU93/43p75ETdRDni:3YIIbT4luBfti6g3p705i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783343930, "uuid": "1b5a8454-a478-44ca-bb5f-1caede3a0f82", "value": 393532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783343930, "uuid": "33a5b7ff-ea0e-464a-a75a-d17c0a5efb6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783343930, "uuid": "de528767-57d0-473b-8e80-240e69425f95", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fcd6de0-7931-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783338731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783338731, "uuid": "deda9c27-3860-42fa-8b68-b9e32e85e216", "comment": "Malware payload (Efimer)", "value": "5735b6cb1e0230dd65daf7ac4be2d1ea", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783338731, "uuid": "53c2e86b-ec01-4e66-8fc3-055336c9d811", "comment": "Malware payload (Efimer)", "value": "63c107795b2fab22ef5ec7b353245b34a58c27640b9f70b1c65f9d5c317b417d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783338731, "uuid": "2edbad84-3f1e-47b3-81de-bf4856be949b", "comment": "Malware payload (Efimer)", "value": "48f7f0293755241c557639332bc0f5e63e0b3e56", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783338731, "uuid": "214cc3fc-cbcc-45ca-95d9-d8246aab5348", "comment": "Malware payload (Efimer)", "value": "64664dfecf34ac928be24ace070519f1885a4ce4526a0e9f2814235079d458292b399cbe4526a661492d4e4fab9b8a0e", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783338731, "uuid": "b698ea73-171e-4c64-8bf7-21bd1476e327", "value": "T128E633246DD00AEFECE2413DEAF25A95F605B8D31B32C1CF565853926C831E18EBD663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783338731, "uuid": "34aab4ee-867d-4250-9506-2a0f64be352d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783338731, "uuid": "729ad0af-62d5-45ce-9cd0-ab4d0ebd2f00", "value": "393216:H2R8NXC4+5XBhZDK8+5/y4SXMCHWUjXMcuI3/PGTAI:H2wXT+5Xr075/WXMb8XZH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783338731, "uuid": "c5a4d67e-8de0-4fbe-a4a4-c6b2b9b76cea", "value": 14318786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783338731, "uuid": "d9edfa4f-836b-4def-8ab5-93605d4e0d2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783338731, "uuid": "e7e25148-c7ef-4283-ac06-7f788f3fc445", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380711c1-792b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783336195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783336195, "uuid": "ab6aca6c-476b-4a49-9f33-6311440b745a", "comment": "Malware payload (ConnectWise)", "value": "c2a26a388bbbf3ee700b938de066838b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783336195, "uuid": "5812cde8-f214-4e86-b54c-c6ef87c8fea6", "comment": "Malware payload (ConnectWise)", "value": "651a82b426efa1053fd38f2d28617b4324a74787934780d88c64b1cf0638d9cf", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783336195, "uuid": "5e950754-3c5b-4778-abc5-e04662af5769", "comment": "Malware payload (ConnectWise)", "value": "bc673bbff3aa61ea4f719aa3630020f6033d9133", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783336195, "uuid": "c1d4e1d6-4d33-4f2b-9c56-34bf93e4ce1e", "comment": "Malware payload (ConnectWise)", "value": "52cba900ab2040284d5d3d9a7ffeb0b62937b88dc037a63cb5bdb792e4b7b5ee94ca282aa17540b4e2d71f769bb51404", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783336195, "uuid": "b5144605-62f4-4d86-b39b-b6d02c6f5f09", "value": "T18C647C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783336195, "uuid": "515a21f9-ce67-42c5-81a4-f67012ba9899", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783336195, "uuid": "7b4bf00d-2283-4de9-80a3-7fe57327585d", "value": "6144:ymlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9M:R1iw7gryNkSV1hy1Z1u2JLu9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783336195, "uuid": "e7438ced-2aec-4ac6-8d63-932f01d45de4", "value": 312544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783336195, "uuid": "7370fa5c-4522-4c56-8e4d-92e9db2d504e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783336195, "uuid": "03ea29b0-98c1-4021-a9e6-fa4e8354b642", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3f49037-795b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783357046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357046, "uuid": "25bf4b22-7b91-4007-9d08-8d32c20054f9", "comment": "Malware payload", "value": "06f4b88363d2151952c305b819d71145", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357046, "uuid": "f8afce18-1c3f-417f-8d2f-740faa62b142", "comment": "Malware payload", "value": "6627ea7acdef08a231ebf979d35b48089ac139dabb195188942ea2761636a87e", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357046, "uuid": "01101fa3-38d4-4393-95ea-f0752c9d300e", "comment": "Malware payload", "value": "d4a16a59baae4a82dcdfd3203d0566533d656aa0", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357046, "uuid": "02ba5fe6-6975-4c2e-8280-4f94ed573018", "comment": "Malware payload", "value": "c83a8baf4b90e2b1eb8f04ed84217c8953dc9d451c62854b76ffeb000a315bd17641560fe5a5df9e4920791852721d8e", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357046, "uuid": "be7311a2-093e-4b2f-9f53-07485312a8a2", "value": "T1E41833187F28FC86C09DB13F77F76E341B5265070921AF2B12A3859EA59CF2693352B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357046, "uuid": "3926095a-b66e-42f3-81d7-cad12b4dd84e", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357046, "uuid": "e69b9088-362e-4d3f-845d-621df5bbba26", "value": "1572864:gq+BWMFDe45kDJ3V6hDRVO1Jhh94iybSgq/hQv5n0PaRKrMzgBXCOwffoGWkt7r8:g7BFle45+5ohDRVgJhh94ilgohQv50Pd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783357046, "uuid": "1c58aaec-c1a1-4268-bd0d-044000dd2387", "value": 90159983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783357046, "uuid": "11e58dec-5b19-4b3b-9980-40b1f9492cdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357046, "uuid": "63ba793a-3765-4898-9573-9beb3a575344", "value": "PlayboxRPG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74825307-791f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783331143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331143, "uuid": "e6730a37-8b60-4868-b05b-5f802d5c4589", "comment": "Malware payload", "value": "3134415d73d79fb9c686a311359ae21f", "object_relation": "md5", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331143, "uuid": "72b67e4c-0711-44a6-9b27-2e80e116e762", "comment": "Malware payload", "value": "66a8029fde99c6fbab52680a16ee9f055872c899a9d5e38a7d8f713c59c16828", "object_relation": "sha256", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331143, "uuid": "ce2b6187-e202-48cf-b7d8-1010ebae2977", "comment": "Malware payload", "value": "28ec7cfecf571d5bf2ff7b6805559879f0a4b62b", "object_relation": "sha1", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331143, "uuid": "65f9515d-ca36-4757-a24a-c4c314bda6f9", "comment": "Malware payload", "value": "d1064d9fd8b0ff9231de25563b30486b6ff282b9cb1cea87feb3cdd578b44b6d6bc32812939f8c57f8869d7729c3417d", "object_relation": "sha3-384", "Tag": [ { "name": "xml", "colour": "#F1868B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331143, "uuid": "e87b7880-c7cd-4106-b346-541ce009bea5", "value": "T16B01499C96A89B4104BFC486F2F54024E1D2D19BA2F4D3C6F38D05666F28D5E385320F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331143, "uuid": "4437f178-7af5-4638-a784-0ec0957798e1", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+RjikxHlkxpZhG+E6:FH8j/wWi2jzxJxSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783331143, "uuid": "9ba10648-7618-4514-baa7-6a3105f6aaf5", "value": 727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783331143, "uuid": "ac3d3014-1bff-4a0d-a2e3-c04d5e625e85", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331143, "uuid": "fc3c3dc7-f898-4dc8-8a9b-ae1d132c5fb6", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6dd1c61-796c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783364352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364352, "uuid": "41461ef4-a650-4a21-9e87-a8fab21fc3df", "comment": "Malware payload", "value": "d0bb3262306f8f4da1c3b6757547c39c", "object_relation": "md5", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364352, "uuid": "23762603-63f6-471c-a9b9-8456dd70072f", "comment": "Malware payload", "value": "66eed13d3010e731814a024ac2142e331eb7fc250bbe5f2177c2d97f2656e68c", "object_relation": "sha256", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364352, "uuid": "8c499354-f508-4b87-ad39-071a833f7b31", "comment": "Malware payload", "value": "a6d1b92c1ee6aed4d4401dcc35aeaf4e6595c9ac", "object_relation": "sha1", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364352, "uuid": "6fe7995b-509e-4234-b500-763f92534c85", "comment": "Malware payload", "value": "8ad8ba6e7acba0e7ea4f61aa1778f2dc65e2454ff24c44f1a86d26c393a0316636e3563523a806d4d8f84a80358b7032", "object_relation": "sha3-384", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364352, "uuid": "13bf7459-47fe-4f13-85ea-511e39e53590", "value": "T1E9F0D86CD6A6CE02C04E06300A2B04C20C34CB9A3C28C26BD91E65EE85A97C08BCB4A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364352, "uuid": "57109720-74ec-4112-a9fd-214a098c0a4c", "value": "12:5jcT0/agYdvPtaE+cTE+TLYVSq5Hy1SVF3TeJpHocJUGWVN5Dk:9a0iZM0TtH4S4HmSvqHfU1vY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364352, "uuid": "76ab9c71-a3b9-471c-82ce-2d32a4a485d4", "value": 646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364352, "uuid": "93420981-9edb-4f09-80b5-932a2e7ae7de", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364352, "uuid": "d7069266-ac9b-457a-af57-8da4f4fc8890", "value": "photos-55869729845700.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6ff2d06-7948-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783348917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348917, "uuid": "d4de1c75-103e-4983-a213-b65e88d3a330", "comment": "Malware payload (Mirai)", "value": "990b5c5eb7044e4261843ca8ebb53a5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348917, "uuid": "291a8113-7350-4936-85ba-f59358d0aa3c", "comment": "Malware payload (Mirai)", "value": "678cde700f136fd30dc020e626a2d72f1b604de262afbcd005a93b8ca7dd58bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348917, "uuid": "b8cbe57d-e99d-4fb4-9cff-64bd6bd04732", "comment": "Malware payload (Mirai)", "value": "b80202b6d119608e6313d08c510395692d68a857", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348917, "uuid": "a1732c6f-9d46-47f3-8547-509c84d5fa42", "comment": "Malware payload (Mirai)", "value": "4a060df8287f74bd9bbbe1573ba73a5f405f64e30add04bacd5967e40b5639b90c9b5830989d0b20a3fc888277a8bb24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348917, "uuid": "c72ba7f4-a979-4d1d-a23a-160f5e0a1ac6", "value": "T1F0E33BC7F900DEFEF80AE73B48130805B230B7A155921B372257796BED3A1991967F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348917, "uuid": "c8c0aebf-83cd-4a8c-bc0f-0cce8f750247", "value": "3072:J7JiNTYyq0LQyJ0Am74WrgN2EdS5UV4jbiFLy3FAlpx:J72UyJhm74W0NfS5MLe0x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348917, "uuid": "b1ead865-1ca2-4dce-b3d6-2cdabc9cc51e", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348917, "uuid": "6e59f639-f63f-41f3-830f-72e32cd06892", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348917, "uuid": "163e0eb1-ec6d-44c9-8412-fea632e24457", "value": "atomic.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5105b6-7912-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783325463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783325463, "uuid": "bbc0f1bb-540d-4688-bddd-458a5951bd3a", "comment": "Malware payload", "value": "2ef6fe846f0e2986d0bf8b24f7de247e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783325463, "uuid": "99c0de9a-c709-4bde-9600-1fda241c54bb", "comment": "Malware payload", "value": "67d9b0935e64a95a6db84ceaa5f297b7d9ec23304cb07cc2c00c1e24a5312408", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783325463, "uuid": "4012ea42-b658-4e6e-9d03-f029d72030df", "comment": "Malware payload", "value": "ac9f4fc2bbb5e3e82df3f011c0c0c3289966728c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783325463, "uuid": "ffaaa233-f255-4195-adb4-c487eebd3e8c", "comment": "Malware payload", "value": "ba629a35b8bae416e3093c7805d20a254bce68fe4e53b6edbbc4e4e27fd5f4c7e00cec6f202fc4d936720d216105ced8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783325463, "uuid": "3177839d-77ac-4efe-9c12-84394ebf62e3", "value": "T11608331C97B9A19BED6E4CFC25B0F9B2FA2C60396E2C38979FE430517172408067959E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783325463, "uuid": "9a5d145c-19f5-4f13-8689-707e7db1ce4b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783325463, "uuid": "1a8d0cb0-1b54-4ccf-803d-b4a30707e188", "value": "1572864:Ft9IKPa0z3AzooL3YieTqowzKYypCPRfYLgRLlPBnU6InslA9dVuA+7:FUK5brorYAoyKYyuB/5PU6InseuA+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783325463, "uuid": "e49fdf0c-af68-4849-933e-5eeff629937e", "value": 81688625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783325463, "uuid": "c29dd59e-b0ae-4c7e-8f20-f724e734f59f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783325463, "uuid": "65ae77ad-60ff-4cac-bba3-4bab75facdb0", "value": "Fairy_Game2_winx64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5745ce3-7959-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783356243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356243, "uuid": "d8b816b5-abe1-4e6b-96da-e1f5c02a2e94", "comment": "Malware payload", "value": "91231b452180b1f04f414290f05e3a96", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356243, "uuid": "4c0c05cb-5e6e-4d4b-a2ce-c61297ab5888", "comment": "Malware payload", "value": "68822ae592a4e44984186eb70b76fa1e7563f83b0c89bf9fbb231acfd9122f49", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356243, "uuid": "9247c9be-dece-4c01-b328-bc91fdb4a7a1", "comment": "Malware payload", "value": "32e45179dce4dca18dfa542a4ac96958dc0a6545", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356243, "uuid": "e5af13d2-cfa9-4532-bdc4-edfeb3545f1f", "comment": "Malware payload", "value": "a665bfea43fa76eda7fe44c0b8cb73e47f6706e037aa96b8fefa36b35c774b17a238760abaa7e7ce2c884ea62134bb84", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356243, "uuid": "403179e7-9b63-4dc7-ba3e-e89e826389e9", "value": "T1B1083324012380A4D7B774F25A67E710FC25EBB9AEB6046DE98BF8D532B6095015C7FC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356243, "uuid": "4d23807e-416a-495d-ab6b-5e68a14d315d", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356243, "uuid": "703e1819-68e2-49f7-bf0d-20d55b159dc5", "value": "1572864:Qt9IKP2qGRWYKrrtU1GfPiw0P9myNR24Vkb/3UwW22QOn+j2VVY7:QUKuqGRWFr5U1Gfm99R24VkbvXWkovY7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783356243, "uuid": "789a5a8c-34ec-48cb-bccb-7b4309ca91a0", "value": 77729513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783356243, "uuid": "db657bfe-ab9f-4123-9c47-074db2de72e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356243, "uuid": "f0ff2730-8297-487f-a67b-d7bdbdcf9328", "value": "delta-exec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e43c3852-7930-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783338631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783338631, "uuid": "bc089c90-6d5f-434c-978e-b0f2186a5d1e", "comment": "Malware payload", "value": "83c3bb7975e68fb0797e5c83f897920a", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783338631, "uuid": "8074a50b-4f48-4306-ac7f-d76e2f8b310d", "comment": "Malware payload", "value": "6a8a36f8fbaffae415579c9baf660c1fdb9013c7ca0460ba68c1196dbbb44510", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783338631, "uuid": "8db3ec03-7208-4762-9196-f78e149dad98", "comment": "Malware payload", "value": "e7f99ff2ac158c82cd0f51c3e05c054797bacf8a", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783338631, "uuid": "e0d70dae-e3c8-4730-b809-f0caef4415d7", "comment": "Malware payload", "value": "80c79e6f2668d9caf44030602d98a9df803b84ed86df07b1a3fc9ad9aae55ac8046dccd5a024950263591dd568dccbd3", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783338631, "uuid": "cab8264c-5868-4076-80cf-d1ff9f1b202e", "value": "T113A65AD71A8A68ACC786EAFB8534703FDA03B46553AA71EF563A72EDF613D147024340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783338631, "uuid": "28f67cc8-0828-4f20-98c7-99fa609d1107", "value": "511a9f08ad049024ceadb3547f453c54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783338631, "uuid": "8917acd3-d826-470c-966e-0c0ce3eda11c", "value": "196608:HHid9vyObfMHl8mq7/yKm9b5G8JADSIsUzxoVU7lvIcBI:iDpU+FKn9b5/yNoqZvIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783338631, "uuid": "14b94433-4e88-4ffa-84ad-091c93976974", "value": 10113536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783338631, "uuid": "caa5b80f-286a-4fd4-9573-ee5979384250", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783338631, "uuid": "176bcb99-d01d-4222-a661-1085b7dda72f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ece48f8-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783364983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364983, "uuid": "990e7e81-8c40-42b0-8631-8ae9c5259d8e", "comment": "Malware payload (Mirai)", "value": "360e13a823722f5c9a2cb5fe0232a147", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364983, "uuid": "f995d4a2-e0aa-48fe-9a39-32b4535c0415", "comment": "Malware payload (Mirai)", "value": "6cc4c210350ead3c781a49ab47cbb19b72439b078826a6cf1ebd06bad21fc45d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364983, "uuid": "cfbb845b-8114-460e-b914-f274c069f061", "comment": "Malware payload (Mirai)", "value": "15fa1bc6bdb51b636cc9347afeab07864fa651ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364983, "uuid": "36250f43-6d45-40aa-bb9c-d56a82270717", "comment": "Malware payload (Mirai)", "value": "adb7a7b4cc9c84a137bf08ecfc4baf291db69fd755878c216ae2d823bcd485339e10de748fb1923a60b36c6a3c3e8545", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364983, "uuid": "029e304e-d80c-4979-8bb3-209f8f727a0a", "value": "T162B2D0AEE23471C1D38D7A7E108E17B21C946580339E879C73E24D9CBA3575EF0680BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364983, "uuid": "e592ab9c-ad72-4f87-a08b-97b619b45236", "value": "384:X0kOhodP2pvafAXVdBT3yNwp/zlFEoCXhGV31tUcQb6AwMLRWGVCz0NvEZ8:XthsWUd4wprlbmGt1lQhTWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364983, "uuid": "0489beba-4f42-493b-814d-990f2d2ef891", "value": 24172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364983, "uuid": "009143c4-d92b-443e-b44f-f08a85389536", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364983, "uuid": "270d9aeb-25a1-4361-b57f-b7b76bfe2a07", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055771d4-7953-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783353290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783353290, "uuid": "a9bc1114-2273-4478-9874-dd674c4e064d", "comment": "Malware payload", "value": "7c78cd36b7dbcb2d7aec1afb683e5ce7", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783353290, "uuid": "132083d0-da9d-451b-8255-214a2b71db60", "comment": "Malware payload", "value": "6dacf28164ad873fe98c5d583e73531cded11dfcb2955146b1adc333b3510002", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783353290, "uuid": "45c2ab29-f789-4642-8942-d30c6f2cf775", "comment": "Malware payload", "value": "81d801ae7cce4e54fb070258e5878227fb87c8c0", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783353290, "uuid": "48c94489-6da2-4be6-b9f6-b94c1bea5962", "comment": "Malware payload", "value": "a7d77ad299e9c1231dfc034d8ef4ae89e57d75321508503c085be9f35f040473442adb2bc704117fddaeaf68571a627b", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783353290, "uuid": "14bd786d-0042-4438-b46b-6b46003eb2b1", "value": "T1D08633867CCB29B2F403C7B09893622E33667FC58DB84D0976DE775C2C721259DBA246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783353290, "uuid": "cc3d2c85-3b7a-4fa6-a665-9556233f5c1f", "value": "196608:dVDuo39jPbm/hnkr+1n++NFUjbPKRbH9aU:dVDuoNTbm/6k/acbdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783353290, "uuid": "194a27a0-0afd-40cb-a607-a462665117e3", "value": 8232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783353290, "uuid": "62210ca6-2b2e-4151-9c92-9082112671e6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783353290, "uuid": "91953986-ab8c-4970-a46c-a8465e9043e3", "value": "zinst.6638258013.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd95afba-7929-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783335668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335668, "uuid": "efa3619a-3738-45d0-8d38-9f646f869c44", "comment": "Malware payload (Mirai)", "value": "8f57addeb19b852bb11b3415bcb54bea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335668, "uuid": "15125c47-3068-44dc-9f3a-7aece8b0adee", "comment": "Malware payload (Mirai)", "value": "6e709fb9b09d9f8318724a8620812f55411a3ea49de6319c4832885547773ddd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335668, "uuid": "61c135de-4719-4210-aa39-956dd32aae3e", "comment": "Malware payload (Mirai)", "value": "642c5dc813d61040009376c6360bc8b1a2390096", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335668, "uuid": "b70f6940-9804-43c6-a692-2ab3e853f21d", "comment": "Malware payload (Mirai)", "value": "b97d136a108923ab4c96ab043ae6106c765066b5c0a8b9fabd32303e5a00967181d11643d0a2f366f2ca9de060260976", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335668, "uuid": "1151abda-3569-422f-ab98-4c6ed8e3f501", "value": "T1C124C60AAF610FFBD8AFDD3746E90B0635CC650722A83B3A3674D924F54A54B49D3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335668, "uuid": "ccf1dfd6-6eeb-4781-854b-d196dda835cf", "value": "3072:PD/6gT7DbU28Mn0NawZ5aMBjv+7GYNREV1:PDND1f08wZ5Fj6GY3EV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783335668, "uuid": "2de4b4b7-81ce-4c8e-85b7-c265715cdc21", "value": 211648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783335668, "uuid": "0b952b6c-dd6c-475c-8851-ff81781905df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335668, "uuid": "1da53462-098a-4c90-8eac-310f62fd692e", "value": "iran.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc7f0dfc-795c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783357463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357463, "uuid": "aced56ae-85a5-46b0-8274-07ded45a3906", "comment": "Malware payload", "value": "8ffcbd8a2d5b9429339ee1c0a3dc68f4", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357463, "uuid": "0ee20007-4f81-417a-8843-8daa499a52d4", "comment": "Malware payload", "value": "720a3c7352a4ebaa95565e234fec74865a2dbe4e90e5e9cb308c8575e21f6565", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357463, "uuid": "f6fd0df2-433a-480d-b71b-0f6a001b4187", "comment": "Malware payload", "value": "c0b6f8e9391136a6d5377a2964607e74f6ff8133", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357463, "uuid": "96e609c9-7ef5-43d0-a006-c99d5f97e67a", "comment": "Malware payload", "value": "bbe48be83c7a5653093e9fa7a04b7229217ca3f4e8c48ff1a477ebb6aa43fd1dab20b78fc3e07251430fed2893934bf5", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357463, "uuid": "31aed1f0-ae13-4cc5-bacc-bc7a5d6ff418", "value": "T17DA59E9DEE69168AFD7569C249EFB7994086BB223D014C36957C1E0847380FF74A382F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357463, "uuid": "ff009fbb-e714-4145-bb55-49f5dceef891", "value": "9a8ed8c7d7ad2a34dbe2bff76e02a968", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357463, "uuid": "16d857bb-191a-4920-933d-f2f6541f7503", "value": "49152:zOOAToMTttOtLsUvaWNsOHSYpMaaU0OGYjflMY0X5k0WnvpKBqR8Xu:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783357463, "uuid": "52d181c0-c52d-4cc3-b276-b5fe53fb1ef8", "value": 2098176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783357463, "uuid": "f4cd0b4b-3d93-4b6e-a82e-ec8a35d1a5f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357463, "uuid": "5680c96c-05c5-4cb7-b75f-045772344f39", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffe24b6b-7973-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783367454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367454, "uuid": "c2dac110-5793-4a80-b883-c31aee33649f", "comment": "Malware payload (Mirai)", "value": "a9ad29e991fcffebb40e9e6e7f7c435c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367454, "uuid": "cf547461-a8d6-4bd6-aed3-f86b870bf523", "comment": "Malware payload (Mirai)", "value": "72cdf2c971f2a498a7bc1ea88e248945e8adf6e946273db0c5a533e8f0c0eae9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367454, "uuid": "959cbfac-bb5c-4c30-ac52-ec04a9e6e578", "comment": "Malware payload (Mirai)", "value": "646264959d1d8d6771770b45d0dced44de948f32", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367454, "uuid": "116c5d17-94ba-4400-9b0f-b87861b1f0a4", "comment": "Malware payload (Mirai)", "value": "90679cfbdec57c06567c31894606e5ed0450fbe347f87cc28041cf7b90e7afa615fe84659eb8f8913287d2132100ca86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783367454, "uuid": "310d1b62-5116-4a0f-b545-2f4c1865a181", "value": "T1B3C36B92BB197E3FD5B6493A848783057B38ED409E463613502D76576EB32D00E3B7CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783367454, "uuid": "84b2a5f5-36c2-4741-b732-935da6cbb623", "value": "1536:yN8l06ExEUF+Ap9HR0w1azgUoiTAT7oCvJ+EGMaGjQrRQrYxewBOUMwNN5X:c8lw52w1azXXQ7Jv2voYt7Mkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783367454, "uuid": "3d501e23-2bbb-4dc5-ab70-6a0a3a332536", "value": 125076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783367454, "uuid": "75bb7dd5-7ba0-447d-9aa7-4591b8a91408", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783367454, "uuid": "02ea76e3-0db2-4a77-abab-9d3f0b1324bf", "value": "m68k.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1729361-7919-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783328775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328775, "uuid": "75942f33-bd8d-4729-be94-356f22287bd9", "comment": "Malware payload (Vidar)", "value": "04e2b1d291a58da69068840d6770f72c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328775, "uuid": "828a0b39-c887-4ac7-9ba1-b73ab4c98b27", "comment": "Malware payload (Vidar)", "value": "73800c2cfcd9be75abd98fcf47dfcd3f110f9a0967ee2d52d5cd1c5e5c9d42b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328775, "uuid": "13b5ce61-6c97-4ea1-83f6-386a011ac56c", "comment": "Malware payload (Vidar)", "value": "78f76825a4e6075f6f7571194c6d989269b704ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328775, "uuid": "45c06e14-122a-4990-a34f-4f67e0606f59", "comment": "Malware payload (Vidar)", "value": "aa5a7a332c86bdcb71018021331146edfe307c03d5a163f6d183a0e84aacddcd5bf12d3d8197b78a71e0881ca9722849", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328775, "uuid": "5233f839-b164-459f-bdfd-d294c8db3947", "value": "T1F152FBC6B19365B9D16F8338D71A1277A6B1305403266BFF47CC92580FC2770AAB52ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328775, "uuid": "4cebc49d-4b48-4625-9a70-af0bf9b91f50", "value": "183cf4601240c6239430ecafd27c9723", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328775, "uuid": "d416e855-a1c9-45e5-9a55-250d3913bd5a", "value": "192:O31G2IcSd+t9xIBk2zWoQoxBE5huzUKvkOyot6gQr8th3VOsE:OlnjEYwVzW2x+QsO7tqr8thlO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783328775, "uuid": "74f479c7-4d1e-4ce1-b945-e295215993a5", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783328775, "uuid": "b1552549-69d6-4f61-9118-4fc2e9a738d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328775, "uuid": "0aacbcde-b1e7-4f78-a811-5b51f84ff4da", "value": "04e2b1d291a58da69068840d6770f72c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3838dab9-792b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1783336195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783336195, "uuid": "2254f5d2-646f-47b6-9d48-b1aeaa64b89f", "comment": "Malware payload (ConnectWise)", "value": "26c722dc53ea775a91e105569e6138c5", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783336195, "uuid": "9b1e0688-ac19-4f4f-bf53-5130ff52b552", "comment": "Malware payload (ConnectWise)", "value": "739daec38ce1a857f5bbe3d199e6c129be79014006afd5da0f53ac84f9483afa", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783336195, "uuid": "a5502c2b-fa61-4e78-89eb-2cb89d16afac", "comment": "Malware payload (ConnectWise)", "value": "ff1c77fafb8f58c31df9ea5118ded6091b0c2406", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783336195, "uuid": "d1e952df-5b02-4439-8396-4303a4dfcc83", "comment": "Malware payload (ConnectWise)", "value": "c8379caef1799fa77fb30e094ae40616b097556b87d62ae6c471089cec7fc67b9f61cdc9555d489035d38a9b90544d37", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783336195, "uuid": "795ea163-0104-437e-b9ff-6e877046140c", "value": "T18346E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783336195, "uuid": "bc0cc16f-ad0d-4f38-94db-91ad743209b5", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783336195, "uuid": "b705d303-033b-494c-ae3f-1cc3f3ed75ae", "value": "98304:xzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:xhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783336195, "uuid": "8e3c3223-9321-4a8c-a243-9c1f411a529d", "value": 5643448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783336195, "uuid": "bffd7449-58ce-48ad-bc3b-c8b8670301a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783336195, "uuid": "c7fbacfd-5b97-4dfa-853e-8309e8912c0a", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42137f66-7959-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783355969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783355969, "uuid": "dc7dee00-748f-4ebe-b391-fc7fbb320674", "comment": "Malware payload", "value": "f9cf00b582212c8217eb8c2ed80fdc14", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783355969, "uuid": "af7aec1e-dbe9-46df-9367-8855908f7b0a", "comment": "Malware payload", "value": "7523d3e9f57b02354311fb5d8b6b5eb69bd4e619d9dbeb727baae75ff6bfd1ea", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783355969, "uuid": "1c034949-357c-4533-9be8-0b3c1c3b1637", "comment": "Malware payload", "value": "df38c2b2d5fae56e9873d11923d3b13d12199a47", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783355969, "uuid": "8dbf8456-7265-4056-895e-0c269e43d58e", "comment": "Malware payload", "value": "9536759a63025f06a4cee79090b680d35e9d6b0e3ab2b1c24f656ed8dd6340d9757818536f95c55fbbb774d95c4475a7", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783355969, "uuid": "6d480d4a-3ba5-498a-a657-9972a6f08ef6", "value": "T1C808336C1131D098E61591F710D5BD32E3C8C222B13498AD4A68ABF057FFCCEA5DE6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783355969, "uuid": "66d552a7-3eeb-4f7a-b9c8-983c31470663", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783355969, "uuid": "a6e2ca76-08d3-4044-8411-2eec3b4599a9", "value": "1572864:Nt9IKPlR2wdRWYk2IpeL+QvGRJMpuoF3bI3IRVAIa5Ki7:NUKGwdRWvHpeLDGRaRBbI3ik5Ki7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783355969, "uuid": "83ce42a0-b3db-454a-bfdc-3451a6043d10", "value": 77625609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783355969, "uuid": "e9970908-d47a-42a8-8768-c1c5890e79cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783355969, "uuid": "08412253-a29f-48ab-abd9-8f69ae5211dc", "value": "ClaudeDesign.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabdc309-7948-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783348977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348977, "uuid": "c80b5317-8c90-499c-a58d-4bdb214fcf17", "comment": "Malware payload (Mirai)", "value": "3f6487eed88042d9ab34c69fe605c769", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348977, "uuid": "9ccd37f2-f77c-457d-a5d6-2364c8879369", "comment": "Malware payload (Mirai)", "value": "7577c0e68951f76a996ba4277d8033160bf91cf45278dee2d74f7ddeb560c2cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348977, "uuid": "4d740213-d7ab-4087-8cc5-80c3ec44601a", "comment": "Malware payload (Mirai)", "value": "8a3f01085ba88ef7683616fd941a3cae7a2504aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348977, "uuid": "d1cd3b46-61c0-42b6-a4ad-06adbdee6140", "comment": "Malware payload (Mirai)", "value": "1c65c402b9a1836cebf8bc2866baa2125420160797334f580fd8f60ee103c7c2ebb06319a0dab288907a9bc4f98bbecb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348977, "uuid": "8aff1317-1c40-4f27-b651-c0c35c450cb4", "value": "T16EE31A42F8818B16D5D112BAFE1E128E33231B78E2DE73129D246F64778A97F0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348977, "uuid": "bf1cf489-cb4f-43c9-b8bd-c10bc951ce06", "value": "3072:KH3z8g2UKG7xxX4PSaQzazah8eCalbwvQOk5Y:Uz8g2p6xXeSa+aGh8epCQOsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348977, "uuid": "949751e7-54b3-48b7-b9ea-fc60e7b32d3b", "value": 146268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348977, "uuid": "ef84931c-13b4-40b7-bb4e-13bf550a6780", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348977, "uuid": "4cc97ce1-2ea1-4b69-82c4-aa8e2b78bdf2", "value": "atomic.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b102070-7937-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783341488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783341488, "uuid": "032b6ddc-4c7d-4b41-ba4b-719cf3f21883", "comment": "Malware payload (RemcosRAT)", "value": "ccd07811a2b885361a3495d92c2b9e61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783341488, "uuid": "f2d9824f-1748-4a6b-b833-986873dca560", "comment": "Malware payload (RemcosRAT)", "value": "75879d86cbcb3ece0ae2586a94c84cc867af39a799b9faa20e914eea8d9e323b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783341488, "uuid": "2a6bb2ba-93a3-4787-a442-cb349fede7bb", "comment": "Malware payload (RemcosRAT)", "value": "80e2a9e587eb8c68f6e969b1a58a498ad3df9554", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783341488, "uuid": "37351827-63b3-4e77-8b14-3dd2ecd1087f", "comment": "Malware payload (RemcosRAT)", "value": "55f24244ffb35fab7ca46163a3d92af1eaef280b0f6af2c2320422c5468f25af9072a8449bf2bd6fb4ce668c260720c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783341488, "uuid": "efaf2e03-4fc3-4192-b69b-304c9dd2aecc", "value": "T15902D297C92ECCFE6F3A163B108131C5A28D8296CD0E83337D2EA07D6767C1485F2959", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783341488, "uuid": "f04b1808-2b82-4b7d-9a8c-e890f725ea78", "value": "96:VTpkAfculHfNXsPx0mnCtmsSF9eN2v24j3ZN2+UQhXj3tKhS4Q3RTb7UVE73QNLQ:FphfculH/mnuIrBUQhzIhVQ3Rn7qyQOL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783341488, "uuid": "56dae8e5-3783-49ee-8128-c98914e7f810", "value": 8419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783341488, "uuid": "186469d6-b53b-42fa-b2ce-3b2c77bc0218", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783341488, "uuid": "ba766ba0-aeae-4b46-afa0-f782afe1617f", "value": "wegivenebstthingsforbeterplaceformebetthingscoming.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbaf45f4-791f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AdaptixC2)", "timestamp": 1783331316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331316, "uuid": "422994bb-6d10-448d-9ffb-2e41adbb974f", "comment": "Malware payload (AdaptixC2)", "value": "7f54e49addcff9e77e9f530287b61559", "object_relation": "md5", "Tag": [ { "name": "192-142-51-51--18080", "colour": "#2484F7", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331316, "uuid": "717fbcf0-bb06-4278-b7ff-4c34efa8269b", "comment": "Malware payload (AdaptixC2)", "value": "7675d23d748b0f2b60d9c074d6db1e843a69efd541bd96077065d04b5daa5637", "object_relation": "sha256", "Tag": [ { "name": "192-142-51-51--18080", "colour": "#2484F7", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331316, "uuid": "6d9ab797-2447-48ac-8bde-acfc0d7641b9", "comment": "Malware payload (AdaptixC2)", "value": "4babb4ab84d95205b34f869eb87378d9e2b4fc60", "object_relation": "sha1", "Tag": [ { "name": "192-142-51-51--18080", "colour": "#2484F7", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331316, "uuid": "40c23b73-82b0-45ab-8518-14fd85efbd7f", "comment": "Malware payload (AdaptixC2)", "value": "1e5ad20b63a9bea39b4f11c7108a42ce726bb8dbd4b745bc12045915428c1b84c183e3f0f26ce3770f288822cd4474d8", "object_relation": "sha3-384", "Tag": [ { "name": "192-142-51-51--18080", "colour": "#2484F7", "exportable": true, "hide_tag": false }, { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331316, "uuid": "f4cc756e-53d8-4733-a29c-3e39cb51a9c7", "value": "T109565B03ED9515E9C1AEE2318A629253BA717C485B3123D72F60F7382FB7BD06AB5740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331316, "uuid": "d932753c-1979-43e6-82d5-89523ac6d1c7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331316, "uuid": "7184db0e-c6f3-4e57-bc02-b8d947694b8d", "value": "49152:ZYdSYAEMr5sh+W1BJ01u8XwztBkxn5AxhGOOAY4gTRZ7pqgOKTjbrVwKLK9KtScz:ZyQjlXw8d58GOGlpXl5S6E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783331316, "uuid": "9c116141-e21c-4a80-bd08-c3dfb18b3923", "value": 6262784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783331316, "uuid": "bfea066c-752b-4398-be13-74bcc5eeed4d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331316, "uuid": "5780a864-7eb6-4372-8dfb-d4c0823bbb72", "value": "beacon_windows_amd64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "222350dc-7947-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783348184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348184, "uuid": "c75c255b-ebf4-4a79-9238-e0a4cd100042", "comment": "Malware payload (ValleyRAT)", "value": "93450689153d542cd52383b329760821", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348184, "uuid": "801ae1cb-4d2a-447e-b400-921067846cd6", "comment": "Malware payload (ValleyRAT)", "value": "77e220b261fbfcc539ecab0d3567603ee3e261c02ad1a26c7ce19e513f240a4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348184, "uuid": "5637d493-f9ad-4d15-be02-b0425b677302", "comment": "Malware payload (ValleyRAT)", "value": "bd2157498a2ddd17334012f66dcc40186a724c61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348184, "uuid": "68ad804b-daaa-462e-8d6d-e27177ecd48b", "comment": "Malware payload (ValleyRAT)", "value": "99c69b758231c79947fff977efcfe186c2553b43e3fc8a5167ea95096f738ec407c98a04bfd840b64936dd6ef91bc314", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.wos[dll]", "colour": "#9D8D4E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348184, "uuid": "e84119ad-e760-48c5-bfd1-5843afb5bf88", "value": "T19737234122E94795F0B3A6B7CF750875FC66FD368920C71F0095781A2E3BB80A56AB37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348184, "uuid": "c71a6a0f-b2f4-4646-96fe-d2a371188c7c", "value": "17f6fa8fd9f3c92a057c409d23179d38", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348184, "uuid": "033df4c6-d188-41bd-aef6-25e1abedecab", "value": "393216:pMbNA7qAfDvnNPdRzinvkm5/MSfXpu9A+HFScpK4/4WqhE5MXOYPcuebgLUHMMpA:CNi/fjN1RzpA/n5u9A6FVpz4LhrXOYPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348184, "uuid": "c8ce16b8-b730-4245-876b-9f68c0f75927", "value": 23565152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348184, "uuid": "5a011627-0007-482b-a20f-3ecb6dc4db8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348184, "uuid": "d2cb07a1-f0bf-470c-9ed3-e41dd53388d4", "value": "gtqvpx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42ca7854-794a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (GCleaner)", "timestamp": 1783349528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349528, "uuid": "07906966-aeca-4790-b02f-45a6f9c5df33", "comment": "Malware payload (GCleaner)", "value": "aa55e7077258421030dbffcdcdf4f286", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349528, "uuid": "d60cb4d2-1880-4995-a5cb-6b1fba118da9", "comment": "Malware payload (GCleaner)", "value": "77e2e6ed9670b21b6f2f0a6ca1498e79ae0990986235e98627cc067809947137", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349528, "uuid": "c7ca6aa0-ec32-4161-8c02-82b5f726c0d1", "comment": "Malware payload (GCleaner)", "value": "2714012d13f2441e2a8d0063da07b4aacb0a63c4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349528, "uuid": "9fc66ca7-7abf-44b5-a43a-f1e522f809ed", "comment": "Malware payload (GCleaner)", "value": "c9dc4aa26f0553476df41f545ddefa86cd51dda56f2c0338178e7cd8a042e5d42ded9f8055527fe21bb856d3aabd9f28", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349528, "uuid": "f3684489-736b-4b36-9e46-54b2d312641b", "value": "T145E4AF17A6D48473D1631A7C8D2BE6B49837BD612D286C863AE83C8C5E3BF4174653B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349528, "uuid": "ca718471-503a-4f7d-8195-144ad91d3ac3", "value": "aa22f419b85404a600a9179c79172729", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349528, "uuid": "2ee0a4b2-59e8-404e-8ce9-51a9f7d506a1", "value": "12288:eu2kj6N7J7z0+gZCFaJf5ABQ/8I6D31tV+EpP43:JtevYZCuWRrD3Ix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783349528, "uuid": "89355a4c-bb5c-41a3-8fcd-322669359520", "value": 659728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783349528, "uuid": "1615bbcf-1521-4c2a-8238-229dc0b21699", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349528, "uuid": "d2c59362-30d9-4172-93fa-38152b45a9e4", "value": "setup_euone.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "612c9d57-7939-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783342277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783342277, "uuid": "85827f9d-8c93-47eb-a6d7-6c2e55690786", "comment": "Malware payload (RemcosRAT)", "value": "dd5656ff62cd585f1bdb13a7ef97216a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783342277, "uuid": "cd00da7d-54dc-479b-97d2-4bbbf6f95b62", "comment": "Malware payload (RemcosRAT)", "value": "77fcdd4baf28b6e3ef7b47253576d14b36a119a801266b48171d7f7df54bd96e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783342277, "uuid": "59c90356-9219-4334-8b96-725a25270943", "comment": "Malware payload (RemcosRAT)", "value": "6a1a3c502c2d5941c3c8d794f07ae684d05c397d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783342277, "uuid": "015d3fec-6f16-486e-bbc7-ab2213927082", "comment": "Malware payload (RemcosRAT)", "value": "a0de94ec8fd04ab4ad8b070cd41d34465630463519984e985f619203562ad967683e06f793e5059247069d204faf35ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783342277, "uuid": "b63aa91f-0d55-442d-98d7-b58528386d07", "value": "T13D32881821285A414828F25FF87D335F550E7B8DE1C0CAA0B34FED899BE763349F9A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783342277, "uuid": "68dc0d36-c754-4ad4-abb3-edf79af6e487", "value": "192:FpjV/D0LHU4xTau/W9A2L3j7215n2aQDaqLIsdu9kGH:FBV/D0LU4xTau/W9TL3j7o5n7QDaqLIz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783342277, "uuid": "bb71555e-0495-4281-a923-dd593e18ca31", "value": 11509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783342277, "uuid": "a5b91892-a70e-44cf-9f1e-e8f0d24316c4", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783342277, "uuid": "428ed6e4-6dbd-4652-bbc9-28f119694a04", "value": "givemebestthingswithbetterplace.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11fde206-78ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783309932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783309932, "uuid": "1d86ebdd-0563-47d9-a123-9655e092bfd2", "comment": "Malware payload (Efimer)", "value": "ae5a244595e83aba47af83377bc8ad32", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783309932, "uuid": "53de24ed-2035-48ca-a172-b451be372b1e", "comment": "Malware payload (Efimer)", "value": "785304d46dea8a93d361caabfadf63a6b7397a5da99300bd63bbe3e33fb45f6e", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783309932, "uuid": "dad77f1c-4faf-44df-a026-0eebbbd6a8ca", "comment": "Malware payload (Efimer)", "value": "4b18ef07873f0be94302659bc64914f885125fb3", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783309932, "uuid": "92d284cd-0c9f-47ba-8b78-ef5690f2ff56", "comment": "Malware payload (Efimer)", "value": "7943c482bb823aea27dc0f5c77c5f6492b99d9c581203c92e0ff69886fba27578f4b919f4e0747aa03b937ce449bbee9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783309932, "uuid": "b0ad59d8-4e3b-405c-bb7c-ad7c75ff4609", "value": "T1A0E6331875C003FADA376038E9E18AC8D828B4741FB5CADB17A453A9AE171F14E3D767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783309932, "uuid": "26977955-d26d-437b-b13e-39ccf51afb70", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783309932, "uuid": "3a5759c0-3925-4995-b47d-daae55a5b0e6", "value": "393216:fj5xA272uYAydQKxxEtDm3AJXMCHWUjXhcuI3/PGTAI:fj8NysQzy3AJXMb8X2H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783309932, "uuid": "9533d20b-9bf9-4d09-856d-1cce8fae3d1b", "value": 14304906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783309932, "uuid": "6a445fc5-fb07-4b8b-a25a-5fe5a6107997", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783309932, "uuid": "ef7bd905-bf67-4bcf-9287-e6c5d13a9c7f", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d41ec235-7948-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783348912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348912, "uuid": "7f5c2eb6-4908-497f-971c-09e3998db85d", "comment": "Malware payload (Mirai)", "value": "c2be922cda623bcfa17a0526250d4618", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348912, "uuid": "151da2d4-4e86-4292-9bdd-ce6ce3cd0a80", "comment": "Malware payload (Mirai)", "value": "78824b6f63b015a16d24e79a5836d50c11f3b25a770ea6a319834697449d0767", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348912, "uuid": "34a8e677-ee24-4e25-b3ce-a7f2a486c85c", "comment": "Malware payload (Mirai)", "value": "9fbe74f921c6d059d792ca9b58ee7383c55e8571", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348912, "uuid": "79bf554f-b450-4a5c-a9ed-c5d8c37febc7", "comment": "Malware payload (Mirai)", "value": "d954cc3ab3e570e3c7766b6267fb0908a6747e83c5e94cd5365f8c8e6012aba73fb4ff7806ec8f1f96d6efe41e1939b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348912, "uuid": "6b545931-ee88-42c0-8fc6-a4fc28fff9b7", "value": "T14F4302557118897ADD31903FCC7684832ACACEBCE0A790B7194109EDF91FE9253FA10B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348912, "uuid": "9daedc3b-3dca-4969-9414-ae8e90096446", "value": "1536:+fNzJGBc9naMAkEFWBSi6UkwjgMLtY8MKM1UfLQ:IgGjlEcSJwsM/hiyLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348912, "uuid": "f71a12d6-4ffc-48f9-adc3-9f8b33339557", "value": 55912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348912, "uuid": "96276395-aedf-49de-9e37-a6c08b1ae236", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348912, "uuid": "6a668462-5864-452b-8949-b754572b9bb9", "value": "atomic.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5db8c2ae-796c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemusStealer)", "timestamp": 1783364176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364176, "uuid": "98930031-d798-4b0e-8b97-f96a06c7b9ff", "comment": "Malware payload (RemusStealer)", "value": "951d55217430346bda00399c5ded48ec", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364176, "uuid": "93193a87-2ae2-42b9-9d70-752efdc3ee2a", "comment": "Malware payload (RemusStealer)", "value": "78aa82ebfae6c6ea690fad27bda96e3de794a5d8b26cb0d25f51b2cf045cbcde", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364176, "uuid": "2e580e0c-9aaa-4fd6-8267-d63f6407e76f", "comment": "Malware payload (RemusStealer)", "value": "210d85ff366c036a083e1bd0821cbf6705cb3424", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364176, "uuid": "0e2900f5-6848-4878-8a23-4b4ecf14eea2", "comment": "Malware payload (RemusStealer)", "value": "e73a2c0ebe95dde7b11e9f0c70c8fcf5885639b28bd7a1f7351d1d750b8e5822bf8dd2eda17392470b032ce069cd7ffc", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX3.file", "colour": "#8DAAA4", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364176, "uuid": "047be159-3cc3-40dd-b9a2-ec501f4e9f74", "value": "T1119522E89B0ED143C4055B704D61E27C2A6A6D8DEA0083274FEE7EFF7876B1A98453C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364176, "uuid": "7491cb28-ad6b-48e8-b0f0-dff656984a1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364176, "uuid": "d2728413-fe1a-4584-91fe-edd32c245af5", "value": "49152:nc6IApmosdqQGd9LHP9AZd97wuZ74f9JFVd2TELbTvKvZhi5wU:nodqxFPSHRyhLbT4hi5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364176, "uuid": "cda2bef9-9607-459b-bacc-24d38f3145f9", "value": 2054144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364176, "uuid": "a0598b9b-5fc2-4b50-8f70-ad6002880671", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364176, "uuid": "351bf645-4bf4-43b9-8566-1d8c9f983ae1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c67cb9f-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783364979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364979, "uuid": "75d0984f-7c70-41f4-ba6c-0ffd40b88f38", "comment": "Malware payload (Mirai)", "value": "870a2227b86a14d96f4d3ae931aac385", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364979, "uuid": "216db9ce-3086-4fd8-8a58-d66dcf2cbd0f", "comment": "Malware payload (Mirai)", "value": "78af04bcad709ab444daa65faff1b3eb8c9f96f06cd410bf813c476bae331845", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364979, "uuid": "0437e7f5-78cb-4460-8dcd-f7ca212340af", "comment": "Malware payload (Mirai)", "value": "9460fb90e25f693b112458e6ea1936ad6ab92229", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364979, "uuid": "a6a81465-66e3-499c-98a5-f31e0a762797", "comment": "Malware payload (Mirai)", "value": "e6d1ef9a6859fe3bbab635017b7d8ea8c5e8de93fb99b7f1a3aaa7ae349e6888a5339347b4599e1fb2f7da9a71971870", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364979, "uuid": "90468a9b-bdc4-410a-a631-5b225ef44d28", "value": "T139C2D034D706A894DAD02D7DD8394485EF4EBBFDD0FD3D222984A63C9683045A9FB386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364979, "uuid": "1fb3e5d4-bc76-4fc7-9986-45e241aa76b7", "value": "768:0CCpJ6UTh3QjB1CbHBwmr8nDlYS9q3UELj8:0NJ6QhgV1MwZhYHLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364979, "uuid": "0195a408-fb25-4c6f-b677-bde1e9dd3ebf", "value": 26724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364979, "uuid": "fe2a4d91-3560-4bbf-afa2-9d9597b48bce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364979, "uuid": "0d2df086-aff6-459a-9385-8ea41d6b616b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3a6a8e5-7908-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783321397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321397, "uuid": "a9f5572e-419c-4d1a-8269-dc11e98567a2", "comment": "Malware payload", "value": "10b5f9a4a17482141df2d7e6dfd185f6", "object_relation": "md5", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "hoteljune2026-blogspot-com", "colour": "#3B4D50", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321397, "uuid": "5c07e1f8-e97b-4429-b759-151b0d975d9d", "comment": "Malware payload", "value": "791efe9ea6eca27b954c70c7ca06b9378d79c69332d31645107cbc916f46454b", "object_relation": "sha256", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "hoteljune2026-blogspot-com", "colour": "#3B4D50", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321397, "uuid": "5fecf382-6e17-4753-baf9-942c23faa603", "comment": "Malware payload", "value": "6fd9bd4da20f3670153cdfa06ccf7ed9b096b910", "object_relation": "sha1", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "hoteljune2026-blogspot-com", "colour": "#3B4D50", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321397, "uuid": "b48a7fb1-b417-4d68-8438-9e0f390fbfa3", "comment": "Malware payload", "value": "183a65e86ea9ac3e42ca66b8037103c1872fc5da7e900cddaf2bd54f18ab3befb3d6cac74acbee9c9a38668996022b5a", "object_relation": "sha3-384", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "hoteljune2026-blogspot-com", "colour": "#3B4D50", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321397, "uuid": "c784383f-c7ae-4615-a6f9-0d2a4fefb90e", "value": "T135D167E2162BFCF553B9905044893488D7E8040BCFF92544FA9F61209B47A7FE7AA1BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321397, "uuid": "b53e01fe-a048-41c3-9b40-96ba8791655f", "value": "192:+WQgjgK7D204XBF6FgimmI26pNzdiseARCJ7DhgNqq87DpgNqqk:nDp4XBF6FgrmuNzdiseAESNqqu6Nqqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783321397, "uuid": "1cc3fa6b-6267-4bec-b223-4b28e3204d0c", "value": 6522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783321397, "uuid": "5c45d6e4-0245-4ba0-9f38-d425690b67af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321397, "uuid": "534452c8-f892-482d-86f2-9635904289b1", "value": "791efe9ea6eca27b954c70c7ca06b9378d79c69332d31645107cbc916f46454b.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06463653-7968-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783362311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783362311, "uuid": "57086ff8-a8aa-469d-8747-66d9efd81c43", "comment": "Malware payload", "value": "dc3c7a0a634e79b8ef7a2d7e276d96bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783362311, "uuid": "912cd842-fe84-4a36-bafa-1589be0ede69", "comment": "Malware payload", "value": "793e91eef011ce51c99af960c97490c091bb56b7b85720d4ba8ca420d1f27aec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783362311, "uuid": "87427e97-3314-4274-85f5-c1ce89a4da6c", "comment": "Malware payload", "value": "90252df9edfcc082a37c5e7bd22d2f4909898859", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783362311, "uuid": "b2ecde47-24f5-48ff-9640-4bc07b2c9dde", "comment": "Malware payload", "value": "79db9b793955625040245e081567cfc4cd254cf103dd7a610fc9fdcd5d3ea12ded4cbcf20c1728572045accc4c89d632", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783362311, "uuid": "02b3d3ad-bf0a-4a80-bbe5-129df8c06c92", "value": "T16AA40145FF96A8E9D83984319EB6D2A314317D8C5E25B22F631C7EAF7D70990C63B240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783362311, "uuid": "bd4e51d4-4d1c-44a4-aa73-48ffed15e82f", "value": "9be4f90f50c714bc00cc8beb2e137299", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783362311, "uuid": "daf52ea6-e395-4da4-b5d5-3527b014fc49", "value": "12288:XBQEizGvu2Vl0OPYnARYhXIRo30YjOPYTYTevVSgfv+kfr6:XBezG9VnYAeh4RoNnmcVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783362311, "uuid": "dfb705cb-da93-4b7e-aa65-e977b06f7a18", "value": 477920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783362311, "uuid": "1a3bba92-576b-413f-93c3-21d50a62f143", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783362311, "uuid": "dcf0b768-bc65-426b-bcf6-6d21097baff2", "value": "Bryllupsmarchens.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23aa04a2-7995-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783381688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783381688, "uuid": "ad4340a5-071f-4f85-857e-fc97f333c1f7", "comment": "Malware payload", "value": "b49d3c1193ac5e850d478d8aa3ec833b", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783381688, "uuid": "ddb5f218-732a-4f98-8b07-54a1e58fe601", "comment": "Malware payload", "value": "795dd9b56b65ddab01a5ff024232d4b94aad299ccdfa0da940a9804f1a6bcbb5", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783381688, "uuid": "ca3e945c-8b69-4ab2-b618-b0857e16dfcb", "comment": "Malware payload", "value": "97bd303bc315b49252bc2e90592963ab335f4ea2", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783381688, "uuid": "b05cae74-8dbe-48c0-924a-64f2fb3f2a27", "comment": "Malware payload", "value": "a26ef68aa47874d515613e5cf6fdb020f9a12580a8668cc9d16122d05277a852863ff7fef06e899249e0117840c4687b", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783381688, "uuid": "4617c454-de60-4425-a4e4-46d77cde69b1", "value": "T146B5024EEB8A07F9C93D80B850219252B7C1BD178F10EEAF36552C666E67DE85F39700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783381688, "uuid": "18ac8e6e-05d4-47f1-a54c-c4a224ae5ebf", "value": "5a08440e22a99b9fda864d620400de65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783381688, "uuid": "2fcc1c92-1bd5-4aae-b41f-e6ac6c4fc1ab", "value": "49152:EhAzoqxbxPRu6XXwM7g5r+4UYlGfkxiA9nKLnqKlEsez3CGNJlk6r12Q:Jj4U4Gfkkxq2Ep+k12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783381688, "uuid": "23b54e3b-1464-46df-8f8b-3484ef1720cf", "value": 2310144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783381688, "uuid": "ad2044af-dcf7-4d6d-b6c0-4cd82dfe63d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783381688, "uuid": "63296199-e41d-4abe-8aff-c1925a61506c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f988384-7920-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783331510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331510, "uuid": "e3faf400-65ee-4af0-9085-035dd2ea30a7", "comment": "Malware payload", "value": "15915519b8e58f54cea1b75beaf322f7", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331510, "uuid": "8cd9eaea-2b7f-4d57-bf78-f140d0556e80", "comment": "Malware payload", "value": "7a3cb27089bd72a391d3d1d58257a981cf6b9ec1ea3a60235b50e7eb59ca8480", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331510, "uuid": "f6fc3aba-523b-48c0-b711-27b9c4842864", "comment": "Malware payload", "value": "85be3b3677356d05370b0dacde2ce11f94fc611f", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331510, "uuid": "e1d7b8e0-e453-49ee-b410-636de04bcb44", "comment": "Malware payload", "value": "e7901deaf9561a6d6c14c1e99513ce8d81eeb477aebddb1977887fa69cf97dd86cffce1b925cc65918d80064e3713ca9", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331510, "uuid": "873fd3df-c2f7-4d8f-be6f-814432d4c0e4", "value": "T12917F9389D9E0B223B91D6F9209E52FDC1259C372B023558F49D978C3B73790B7AE906", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331510, "uuid": "f54b8953-85b4-498b-a949-eecc1910eb2e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331510, "uuid": "0ce12317-3946-4ffb-a0c0-2225a978cf08", "value": "24576:L0glmm32eyvccm3lcElJpriMKrx3TirR3lrb4pBlXi2QoRKnBogEEOcDje7gT46b:ZPmxC2gPVcUwCv07g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783331510, "uuid": "5016f4fb-1ad3-4903-9455-eb881b038e24", "value": 20221952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783331510, "uuid": "0961eab7-8cfa-43f5-b051-176188ba9d01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331510, "uuid": "8a327ee9-f98d-4fb7-ad2f-7fbd4a499b5b", "value": "Draft Proposal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1842b4a8-795a-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783356328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356328, "uuid": "40c02897-7f5d-499b-bbe1-0e0d729d3dc0", "comment": "Malware payload", "value": "e9598a5a14017e64bcdebca1ec368662", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356328, "uuid": "d1c09df8-fea8-40cd-88fe-3bec12658f88", "comment": "Malware payload", "value": "7af71cb50454a30dbe06d315fd3ed60ff78fed62dd80995e7d3463a9ac227abe", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356328, "uuid": "a2a328e4-5bce-4132-a502-fd760fd45bac", "comment": "Malware payload", "value": "1d1b4b9454481f5aeeab78046cfa9b57c5060049", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356328, "uuid": "39d14a93-ffee-4934-a720-e43e6b50b8f7", "comment": "Malware payload", "value": "4d6b5834e6351d071f96b14e7ba876013fccdafe0c3d06bad84e35e62f775c11e7864b0d898638dad45dabe0b598be34", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356328, "uuid": "9dda6970-cd51-4cad-9d76-72d65420fa41", "value": "T14D0833AC81D0D12DD5A654B16EF09FC0B4C9997ABB7D220DB929E32433BA5C011DE39F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356328, "uuid": "c385fdd3-b284-46c7-9dd1-5dbc341c97f5", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356328, "uuid": "36500eee-1e76-4358-9e06-d333d51108de", "value": "1572864:bt9IKP0A2KRWYCIRgBlSY5OCKe3Qrn2QEvcQwZctK9ZSy7:bUKF2KRWJsL7e3QrOvcQux2y7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783356328, "uuid": "0588ef8a-f395-4a97-911d-c3dd4a744d65", "value": 77727860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783356328, "uuid": "83c755e8-9c62-4750-86ca-a24fc3274b71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356328, "uuid": "26dc6b03-daf3-498a-80ab-669c5854805f", "value": "Lossless-Scaling.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b8ff59-7921-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Stealc)", "timestamp": 1783331838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331838, "uuid": "3efbae7e-2b29-43a0-ae2d-f3b9bf05498b", "comment": "Malware payload (Stealc)", "value": "227a39d09941ac183f45e7b7c0f3cdf4", "object_relation": "md5", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331838, "uuid": "f517286d-7bc6-483c-a201-eb1f53639531", "comment": "Malware payload (Stealc)", "value": "7b3aa1d7625cf510dd111f1d390415de1538dfc011ec79242b44badd6d32b120", "object_relation": "sha256", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331838, "uuid": "45ab5efa-a2b8-4dc3-aacb-27da31b67ef0", "comment": "Malware payload (Stealc)", "value": "1475659b5d3002a0b49ee774046884d7f218693d", "object_relation": "sha1", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331838, "uuid": "faeb55ce-3957-4d68-be37-65a05ed3fff3", "comment": "Malware payload (Stealc)", "value": "dfd509d8b807fcbbaf2559a8687c4646c7a0df73bff2ba80ba5edab3a57b60bbbf8a3f4abc2f6a30e09d3f5376746462", "object_relation": "sha3-384", "Tag": [ { "name": "D", "colour": "#199F5A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "EU0.file", "colour": "#802A88", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331838, "uuid": "bae29ed8-9bb8-46c5-9c7b-d034e4ecb5bb", "value": "T170A5334B42D41507D48D0736D0FA09935932F8652BB59AFF32B18ABA1F736C4BA3271D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331838, "uuid": "b13c55da-2db2-4971-a5a2-ba6b0765a3bb", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331838, "uuid": "6dfd9a0e-18bb-4841-819e-6b83db03e01a", "value": "24576:cu+ITIDOC/LeOjwNzI3brwrD+/KMy9epq7g0aHcs7OE0HDa5oZyFw/CY9uEodD5p:cu5TIre32LrYC/Kn9eesZ0jakk8CJdD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783331838, "uuid": "4a4359d6-a7a8-4f3e-ad59-73f85ffc9249", "value": 2203648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783331838, "uuid": "37002396-b1e4-4c84-aaab-90559021da30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331838, "uuid": "8dfe818f-4565-4d03-ae80-7cd6671c29bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15373d77-791a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783328835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328835, "uuid": "f79a3d98-07de-4eec-828e-a2b3f60b7fbf", "comment": "Malware payload (Vidar)", "value": "e96154e835a8655af64ae2d7ce1256cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328835, "uuid": "eb9e3f2a-3098-424d-a1e0-3754df287c10", "comment": "Malware payload (Vidar)", "value": "7c501632cd3830735040964b69d73a5dc315d0422fe3f1012c4b50db58dc0663", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328835, "uuid": "0fe21687-5125-4676-9020-47332390e644", "comment": "Malware payload (Vidar)", "value": "47790bec41fccb217b44e81713b0e51db89d4887", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328835, "uuid": "db091ae5-c2e2-4cd6-b3e6-12f99b07e6ce", "comment": "Malware payload (Vidar)", "value": "8c0cb3c80827aecea55c5e652484c2d96ab1129c0e6d891caaf5ce390cdd4ea3a318f94b2e88d0ed88a1622a1fdaa6cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328835, "uuid": "38cab3a0-4c94-450f-b360-99709d2859c4", "value": "T15652198A3197B0E4C0BDC37ACE9B6376AF1130885B5A0FFF55EC85502AC215079B876A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328835, "uuid": "4a54ab9c-bf72-4d24-9503-61fd9be14ba4", "value": "e23bb1c08602479266491150dc857434", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328835, "uuid": "78a72ebd-de02-43ee-941a-dd233a46649b", "value": "192:OhBelbxzW8EeygMLn46nBNH/ulXWomf/z88DgoY38MnKjraK3V08:OHEzvBxWn42BuoomfI8D5HMn+Dl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783328835, "uuid": "63237e02-1e30-4a89-8fc2-e71df13c7159", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783328835, "uuid": "99940720-e416-4761-9d0d-3899aaf80fe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328835, "uuid": "3b2319f1-6139-4b4d-9735-f775f00e1158", "value": "e96154e835a8655af64ae2d7ce1256cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d37907c-78d5-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783299401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783299401, "uuid": "f257fdb5-83e2-4f31-ad51-cc237d543206", "comment": "Malware payload", "value": "b2aa5a96937b777f3abd3db4b900aa73", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783299401, "uuid": "7bde813b-4c96-407c-a22a-c1ace124d822", "comment": "Malware payload", "value": "7d6005eb2ecd6880d6488ab364ab9edace9ec73f40ebe459f7c141ee5494b6b0", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783299401, "uuid": "0d8a0177-1cd1-4633-bad1-80c410b6d6e3", "comment": "Malware payload", "value": "0839cceacff37c17c1337ee3cdcffac7828e4ad8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783299401, "uuid": "492e763f-beed-4d31-8048-11c29b17557f", "comment": "Malware payload", "value": "c578cba5f83c9a5b0f12802307d7545a2909c844612808a7b69fff778372e02f6058983236b61d69dd42edcb3f232d17", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783299401, "uuid": "c2ee2a09-753c-431a-8622-47062a92c740", "value": "T1AFD02E636273223090E38891FAC2A400B2010B3E1C49A66EF00B16B06F0A348B8C1364", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783299401, "uuid": "47bfe96c-e807-4448-a5ce-a485c4b24a47", "value": "6:hT3w91atQnSSPnBLZbAulNXYq4HvXDG+NjVsNXYrkJ:VA91rxdZbPiq4HvXDGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783299401, "uuid": "9e1728f1-cd33-44cc-82d9-764bbe5b527b", "value": 263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783299401, "uuid": "42d06d5d-02a5-4c07-acf5-52dc0a908e12", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783299401, "uuid": "980c25e6-79f1-40dc-8f97-40e99ba10d78", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed7a1f73-78d4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783299133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783299133, "uuid": "a512bd56-6f70-491f-b4dd-9308d8d33f17", "comment": "Malware payload (Efimer)", "value": "be685c063179a90c0b746c57f32e584d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783299133, "uuid": "e5dc274e-3875-4890-a5e9-e52d3aa93e0f", "comment": "Malware payload (Efimer)", "value": "7e3a616ef675bb32783c7109970fc93ba418091007392f07052a49b144eaa081", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783299133, "uuid": "d0fe9cb6-db9f-4ae9-bc58-836823a51e9c", "comment": "Malware payload (Efimer)", "value": "58fbeb266b931e01cf21e758712b670009e9eed3", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783299133, "uuid": "ce926cf3-31b2-4a2b-8abf-b7f083e48c07", "comment": "Malware payload (Efimer)", "value": "b60905363c01fc4b9d1d0dd35dd7b4de92cf2bd2755a8129192729f82265cf79c3875621269df399a74442af273ec779", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783299133, "uuid": "36714c33-a3c7-4838-bf64-2ad86e1e1d78", "value": "T1EDE63344AAE012EDE2730238AE929196F0A5B4360B31CECFDF9CD6767D536F0483D656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783299133, "uuid": "a42a0bd0-79af-400e-ae2a-e1c6fd400202", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783299133, "uuid": "7a4b8934-b8a2-40d4-8eaa-1555eb27f10e", "value": "393216:XkeQx0wMj3I0MyzWSxXMCHWUjXMcuI3/PGTAI:XHRxXMb8XZH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783299133, "uuid": "6e12457a-20d1-486d-bfde-b460dd5cb035", "value": 14289072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783299133, "uuid": "ebd93ae0-c493-4064-8378-0346ac47ac94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783299133, "uuid": "c8adcfe9-bab5-4767-b1b8-edbb3e1473a0", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b305407-791a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783328845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328845, "uuid": "7223af40-ae9e-4f8c-a5aa-516c8dc00313", "comment": "Malware payload (Formbook)", "value": "2db9b397d98c55c8a7be695d747d251c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328845, "uuid": "bba9db8e-e8a5-41b5-b8e4-8a58767af8d1", "comment": "Malware payload (Formbook)", "value": "7efb9e34f0829837d0b8b8ec33124b2e68c2ee15f1c222afc7c2d4ed985f96d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328845, "uuid": "02c1c148-d299-4a30-86dc-0bda0a9fb5b1", "comment": "Malware payload (Formbook)", "value": "dc45f63319b41252b02079c0d1cf70cb58153cfd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328845, "uuid": "d57e64a9-4c64-49d2-98f9-4a7c8429a352", "comment": "Malware payload (Formbook)", "value": "771a1ffdf8401f0b037f60303e3720e569522a616c2f37d0124587a4d78ed3d90a34b552e012172483e4a7d33bd0b769", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328845, "uuid": "aadb44bc-df45-4822-a3c9-ec0ec1b146d4", "value": "T1EE351298B74DD402D461173C9DB1E2B805692E9CFA20E3635FECBFEF79366125885382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328845, "uuid": "0c363d98-5366-4c5e-8888-3fad7a34952e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328845, "uuid": "ffb0f3a5-b083-4c0a-a90e-4a6101f1e38d", "value": "24576:ZPEvV0L950ZsDoD4bLle8yCkIokYz97Fxg736/z1A7MPU:ZPEN0LwO+4bLlMCkXz+KpeMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783328845, "uuid": "670f226c-1d27-4e15-8666-477841586b79", "value": 1114112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783328845, "uuid": "ee3cb97c-8b06-4e17-b22b-c8940830dbfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328845, "uuid": "be69aec0-3d67-416e-b5cb-8d4fd57be11d", "value": "Purchasing Order Requirment Specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8700296-7946-11f1-ac1e-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1783348114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348114, "uuid": "c613875b-7a20-4b84-a890-3427bae1e06a", "comment": "Malware payload (ValleyRAT)", "value": "ddc9fdaf5a150503ca693d342e2abfe4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348114, "uuid": "d6b92b71-9b53-4d45-87b4-bf944399dd9c", "comment": "Malware payload (ValleyRAT)", "value": "8048288e80f790fe15ae18db47191fb9c086b97cc2d84c83c918c4eb3db4dfe4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348114, "uuid": "338ab2c2-cd59-4969-a2e8-a1c1ac454b50", "comment": "Malware payload (ValleyRAT)", "value": "91e22253e65fdd884e0041e9879c8f80db3f7713", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348114, "uuid": "2ce03860-681a-4b16-a1a3-c7d63ba60cea", "comment": "Malware payload (ValleyRAT)", "value": "4b4057d0277ac852642b16ea424a4a826dd1742fe59ec0517ba85ad1f1a1419b9bd775f3d24e8dd65b6fd68a4adf68e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348114, "uuid": "76a13238-d088-4740-b787-75d89501ddb7", "value": "T1C0763BFBB131CA98C0CAC57064878FA28FA17D1506B5138363CA271F6F7AD901DA95DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348114, "uuid": "fdc3baa0-237b-4f50-aa87-5ad216b2d58e", "value": "0112874684b071c4c8edaf3a4d9a91b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348114, "uuid": "1e5c735a-97c7-4d27-8a9f-f99da6a33fb5", "value": "98304:wvhhKp2bq+Gyy+wE2mNphD7w7wtgWizV8MRVCw6Ve8z:obq1VV6ph4stOzV8mOe8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348114, "uuid": "1ae3171b-d56a-479f-8b26-ce557e4be88a", "value": 7473664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348114, "uuid": "642d3eab-9a12-4f34-a042-d057f24d7101", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348114, "uuid": "98f61bda-2953-4cc1-9e82-e373c89497f2", "value": "2026.07.06\u88c1\u5458\u540d\u5355\u53ca\u8865\u507f\u65b9\u6848WPS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de6f6aeb-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783365251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365251, "uuid": "b19a4841-8ab1-4cc1-bfb7-cd23e1f19938", "comment": "Malware payload (Mirai)", "value": "552dc99b79beadfd071232c318ac9c34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365251, "uuid": "a60f5178-df11-4ab4-b0c9-37cf843a0258", "comment": "Malware payload (Mirai)", "value": "80dec65aefed608345d3baf92464aead3333ea1e880ea0c04c6ccb136c839436", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365251, "uuid": "6eb8f59b-1289-4486-9c2e-bbc3be6a35d9", "comment": "Malware payload (Mirai)", "value": "511c0fe4c310c7b0c3bca8f80d85bc36691518b5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365251, "uuid": "acbd4ceb-afcb-4f39-bc6e-465f6e6cbc8d", "comment": "Malware payload (Mirai)", "value": "a198beb1204845d62bb2e150555d51918ff625dd5e5fcfd9a15a63ee9b24c9201eae6e402377f355103ccfb2e535f6ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365251, "uuid": "3b69f0a9-a785-4a4e-8c24-ab31c4c9736a", "value": "T1DE43F755F8814B22C5D5027AF92D118D332367E8E3DFB2139E206F607BC696B0E36E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365251, "uuid": "cf54cfc5-b8f7-4f4c-99cd-34f7f7735cc2", "value": "1536:GInoHzdydabeUeJj8VK1D/QJ+Mfwi7rzSm14M:QzsdysyrzSm14M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783365251, "uuid": "6c03d5af-a943-48f8-85f4-0d63818b359d", "value": 58904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783365251, "uuid": "2ec311a5-9a4b-4d6a-bd63-426d24bbba00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365251, "uuid": "a31a378b-b5c7-44a1-ae5c-b6bfd800e6e9", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08bdfddf-7939-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783342129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783342129, "uuid": "e524cddd-2bd2-4ab8-86f8-9d38fa0dd27a", "comment": "Malware payload (AgentTesla)", "value": "d1f41d50627a69e02d4f7464beb2f8b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783342129, "uuid": "74fa1098-706b-4dd3-b646-906c2bdfd8b3", "comment": "Malware payload (AgentTesla)", "value": "80df68273b763bbd74207d708a49c4aae244a6cc85161e2efae0d73f373830a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783342129, "uuid": "08eeaa0f-de2e-40c9-83d4-dfcbebe5bf6c", "comment": "Malware payload (AgentTesla)", "value": "ad383fe7025e956bce4458cbb0106f958489bf9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783342129, "uuid": "e0b0a25a-d62a-438e-b738-34ca676ef0b9", "comment": "Malware payload (AgentTesla)", "value": "46689fb3d81582c308dc0c5adb8618cb6f104f6b5b8bcc5d69865be28ee94e113f01e6c5e1b546df9ca546a33ca1d3a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783342129, "uuid": "567e5343-eb75-4f4c-9541-5b510a6c7926", "value": "T16B75BE55B3C866E9D556C9348715B733D2B2B82347A2A0CB0A9ED3091FB7AE15F3E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783342129, "uuid": "f5a0d293-5eaa-4d02-90ba-51cd4ea7b7a5", "value": "b9814c8dbcfa4f19d0b7fec82b718ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783342129, "uuid": "e01cbc56-a077-4586-933e-342fc8cf8ae7", "value": "49152:wNOXMAC2AQdCbs4BPfxFJZRahJZCdC7vr+ad:FGPXJZRahJZCdC7vr+ad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783342129, "uuid": "8d38f306-989d-447c-8d68-7068c5036bf8", "value": 1623552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783342129, "uuid": "97a71518-4be3-4589-8350-0b1c29060bff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783342129, "uuid": "2f2f3854-2619-4904-8e4a-09a4f8b0c485", "value": "POWRPROF.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e977b5c4-7944-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783347230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783347230, "uuid": "21721c22-6b86-431f-a5eb-843f5fbe4e98", "comment": "Malware payload (Mirai)", "value": "e92d9f2e7e17134202cf4e234d5f3328", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783347230, "uuid": "9ededa7c-f702-4648-8dac-bde800a6fac4", "comment": "Malware payload (Mirai)", "value": "810a048bc32d532c81c0210b5b279682300ec818c2694b31593b73366f6a8bda", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783347230, "uuid": "63af0255-495b-4b9f-8dde-67c21b0b4ee0", "comment": "Malware payload (Mirai)", "value": "40f0c0c21bab8d42b655378b8ae0693d45d2af22", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783347230, "uuid": "8a5df6ea-0dbe-42ac-9c61-9249024d46c4", "comment": "Malware payload (Mirai)", "value": "09ae3f654f19292dc87b91747757fefa6e9d6488f601a2617656c9cab10019c00f50631c6740b7db06865586e3324545", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783347230, "uuid": "94c3ee4a-317c-4c07-97c0-357153826e88", "value": "T19D613ECA531913322CEE999772BA447472E0939E10CBEF45E7D8A4F84B4DF9C78416A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783347230, "uuid": "46c2b2e0-5f34-45a1-9cf0-351273381d63", "value": "96:i8X+spkEehfzX33wZlEvL2FbY3XnHAJVv8:A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783347230, "uuid": "8ce266d2-65d3-4577-9301-eec5a2e222b0", "value": 3179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783347230, "uuid": "61adba5f-b0bc-47ee-a5ea-659997738464", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783347230, "uuid": "c81bea1e-7415-47b8-962d-21e2e6154c3e", "value": "nz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afaa0a5e-7979-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783369897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783369897, "uuid": "a00a9075-7ba8-4854-bb17-dfce3e573978", "comment": "Malware payload", "value": "c152e2900dbc5cd70baeca720727bffd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783369897, "uuid": "94dfcb7b-7747-4032-9a12-cd5f1ae3ebc3", "comment": "Malware payload", "value": "810d409aef915e09eaa59b1cb8df60559c72b2da1ac0ab14ec875fbe58ac03d9", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783369897, "uuid": "e9851590-0b20-4549-a448-2379ec276050", "comment": "Malware payload", "value": "1d0890de5ab61b1ce14dbbe035e5687bbd0ecac1", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783369897, "uuid": "68715810-40e9-4a56-bd4e-99c4080b301a", "comment": "Malware payload", "value": "a4a416bb78ee7b369f7dd478226b616e2dd7f3a3c8729ce0937029628222826e1e8222ed3a031633b55cf0fea10f8cd7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783369897, "uuid": "29d06d1b-e46a-4a24-86ee-b4d820b13d49", "value": "T1F7B012B84112C430F40C441771B6C8A18682E479B819AF32CA414C12440C60D310DB36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783369897, "uuid": "9b988c49-1495-4c67-afe5-c6b8e9494720", "value": "3:TKH4vSCAtFg2TP7XmhYVxQ1OBVN0:hZAtu0D2hqK1OBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783369897, "uuid": "fae6f7b7-e6a6-4c6b-b4ba-2840bd457d11", "value": 94, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783369897, "uuid": "04cc8932-b886-4da0-bc2e-60b9783b789c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783369897, "uuid": "23828978-b17e-4d3e-a453-3e84d3fe6fd1", "value": "810d409aef915e09eaa59b1cb8df60559c72b2da1ac0ab14ec875fbe58ac03d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dfc3fa7-78ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783296289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783296289, "uuid": "c93abae7-d06c-4996-855d-67f59c4e195c", "comment": "Malware payload", "value": "48a5d7bed11f5e16a4313f9528039603", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783296289, "uuid": "10e33291-a59d-481a-bedc-4f0f8e994be7", "comment": "Malware payload", "value": "824f3fde1d14e67fbe30dd056eb6b01b86becc51f75c5dba09beba599841217b", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783296289, "uuid": "77ef6900-03ce-4437-992f-a39f89b35cb8", "comment": "Malware payload", "value": "a5d718836c6a92bff1881ad7113bb35d6c835d0f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783296289, "uuid": "a76fbf64-508e-4c78-abe6-21b70b747114", "comment": "Malware payload", "value": "90dab3e96c162e4071e636d5fa6d94091eaec4ee27e4ef5982746e36510db667f58ae03cafb70473a93c0ffd61d64987", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783296289, "uuid": "39208fba-29b5-4f8e-a5b1-5bbad757b557", "value": "T1AA116DCA63547B521F8C4E18BC5B887D6A42C1E7B1BBA5D0E185CD38ADCC3007C65BAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783296289, "uuid": "dfa35e3a-d99a-4848-916d-2548c23a4591", "value": "24:3J3E9GwsgNIxBXKrRfhPTks2np3vZmqhOghlHA:Sv0BXWpFTkxntZmqhFhlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783296289, "uuid": "4fba65f9-4842-4359-9b0e-728d218598ff", "value": 912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783296289, "uuid": "53cfdcd0-0b1d-4f1d-ac88-b8b33a0db822", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783296289, "uuid": "6c7c804d-a9e9-4e6f-b7b5-7f9242fb53d3", "value": "c.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d8ce91-791b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783329326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783329326, "uuid": "a8033e5e-05d0-4404-8dfd-022d5e913c02", "comment": "Malware payload (WannaCry)", "value": "9a0e23765cfcdfe7e28c9be6f458c620", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783329326, "uuid": "efbb1ef7-3476-42c8-b65c-4c1e46d48e26", "comment": "Malware payload (WannaCry)", "value": "825aa515a905b7294efc080850e77d8962a1411c6f47468a2ce67a19770bc830", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783329326, "uuid": "ef6141e3-036a-4fdd-9202-7425d6ce2d3c", "comment": "Malware payload (WannaCry)", "value": "c08a1f26daca525632ab3e33aa24b3dbd076ba33", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783329326, "uuid": "fc77df35-247a-4ead-b5d8-34d458f5a147", "comment": "Malware payload (WannaCry)", "value": "1b30783720df3a18b78275ab7cbbe018b6810bdcba4309468e006b98da316213cfdc3dbf2cf29425ba6bb2960916f2ce", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783329326, "uuid": "d8945aa5-4755-4ed1-9404-ecd90998de4c", "value": "T19736125933AC81BCC116523494B74E26E7B3BC5B127D830F8B948B6A1E13390BB79B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783329326, "uuid": "e5c8d89d-f0a2-45b0-8196-45ff4580cd35", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783329326, "uuid": "f518807e-b362-4f38-aeda-6f3de2c3b6b7", "value": "12288:jbLgmvbLgPlu+QhMbaIMu7L5NVErCA4z2g6rTcbckPU82900Ve7zw+K+D:jbLgWbLgddQhfdmMSirYbcMNgef0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783329326, "uuid": "4c0521e0-951b-4472-99ef-5419af8a97d7", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783329326, "uuid": "683d4cc2-634e-4d8a-972f-b98f9188da56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783329326, "uuid": "e07b54a2-edc5-4a4b-9d65-bf923457ab8d", "value": "825aa515a905b7294efc080850e77d8962a1411c6f47468a2ce67a19770bc830", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5fbba95-798b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783377692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783377692, "uuid": "5be1d560-3cee-4fba-b15a-f8a2e3dc1605", "comment": "Malware payload (Mirai)", "value": "43341202f687c7d2c07c979b296730d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783377692, "uuid": "9f44bd40-d80d-40ee-bf1a-027a02e3fcf0", "comment": "Malware payload (Mirai)", "value": "82d1721a528d70301513d391d0e356a69ebc8af40e64f2546cccfadd08f3f156", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783377692, "uuid": "f047c516-b902-4c53-8080-2e15a8f8fd06", "comment": "Malware payload (Mirai)", "value": "1fe7fb4922e5206cf1e8ce9524a2c093ca528042", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783377692, "uuid": "410e9135-b128-4104-bb6b-242931c50acb", "comment": "Malware payload (Mirai)", "value": "8bcd08734fce5907fc83659746a919276389d56f88f570243dec52ccae2fd106209b19f1a96d8123718a150a2915243f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783377692, "uuid": "a815c80e-3c40-4760-a0e4-00e06aca8fc4", "value": "T16BB3F806BF611FF7E89FDC3746B91B0925AC540A12A87B76B634D428F64B18F49D38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783377692, "uuid": "ed37d906-9597-4987-adc4-adfa015ea987", "value": "1536:BFymVVcL1yM89AAkp1R6ErEImQr18NFDXy/NM2ZAFnswo:BQmVVcoStEFDXytens9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783377692, "uuid": "12f132a3-6b70-40c2-a69e-74d249874e91", "value": 117608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783377692, "uuid": "33a2ee84-32c7-4eea-960a-b925bb766834", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783377692, "uuid": "24f455af-93f9-42a0-a01d-126afeecbd1e", "value": "tmpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a1460e-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783365232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365232, "uuid": "f2b47ff0-55a3-42a5-b4ff-2e4f1af76531", "comment": "Malware payload (Mirai)", "value": "872598096edeab592aeaa0243f3bf54b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365232, "uuid": "c8ab1e13-6bbd-4bdc-9673-b7234e12105d", "comment": "Malware payload (Mirai)", "value": "83f1f077cd9cc9e28452ccd254cae3c798fbc83e8dfa7377cd896dc8063ed0b4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365232, "uuid": "f1c527f1-a81e-458e-8cd2-c88112528887", "comment": "Malware payload (Mirai)", "value": "eed85f111f6771810f9cc5b99b44263a7093a999", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365232, "uuid": "bca98102-7f1b-48d2-a6ac-e4a73f9e2769", "comment": "Malware payload (Mirai)", "value": "b08cdb03b22ae24e2516e7445c44ce3eaa5587af4aeab28398db37ca48f2b807a0c44567f70e51c3907cde9b85e24c76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365232, "uuid": "4b592d9e-b4c5-4c5e-ac95-a8dac022470e", "value": "T1DF132B12B21C0F27C4A31970253F6BD09BFBEAD022E4F285655E5B9A8A75D371482FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365232, "uuid": "6db26595-c001-4219-8e18-8002ebf71d18", "value": "768:JrTD7IA5FIRg+R3pRrhUGGTSXNkR2igTEqJAd/ucuoIaJWwA:pTSLbQTH44LZuFoImPA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783365232, "uuid": "be6a23ac-7a34-4a5d-85cf-1e8237bceaa1", "value": 44844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783365232, "uuid": "8d7c7d8e-8526-4f20-a6c4-f8f864e98a82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365232, "uuid": "8ed34ea7-5831-43e9-9c6c-bdfb4bd917d4", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488af3b6-78ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1783296280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783296280, "uuid": "5afeb5f1-f51a-4ea3-b993-0ee5abf646c5", "comment": "Malware payload (SalatStealer)", "value": "a45a3b888e08629b2fa156608e81c15c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783296280, "uuid": "1fbcce3b-0d66-4890-87ae-03106bbf9190", "comment": "Malware payload (SalatStealer)", "value": "8517a75d6a6da5640ea40971355292e808aa21d07d2009d11e548bd1f679f711", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783296280, "uuid": "0affd47f-24f2-4fae-9b30-b0d2c5ab569f", "comment": "Malware payload (SalatStealer)", "value": "7ba827b3fe299016b5d47d0150938f49378be558", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783296280, "uuid": "3c232cee-3637-4758-802c-07de32574a4e", "comment": "Malware payload (SalatStealer)", "value": "79dd916d3e28772bcabada86ed5ae0560a6a564686c5a4e40d3dfa348b2b9218ae8308add49446719051f8e3e452a0fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783296280, "uuid": "c9472d1e-d63e-4bd1-94e5-85dcc413a2dc", "value": "T1E3C65C11FACB54F6F9036831416BB27F23315D048B28DB9BEB583B6AF877691187A305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783296280, "uuid": "63ebaa00-7599-4c18-8846-24fe12295a91", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783296280, "uuid": "b5466bc9-8a51-4983-b6bc-cbe65dbb9994", "value": "49152:oE6KiXwhZMKX41WQw9JxdNPCpYs2tFVDbwrLyfGvUdP7XVOYHahsnipR6mSMFZOi:wKUwNQw7/RCH25si5uiM+W4VDEvO/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783296280, "uuid": "08f4bf95-0390-4d43-8841-c795c3152ac9", "value": 12570112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783296280, "uuid": "dd1c48c0-11f2-4163-aa35-3dd7558f943d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783296280, "uuid": "41d2d582-8859-480a-8ac6-069247cccc74", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3dfaa9b-78ef-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1783310740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783310740, "uuid": "66f8cc0a-a624-4b3e-850a-e860fa8cf963", "comment": "Malware payload (SalatStealer)", "value": "9bdfa824fadc86894288ddbc6bee0556", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783310740, "uuid": "4b81656f-550f-426a-b859-7c592b3738a1", "comment": "Malware payload (SalatStealer)", "value": "85cf0664c86098c9868199c7afbc11a5c87d97b2587dd96e47a1d0439b448037", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783310740, "uuid": "19d83baa-2cd0-47c8-99ef-e3c7148879f2", "comment": "Malware payload (SalatStealer)", "value": "6a6beee6f676da1497d051396488182817c89a99", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783310740, "uuid": "b95bad0e-63eb-4426-9b08-741d486ba952", "comment": "Malware payload (SalatStealer)", "value": "8b92c59bf4d49951525749797110ac4f552a9c70a8d078521e37fdf24fa93807a8801269be02ffd3c90c2b8b963fd043", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX8.file", "colour": "#2B874D", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783310740, "uuid": "bf3c93a9-8944-4dd9-886d-7f2ba3ffba66", "value": "T11F0633D5E78D6C62E8CE023A49C726F85B8395CB23760C6BE12C674548E381B4A7F357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783310740, "uuid": "391836a4-845e-4d43-80ec-021e01772222", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783310740, "uuid": "80d34fe8-2f42-4dfc-8dd2-f3d0dd797dfe", "value": "98304:TXX4UdNd95hq0RjanaDphfGPx/OYbj9vm4IZ:TNNnjq0Rja6pEJmY1+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783310740, "uuid": "bbd2283a-a924-4219-bb5e-bacbdd5af95e", "value": 3787776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783310740, "uuid": "21bf5139-db3b-49ef-b89c-4fdc586d3ae6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783310740, "uuid": "2f3997a9-7e8f-4d64-8a5b-cee648536e60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b8ca53-7960-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783358951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783358951, "uuid": "8c047e65-e43f-44d8-a5e7-1fdefb54b87c", "comment": "Malware payload", "value": "c9eba647993216593fd5edef90015d26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783358951, "uuid": "b8e43975-c30a-4393-8a6b-9a925230eb0d", "comment": "Malware payload", "value": "8614fc066d4c8dfe26b101b53f48adaf94d28ca86aa958e79300b34abb4d504f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783358951, "uuid": "9bbcbab5-7ea5-4578-a2ed-34f56f1fbfed", "comment": "Malware payload", "value": "f3145e9e9ca4079d89458399eca564a1b45d05d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783358951, "uuid": "a7d65624-c29d-4027-a165-81151f211461", "comment": "Malware payload", "value": "28372a95cb155ab3242fdc7785b85baeed8a496fe6320fca59247673e91fcb9b5f4383e15852250704a981c90dfa8c25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783358951, "uuid": "f59caf93-6869-40e1-be9c-560cfef7ef6d", "value": "T13C08D043A6F1082DC562D232549B8232FB73B855133556EB734D43A23F77AA18FB6B60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783358951, "uuid": "9a666347-1aa1-42ba-b942-2fee8c88394e", "value": "256f62cebbdf487a51266276ef16169b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783358951, "uuid": "ed327c35-2fe8-4d37-8222-f6c72a34eb0b", "value": "1572864:0UDOGJZ9Sa+tTZi1QJFl3jYyGFPZ+BqZkPgdYWChrj5c:tdxETwSFl3j7w+BqZ7irj5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783358951, "uuid": "cb54f4f6-b543-40e2-86cc-5dcf22500f04", "value": 79800657, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783358951, "uuid": "35a79b07-12c3-4bd5-993a-0d5321e62a7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783358951, "uuid": "aee6df5e-9189-403b-9e87-09e0af6fef42", "value": "RixosGame.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e9e232-7971-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Adware.Techsnab)", "timestamp": 1783366422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783366422, "uuid": "0a77ad15-0b07-4363-accb-53676f06e6fa", "comment": "Malware payload (Adware.Techsnab)", "value": "627b462fe78575f12f53c9a6c3e34535", "object_relation": "md5", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking-customerhotelinfo-com", "colour": "#822B93", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783366422, "uuid": "49bebda4-a099-498f-8d9a-109b9f9ceadd", "comment": "Malware payload (Adware.Techsnab)", "value": "863454d9d304f37003a7d301e543fb08a7fe6ac7853f1405ded6f3f64ba1532e", "object_relation": "sha256", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking-customerhotelinfo-com", "colour": "#822B93", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783366422, "uuid": "f85a0d06-1174-40ea-9f9d-dae920e236ea", "comment": "Malware payload (Adware.Techsnab)", "value": "02ac405d4e4affca7cd87891ecf99fe38b4afdcd", "object_relation": "sha1", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking-customerhotelinfo-com", "colour": "#822B93", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783366422, "uuid": "b70352b3-bc74-4110-ba0b-cdc97d7b28c1", "comment": "Malware payload (Adware.Techsnab)", "value": "5a1292d7e2b573ca0a75a1b06b36000ecb25e827b00ea72517918493073d6652ac9f3f8a7f67b038c2690e955d40c434", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Techsnab", "colour": "#E829FA", "exportable": true, "hide_tag": false }, { "name": "booking-customerhotelinfo-com", "colour": "#822B93", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783366422, "uuid": "d2b859f3-ed42-4038-99bc-8c27f9ba6f01", "value": "T12412081B263B09B1434226F7C4EEE309F926417B26057E8874DC90DDAF2667483F9A5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783366422, "uuid": "593e939e-875a-48d1-a302-066bb62107b5", "value": "192:4svWAEmcDFYGMAHIiCzVtv1JiJU5M/sCzridUfNeoaOFhx:4scVs+Eom8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783366422, "uuid": "758349ac-26bd-452d-bed6-14d9cb5053a1", "value": 9674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783366422, "uuid": "e239dbbf-59bd-4514-bd64-106dc1ea219d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783366422, "uuid": "1e5ca3a9-8b59-4a69-9699-9b78ede7ffcd", "value": "863454d9d304f37003a7d301e543fb08a7fe6ac7853f1405ded6f3f64ba1532e.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c49fb4f-790f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1783324337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324337, "uuid": "9c378385-08f0-442f-8c18-3dcba479549b", "comment": "Malware payload (Prometei)", "value": "cb3d17172d2a9ab027b9a64b311e5093", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324337, "uuid": "b243e1ef-99ec-40c6-8f83-eabde533df78", "comment": "Malware payload (Prometei)", "value": "86aee16230eaf3ed6b788e36b814dc17291cba37ebc8ddd06bc7ecc0ae7e947a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324337, "uuid": "3252d54f-1653-431a-a526-e7c3b2cc8967", "comment": "Malware payload (Prometei)", "value": "2e89c9dcc25964514b796e0d6885f07030a16d32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324337, "uuid": "b6d4a1d2-d4c4-40b6-9ffa-31028810112a", "comment": "Malware payload (Prometei)", "value": "d22d896919b289d07aa12017fcae94e8edbc09da66209d11addc77232d995ebfb24db5e4468204aa5ee6002f8512528c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324337, "uuid": "9844b780-f821-413c-9f43-8409b09eb1b5", "value": "T10234BE63A4BCAA9FDDD82F379C4E880713B66FE4D890603E1C44710EFE2A5095F7A516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324337, "uuid": "e19f99fc-cf43-4ea1-bdd3-01310375cfa5", "value": "899ad1596f9c6642245b3fb721bae585", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324337, "uuid": "9cf89454-2a50-4c5a-a25e-5bafe71510e1", "value": "6144:tGxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdOH:tG60BpL8jk1FGjDc8GVdOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783324337, "uuid": "fdc1b865-98bd-4d0a-a449-63eae82ff1ea", "value": 245864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783324337, "uuid": "ed095b06-b935-46f6-8771-dfd6818e9f3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324337, "uuid": "8262086b-82cb-4ec4-9e0b-ea2b7f7a1bdd", "value": "86aee16230eaf3ed6b788e36b814dc17291cba37ebc8ddd06bc7ecc0ae7e947a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d01141b-793d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783343961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343961, "uuid": "1173c296-3c13-455b-affe-994a818b2eb3", "comment": "Malware payload", "value": "6e072b1d77b55a2c30bedf34210dcb61", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343961, "uuid": "9a68d15b-1c5f-4206-a601-f4038e1fdd60", "comment": "Malware payload", "value": "8889f1b67aea6896945506dae192326149f6c5db87e9b04fa08ac9a142a87775", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343961, "uuid": "36f18c5f-4e40-463c-8435-d5efccc0a6cc", "comment": "Malware payload", "value": "c5242e2e42b164fa499a8350e6a3f24c66df0cfa", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343961, "uuid": "8f317703-b0b5-4413-ac8c-33eb2dedc68b", "comment": "Malware payload", "value": "a4fe6c480170bed627142fa5c46894780bb9ae765de1de8e20641fcfdc77eca1ab1f7633d44694a718e83ba97a9e48b0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783343961, "uuid": "a928b31e-c833-4ef6-928f-251c7b06fe85", "value": "T14672E70FFB6E6F38841BB1E4E669080D5DBD96247141A83AED4C003A140AEAB71F86F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783343961, "uuid": "80c2ed5a-9ea0-4dfe-8717-d675457e3ef9", "value": "384:WS3LZcXuRtW17BsfSefINwBsCuotRuju0+igsCzl:KuRt0Tu0+igZzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783343961, "uuid": "f19d4f22-49cb-4ba3-972a-659e5ed17a6e", "value": 16595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783343961, "uuid": "ed8675c0-6251-409f-87b3-9e090a272485", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783343961, "uuid": "779fdeaf-b135-4b3c-9f44-301fabd3c1f8", "value": "kim_jong_un_is_a_fat_ugly_pig.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe36eb7-7913-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1783325927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783325927, "uuid": "20beda3b-9a8c-4a97-8737-c4c20d63cb36", "comment": "Malware payload (PureLogsStealer)", "value": "b9a1c00ef1c83b815329ce8552ce79d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783325927, "uuid": "389c99a1-63c6-4edc-9de3-1505b8d86cf5", "comment": "Malware payload (PureLogsStealer)", "value": "8a0e463ad1aa7fba604c6585e291e7893b5aad8c41ba6ee89642041c08a314d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783325927, "uuid": "a6fbb811-8a02-4cef-b797-c272e66e082a", "comment": "Malware payload (PureLogsStealer)", "value": "27eb89dad29d04a614b5ae9b68ed22d327808636", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783325927, "uuid": "fae84cc4-740f-4c6b-a6b0-8d231cc74729", "comment": "Malware payload (PureLogsStealer)", "value": "48163268a41ac09ce5c618621021e5ad3e1109b6f0f84897551f11e7f89a20ea5c11f11fe27cef4841dd260bae40ea3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783325927, "uuid": "08712c63-af57-43bb-8f66-556d4a22adc5", "value": "T19405AD6676565E20C2880733C1EB440183F96A877AB7F31E768513961C073FEEE4B6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783325927, "uuid": "62c7cd22-3c13-4623-9027-155185ab318c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783325927, "uuid": "a0235990-40df-49b5-b03e-a4f2c56e2a0e", "value": "12288:z5KzURRKgblPoFyplspamgrWlc5Am/WEiqNXHCb+h0ji0Xw7F5bw8/6dqC:FJTlA/xgylcC/mdsg1ydD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783325927, "uuid": "ecfaa9ee-fb66-4955-96e7-97af99cf41e3", "value": 821760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783325927, "uuid": "7fe2c6da-c732-4184-a23c-08481fdffe4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783325927, "uuid": "e5bd050f-b12c-4fb0-ae58-a6751c6d22c5", "value": "b9a1c00ef1c83b815329ce8552ce79d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf07e6a-7995-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783381941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783381941, "uuid": "916d6ba0-b6cf-40e6-af1a-f69c036bcac3", "comment": "Malware payload", "value": "eb9b66769f3340cc98b290487e64f0e5", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783381941, "uuid": "aa8b2fe7-abb0-4736-a487-4034a1a6426c", "comment": "Malware payload", "value": "8cc325c1243fc3fe72ac7875646dce2aa70973a8b8b6877d9537ea90fb4e1b02", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783381941, "uuid": "f484f96b-6efb-4800-a56b-bad4f23085fc", "comment": "Malware payload", "value": "7ccde4ebbaf92491c8d4deca03f307f3e8a0bc8e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783381941, "uuid": "d15b5dfc-bb0c-4c83-8850-5f0c191f5cfc", "comment": "Malware payload", "value": "00ad307ce7fdda6b65cf11ac52f8f5822f485bb0ef1674687cbebc6087f9394a535fd111f32a15d2b1a39d2ecc05745b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783381941, "uuid": "7ae1fa6c-b897-434a-950e-c0399d72cd18", "value": "T1A6E6335CBAD512FEE973413CAEF160D2D465B8B20B71CAC747A893706E573E04938A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783381941, "uuid": "f2b90e9d-07b7-4f9a-bfcf-a7840c926f1c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783381941, "uuid": "da5fe612-cfcb-4356-9480-89ed3e144f33", "value": "393216:SQn6mTGyTk/2v2g9fpV8p22y1Xz6XMCHWUjXtcuI3/PGTAI:SQ6QGKlBP22Xz6XMb8XaH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783381941, "uuid": "c5378e76-db4f-4bf1-9e12-da619b0ad3d7", "value": 14309235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783381941, "uuid": "c7d5315e-afae-4ca8-b7d1-1f5b079da6a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783381941, "uuid": "874d6b5a-6771-47fc-b51f-3ecb76c0e2e8", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159a407e-791d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783330124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330124, "uuid": "3087608f-ef37-4803-b967-8b9acdb55a11", "comment": "Malware payload (Mirai)", "value": "5e3be49692535e7c6813c43b3507964c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330124, "uuid": "616ec887-6e23-46cf-b251-359068527a2b", "comment": "Malware payload (Mirai)", "value": "8db497ca98e6fd9ebc91f8ab58f81d3f1328ed505182d58abc95e42d3b1e0bdb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330124, "uuid": "19e6f657-a2ec-4aaa-8e68-c2042e78122e", "comment": "Malware payload (Mirai)", "value": "49a1a46363dec6078de06a9641e857a8a7c3ae12", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330124, "uuid": "b6cb8fcf-bb2d-4437-9c0f-bbd1d35cd53d", "comment": "Malware payload (Mirai)", "value": "67bf0d2dc337ee9750d23b901953d59e9ec61e2ffb240d50f1ee73eeb6d2b0a7b1123a04183bc47634e077c512bda243", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330124, "uuid": "83e491ec-52f1-4596-8c57-3208ce34673d", "value": "T11BD34B07B5C180FDC4DAC1744B9BF53AED32B1A91238B26B27D4AE222E59E305F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330124, "uuid": "0bc33ca7-17eb-45a6-a9a0-fec587c0fe37", "value": "3072:09/SOyAEvjt6qkWYnR6sjafoH0FdBugQyDueMEPGF6CaD:09/SOyAEvjt6qkWY218tqCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783330124, "uuid": "c7fd56be-efaf-4756-96d8-8404b532e035", "value": 139768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783330124, "uuid": "9dab74c8-6f7d-4708-b25d-7d82c7baed88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330124, "uuid": "1cbe8c0a-1fe3-4c70-9cc7-5f9600335def", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff670fe-78e5-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783306332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783306332, "uuid": "be230ed6-c992-4252-b090-e48691e92d4f", "comment": "Malware payload (Efimer)", "value": "43153382cd1fb858e55ba294e2761171", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783306332, "uuid": "9e0ba227-6945-49a4-8205-1707e352a0fd", "comment": "Malware payload (Efimer)", "value": "8f9db18f94d1907317c4eb85764d3a53a90d0f6b7943c504ffe54299b66dc896", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783306332, "uuid": "a423771f-97c7-4da5-8276-87e7895576cf", "comment": "Malware payload (Efimer)", "value": "fc8c8020778fcc453661664067a8036afa85203c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783306332, "uuid": "746598be-790e-4b41-9e22-74ca8f3ce38d", "comment": "Malware payload (Efimer)", "value": "ca9f447d728e05bc96ec12d6bef9a297ef1458afb01a87e1147eb6c83c350cfb64b50b1abf80d8dbcadfe1a92982ecdb", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783306332, "uuid": "256dff7e-bde1-4d83-8f2a-3c54b26ad2df", "value": "T18FE633089AD463FEDA73513CADA15477E95DB4260B75CA9F1B68C6A2BC630F00D3CA13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783306332, "uuid": "36e51201-cfe4-4422-adb6-343261e9bb41", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783306332, "uuid": "0eb08810-f8b2-4a79-882f-1eaf871ee6ef", "value": "393216:1+Yq+osHfa8bZs+No8xYUy0XMCHWUjXDcuI3/PGTAI:1rq9qa8m+zx3dXMb8XgH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783306332, "uuid": "95da3f80-1db9-46fd-b9b5-3d9516603264", "value": 14305607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783306332, "uuid": "bbbd5310-3bee-4883-afc9-49eda6453ce1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783306332, "uuid": "dfe7f9bf-7812-4516-9f5a-f33ffacd9202", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd10e399-7908-11f1-ac1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783321493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321493, "uuid": "56dd2116-09f5-4bd1-8ff3-e3ed8b3e7dc2", "comment": "Malware payload (XWorm)", "value": "a5fcaf928242328873ec87d7b55740db", "object_relation": "md5", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "mineiicancry25june2026-blogspot-com", "colour": "#CF77C4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321493, "uuid": "f77e1ba2-79b2-44cc-ae47-db5936036a36", "comment": "Malware payload (XWorm)", "value": "909c364f2d31a192af4e4993d34c3549a56dc7f43435a392d3376ca53dd81791", "object_relation": "sha256", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "mineiicancry25june2026-blogspot-com", "colour": "#CF77C4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321493, "uuid": "fd942df3-85e1-45e9-96ce-5e325dc87d96", "comment": "Malware payload (XWorm)", "value": "afa3f76b1ccd9747b526ca2e4258d9d0f40d460a", "object_relation": "sha1", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "mineiicancry25june2026-blogspot-com", "colour": "#CF77C4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321493, "uuid": "e88f02cc-9bd6-4eb1-b1e0-517a5f6fed97", "comment": "Malware payload (XWorm)", "value": "7bab89d3a670850a9dfad6ae9f2b58cd4d481580bd528234c376d1a260453d5a87ed9cd523527bd6d25ffdf214b11268", "object_relation": "sha3-384", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "mineiicancry25june2026-blogspot-com", "colour": "#CF77C4", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321493, "uuid": "2b16a894-b44e-4894-9cc3-7367f464f4a9", "value": "T1DC32E5873E03EEF516B13ADACCCA20B6DC51902655651590C9EFF3324229B923C167FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321493, "uuid": "f33bacb3-d7ff-4bf4-b0a6-c22e7e1a14db", "value": "192:kmPW9mzV48vNqkOFSMGAybwkZ6F0UoV8yd4ywW9bucnzqavHhukXxQefY9oDsQU:kHSkjFQAybwka0UoV86wWBuArHlQUYey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783321493, "uuid": "f2c106dd-3763-4790-9f94-ad9bc91eafe1", "value": 11717, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783321493, "uuid": "cb9ee69e-f519-4753-aa8d-441215dfbd64", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321493, "uuid": "7d8bc6d3-ab5d-436b-a764-34eed16cb331", "value": "909c364f2d31a192af4e4993d34c3549a56dc7f43435a392d3376ca53dd81791.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339c5fe9-7933-11f1-ac1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783339624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339624, "uuid": "9ba7cda5-c305-46e4-97a5-86af3167b5cf", "comment": "Malware payload (XWorm)", "value": "b84c3476c63b2caac2016f171a0ade4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339624, "uuid": "00ab2d71-2884-4ae0-87fb-ebbc770b20e4", "comment": "Malware payload (XWorm)", "value": "92928ebfaff7dc919ec783798b7b107e9d97de105c2cf6a981a60e01461efb39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339624, "uuid": "de2f8bb8-bf50-4bd9-b63c-9d460dc3a5c4", "comment": "Malware payload (XWorm)", "value": "105153fbb6c35f6ffe8e669574be5493432d6d31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339624, "uuid": "aef958c7-1d4b-40e5-8615-614a52bb78c2", "comment": "Malware payload (XWorm)", "value": "174dff33f4afe5fd5d417029b0d7a14c2de11dee9fadd8c19d09f0f8b5ff834394f5d33cb72cbce4dd6fcd6943671507", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339624, "uuid": "2843cfac-80cd-459a-9f97-814608d30228", "value": "T13B554B4622D07BAC6D47E3C83AF0C6C3C9EE795B706C7C43E76A1FD0539970A6A50A19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339624, "uuid": "08a89a6e-be72-4f45-96f4-9583f444f43b", "value": "384:+BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBv:K7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783339624, "uuid": "7853f05b-44a9-4ef7-a799-81b39e556f64", "value": 1364871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783339624, "uuid": "0f51e833-1ec8-4aba-9377-61950e9b180b", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339624, "uuid": "595b7d8f-1756-4f58-8d50-0495d9383f42", "value": "Cotizacion de Albor Consultores.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f13099-798b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783377688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783377688, "uuid": "e6f6a098-1c64-4899-804e-b240b802c469", "comment": "Malware payload (Mirai)", "value": "66f3f3995d8981cd53c62fe6564a27aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783377688, "uuid": "05445923-8a92-4901-8c42-c1f6d86c8454", "comment": "Malware payload (Mirai)", "value": "938f4f03d862992f23684eb6f7f50ebdd06a7283f6d4a3b2626ee7610e6a9294", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783377688, "uuid": "923abd42-491b-49b6-a952-83e5fe48c058", "comment": "Malware payload (Mirai)", "value": "85b605fc7d11d40829dfcf9fc3a11bb756a18326", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783377688, "uuid": "9ef2740f-fec7-4d7c-b17a-ceaa357adc6e", "comment": "Malware payload (Mirai)", "value": "3a916e7a2af9db6da503e98c8cfe4b88db79fe3849942b42a98e087de0337c493b0dbbf6040c3e687cffd679cc1ab48f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783377688, "uuid": "ee7efade-679b-40ce-b6f0-44bfb8eab332", "value": "T1399329C4BC81A622C6C126BBFF5F018D371697D8D2EA3243DD280BA5778A95B0D37B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783377688, "uuid": "42fdf43d-3eb4-4c10-b7c1-9a141e16fe92", "value": "1536:wFpQHUQ+j+nhLEXIrPMcBCisMKwHDNUGW7UbVWSI1pX0qAvR+dQh398vnU7bDXdy:wFpQ0QpnhLE4zMc/s7wHBUF7UbVzI1i+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783377688, "uuid": "471612e4-264b-4dee-86d5-014cba2fa91b", "value": 91264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783377688, "uuid": "e6d94af0-9381-48f7-b402-6a8937f9f9a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783377688, "uuid": "81ed4d91-fb71-4ed7-80bf-2afb3578fc10", "value": "tarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1b0063-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783364956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364956, "uuid": "0e65c475-b3b3-4e48-b558-20aacaf8fbbe", "comment": "Malware payload (Mirai)", "value": "2ec8d10dc31842f0a1149cd407ecde90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364956, "uuid": "0bdafbf1-bab4-47f2-910c-2e1ebe1a7f64", "comment": "Malware payload (Mirai)", "value": "94516ed729fd8f667865ee3e6c94ad451ae9c255b99b8b9b2920bf4d89205a9e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364956, "uuid": "18dd7e6c-9632-4872-ac68-b083db518458", "comment": "Malware payload (Mirai)", "value": "a24908233eae896e740e641297a61a6f5b0069d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364956, "uuid": "39feb788-5e75-4259-9f33-d6d2f00a6629", "comment": "Malware payload (Mirai)", "value": "35e19ca41f2758c3f937c98aba27b1f24ec37fae6d3fda7e2d3a88ee1603814068afed436f881b08ebb0e44c89b36297", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364956, "uuid": "e70378bc-6723-4540-bcb4-42fe467f6729", "value": "T185D2F220904DE26FD25C137CD765C4DF604E9549AF88849810C4F063A7DADFAD6347DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364956, "uuid": "9bc913e9-7722-47f7-8634-459766210d4d", "value": "384:MijEmUFUkj8a6Ds3JM2AT4FdPKR5FifpWBft60F8p0Djri2ByNeexNAiyCWCiG7E:Hkj8tb2Awq+c/b0OXinSiZW5G/Jy1OFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364956, "uuid": "a1817418-aa2b-42dd-ae4f-6edc59bb245d", "value": 30120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364956, "uuid": "f14059dc-c5b8-4fe0-8d6d-9a813262b245", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364956, "uuid": "633c2d5d-680c-44a0-95f1-71517ebce15e", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c4b8046-7955-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783354214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783354214, "uuid": "1d79361b-afbd-4601-af19-9248d2266b4d", "comment": "Malware payload", "value": "b83b76361910a414cd4e15c98c5fd94f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783354214, "uuid": "3152d0e1-f567-4d76-b292-c77b3146cce5", "comment": "Malware payload", "value": "94c0b9560299cbe10c23b062f08849ac03e2bed78a71581e3adf5ddc015ca615", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783354214, "uuid": "215b3b50-f8bc-417a-952a-61a00dc4c2c2", "comment": "Malware payload", "value": "dbeca2018e179b33b8f67865c36e82c155018f54", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783354214, "uuid": "cbbd36ad-32c9-4170-9bf2-5722a6170c89", "comment": "Malware payload", "value": "8e2e18e7deae35c74435d7f8de17063e8f2443873b63b83549a6155d69be37add388f2eeb4b520d59bb400e193260eac", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783354214, "uuid": "89bbfc33-ef28-4ab5-b11a-3a74ec2446a3", "value": "T184624C0BB8818035EBE14474827F526645BDACB623D4F9CBF7E0648A5EB46E1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783354214, "uuid": "db9aecd7-eec2-4ebb-b3fa-2ffc4bd7771e", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783354214, "uuid": "ebec9c30-3458-4e5f-9403-678269fd2929", "value": "192:AWctsGnjXgjk8LMRAW4NJTMRJFeIFFBKUSf/zwsd1gJxTmv8U9cthp9ik:ANSMqAUl/Zyav8U9cTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783354214, "uuid": "17a1f3d6-31f6-406f-81b2-564702ea2b3a", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783354214, "uuid": "91ab8fec-048a-4954-96c0-45d743588b96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783354214, "uuid": "acef6b97-b213-47f7-917f-929bceccef99", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14949bd3-791d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783330123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330123, "uuid": "82e2898d-a21c-4b6a-860d-b979c410642a", "comment": "Malware payload (Mirai)", "value": "6aa5fe02798df3a74e29c5a3d69a7b6c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330123, "uuid": "a45f758b-ec12-4b42-b26d-40c5979fa417", "comment": "Malware payload (Mirai)", "value": "9516a8f4fe22e15189029b127023ecdc6bd151b1f15e8d2a7466c03163e63802", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330123, "uuid": "6f4ac7dc-decf-440a-886b-27a0cb01368d", "comment": "Malware payload (Mirai)", "value": "4491d4d5048b32d2ca8a49d4cac5bfa270bd0140", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330123, "uuid": "0648d31f-c293-47fb-afea-e097fc8d652a", "comment": "Malware payload (Mirai)", "value": "d44a441d1c778fa2ea442f9e6926ef9cdead5740e4a276a9f61a4be4dd2ef03eb4c8ad88e8a7a700b457114211ee9579", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330123, "uuid": "ed96a82f-594c-4fc7-aecf-b0d6f7d92121", "value": "T163C31B45FC405B23C6C611BBFB5E428D3B2A17E9D3EE720399255F60378686B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330123, "uuid": "560967d5-71f1-4b68-abb9-cd2da5827580", "value": "1536:pXKa0rG5yC/cMChygteOBdWFAcJX4VlgXTA70FoDUGBr7k51WhPV1lHFwywEReQW:pKaprMh7wOXWFh4UX40FoDJBkvWR2SL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783330123, "uuid": "1d4da6f4-c4be-4a3a-a333-0b7b08e0a959", "value": 129824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783330123, "uuid": "f5159fc8-949f-4dc4-b0aa-24cd7ef1aadc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330123, "uuid": "b180c14e-18b5-4f6a-ba4b-8e745db1282b", "value": "main_arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f87b1f1c-7929-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783335659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335659, "uuid": "a1e858fc-85f9-414c-ab82-14309b189959", "comment": "Malware payload (Mirai)", "value": "3dfbb86e0f3806fb5eacc66e65f96730", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335659, "uuid": "254cf663-e1c2-4513-8cba-4c804a43455f", "comment": "Malware payload (Mirai)", "value": "9538c8a2edeaa8667134a469d03a7057ddc1e753ce1e5250f92f01c1097fcb1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335659, "uuid": "93d17941-c47e-4bc3-91cf-a5d474d81e77", "comment": "Malware payload (Mirai)", "value": "f070b0c5a1184aa646e894b9d5fdce34a468ba35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335659, "uuid": "689d6bb3-7125-4492-b5b2-e78628d6d354", "comment": "Malware payload (Mirai)", "value": "dca3ce2ca48a69a90e4414b934d8c3c052418b14a41a5720b67420eb79cb8502114084a0d1bbfb1045643b6feb58accf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335659, "uuid": "3cb7a287-ac97-41cd-a48d-4922011035c4", "value": "T155F30745BD518B16C6D262BBFF4D428C7B2A1768D3EE31039D295F60378B96B0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335659, "uuid": "417141d3-c4d9-4cd6-9e09-2ee9a2f10260", "value": "3072:smpaNJnxpej0LmzYqNyB6wvk4JX1DRextqziQIV:smpaNJnxpejlVwB6wvxJX1teH+iQIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783335659, "uuid": "3e9bec61-7721-4c8f-95b1-d1bc7f1d69e6", "value": 157400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783335659, "uuid": "fd9d52ff-889d-4fab-83dc-aeb976885597", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335659, "uuid": "0af99688-efbe-4187-a150-abc29bcee7df", "value": "iran.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f959b31b-7929-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783335660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335660, "uuid": "4a7103ee-2c5c-47fe-918f-a155a205e090", "comment": "Malware payload (Mirai)", "value": "79e90ff87eadf4427633f6cc4b4d4963", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335660, "uuid": "5b4da1c1-7665-4239-a2ce-202e8391d28a", "comment": "Malware payload (Mirai)", "value": "95f5bd70c4e40f9663b67d40d23a46ca21d97448f9a609be10b12837e6a59805", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335660, "uuid": "eb5a4831-f5f9-4cd0-904b-772c46bae570", "comment": "Malware payload (Mirai)", "value": "2f583de3decef2dc1b73c1d59457152b35ee02b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335660, "uuid": "c525c752-4a92-4df2-9665-5993790ba56c", "comment": "Malware payload (Mirai)", "value": "c178e21ec076047d7943f3ebe5dd09069c3aa57faec61c34a83a3e28822e684481f2192b3bd1592528caee52e71e83ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335660, "uuid": "6ed1e54d-75aa-43ee-8335-cabdf2e87686", "value": "T1FAF31A56F9819B11C5C156BAFF0E528D73231B78E2DE72129E246B347B8A87F0E3B015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335660, "uuid": "936da046-2375-4060-b953-457fb9703978", "value": "3072:Oo0R0M1GwnMVqH8VMFU79wfmPtK93ura4hCG3yx67uk6nD2c62+hok:Oo0R0M1GwnMVO+MFwCOPtU3oaKCMl7uE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783335660, "uuid": "56535191-279f-4296-955e-79d6f69d1c73", "value": 169012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783335660, "uuid": "2f64b4ea-e614-4448-8c64-9b64a6c74d6f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335660, "uuid": "5e28731d-c5ba-4d32-9983-3cc175dc0cb3", "value": "iran.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39cc51ae-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783364974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364974, "uuid": "1714af72-e0b4-4031-866f-7876f28caf8b", "comment": "Malware payload (Mirai)", "value": "00c08b9bfc3eb667ca2d13764bcba2da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364974, "uuid": "606bd5be-2458-4dda-9639-be996ff6779a", "comment": "Malware payload (Mirai)", "value": "977943f436219be2f612a5dde5e39ccb904606c6e34f9e76e75af31b98c24550", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364974, "uuid": "408bcfbf-575a-42dc-a53f-b19726ae74e6", "comment": "Malware payload (Mirai)", "value": "03a1f839d37cee0894898183b09e700d58c8160b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364974, "uuid": "37e5a39e-ac78-41ea-8656-f9c8fda616e5", "comment": "Malware payload (Mirai)", "value": "5d23253f3334a5d25e175df28293728fb032a1f2a83315f53c891f43f0274b41e27aaa450f2579554f96b5556db90548", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364974, "uuid": "da99484f-30c2-4fd9-9cdd-e19df00e39cc", "value": "T1B692D159FC615EBADFEB5FF409B0C3460BA116E56FE99AC1A490A303CB2250921317FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364974, "uuid": "276fe49b-8e53-4456-8f35-232ca8e917e8", "value": "384:890KV5GsLVHhlTtDZddn+UOcqjXvgTmyBEVz8gNA+z6M4uVcqgw05VxJC:y0KbVLTldn+UOceITmgEF8uzB4uVcqgc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364974, "uuid": "77bfa7ee-821f-492b-a5ff-c90ab479a9c9", "value": 20760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364974, "uuid": "41561e48-a75e-4847-b4c8-f1e06d2acae7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364974, "uuid": "b4fab00c-86a1-4155-933d-f08db43c55f1", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0912d7f8-7933-11f1-ac1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783339552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339552, "uuid": "753ff457-1e69-483e-aa64-20e1c6a6a998", "comment": "Malware payload (XWorm)", "value": "a543f03ad8afc6b428978585dbdfa6c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339552, "uuid": "78bc0e4f-ee82-452d-a2a8-ba6664fbc9c4", "comment": "Malware payload (XWorm)", "value": "97cb37e235dfbc41b6a4718ca4ffeb61e36ce9ba6cd329fd5da75cc8cc12df29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339552, "uuid": "3091464c-ddd4-4082-9ff0-e8a465418730", "comment": "Malware payload (XWorm)", "value": "566334a34283c783d5225d326c1925a686ae7f65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339552, "uuid": "5847f187-a0b5-4163-97d1-c70a89eb58bb", "comment": "Malware payload (XWorm)", "value": "3fb27c2cbc731553f1b493cfbcea0a43fd15967ea6f1e0f49c2c27ba80565f31e1295f5a7daa81ba11770a89f2d43f1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339552, "uuid": "6de4a0ad-6c9f-4691-ac62-21092183de4b", "value": "T1FA55823972C41175E72E106DC8E14F4026AD6A21BB2D72F43B134B760A37BDF1EB2A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339552, "uuid": "915f85a2-34bf-4889-8ab6-50a412e16434", "value": "192:IX6TAhUe2A9HUQUSiI6yiQJ0406jJF2Hiyk5MhnaINIcLTvzS6mG53CxYjFH4a6H:MJ7xX2V9DCC8QM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783339552, "uuid": "4973f0f6-507e-4664-8e26-98020afbb57f", "value": 1303945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783339552, "uuid": "d813face-e14f-4a34-a1ac-df511c46e872", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339552, "uuid": "63934eeb-a0a7-447a-92c5-46af2181e42d", "value": "COTIZACION GAMATRACTOR.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12560e3-7971-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783366436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783366436, "uuid": "a7f4ed9b-4bee-472a-bcb6-e9ad736784b9", "comment": "Malware payload", "value": "ec2e4ccde275477539e7f509f58f832b", "object_relation": "md5", "Tag": [ { "name": "booking-customerhotelinfo-com", "colour": "#822B93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783366436, "uuid": "9f25448f-a070-4981-83ed-8352200d3c75", "comment": "Malware payload", "value": "981cc9005fb224a31130f9b8185976f51a0c705cde4e3d5818bda3a726f80826", "object_relation": "sha256", "Tag": [ { "name": "booking-customerhotelinfo-com", "colour": "#822B93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783366436, "uuid": "5e721956-2569-4449-a90a-2ba60f00be99", "comment": "Malware payload", "value": "361ff73e7003ff2b9c6b118217da68c5940eb459", "object_relation": "sha1", "Tag": [ { "name": "booking-customerhotelinfo-com", "colour": "#822B93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783366436, "uuid": "a9126a23-405f-40b8-aafb-2030bc924165", "comment": "Malware payload", "value": "35f95b3852248956789d57b176c9cbb927e9eccc6f95a9dfd8830093c510d49e33cd4639f3200e70aa2afa7280e3aa25", "object_relation": "sha3-384", "Tag": [ { "name": "booking-customerhotelinfo-com", "colour": "#822B93", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783366436, "uuid": "83fe6685-68ec-4bb3-a885-4a24635d4323", "value": "T1F894236FC963EC8EC4EBD2BD6A23A761E430BC57746435404D51BB222B87F49CA6C2D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783366436, "uuid": "360d8d40-364d-40ce-ad2e-1157ec9bdc4e", "value": "45c50c088695685800c4e9820ae701cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783366436, "uuid": "59286815-870a-44e1-8589-ea4a0d8dc752", "value": "6144:QWMy5Z/0JzznxpNNIqLvKybfrKZt0MQvcdi2Byb69ctmMo+OZGZO2Juho+xX+BA:QW95ZYl5IU/bfrKxQ+cc3NZGQ5+akA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783366436, "uuid": "96544fbc-c2fd-4eb3-aa3c-7b46081ced7a", "value": 430592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783366436, "uuid": "7ada5a28-4c1c-4070-aea7-e78f4240930d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783366436, "uuid": "1900fede-a0e8-43ba-a81f-e8354088e618", "value": "981cc9005fb224a31130f9b8185976f51a0c705cde4e3d5818bda3a726f80826", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cbae709-795f-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783358671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783358671, "uuid": "aa8477b7-9f36-4efd-b1bb-55da15bf0b9f", "comment": "Malware payload", "value": "94a865cf00289134a3c09bf4fc87be52", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783358671, "uuid": "869204cc-864a-42af-b649-73763bde5635", "comment": "Malware payload", "value": "98b1c5219b380a435f14f3332d5a54b20bbd109f3bed06bd4a2c50375703be83", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783358671, "uuid": "c16cd09d-9a25-4904-bad6-6951979d0266", "comment": "Malware payload", "value": "3afa3491311c9b9c77b87dbee8b8562aac83173e", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783358671, "uuid": "0ac10bb9-2f98-440b-8478-5084e4daed21", "comment": "Malware payload", "value": "edbe809f8ac69b2157365d3771347866a6582afaa16794fd432eed0a504c44de13626699d22a139c5da9ba5f5a1f67ac", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783358671, "uuid": "eca75703-0bf1-4ad2-87d7-d77ef8ee2aa2", "value": "T11E0833BA59409965CD3D71FAA6209C7002CDED7FBAF61A4C92C415B13BF1886B0ED6C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783358671, "uuid": "1873bdbd-9d8e-4c6d-92f5-5d209b549e5a", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783358671, "uuid": "de6e6fa7-039a-4818-9195-cc51bf6b2c1f", "value": "1572864:1t9IKPtHIJ2pf6dwriPn3lwkEcYG+mXGMIpCFSt7:1UKKkVC1t+sGMIpdt7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783358671, "uuid": "88f016b7-18ce-4fcc-baa3-7a9bbf059a44", "value": 77676284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783358671, "uuid": "8c841b02-5f69-4a59-a270-b7abe0aea650", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783358671, "uuid": "b4ce81c9-ca9b-4917-8be9-5a80b750c96c", "value": "CrosshairX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110229c4-7949-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783349015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349015, "uuid": "cd9d026e-60ad-4fa5-8a0f-372d0e659b57", "comment": "Malware payload (Mirai)", "value": "f3a4d210714facf74193acd93ec050df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349015, "uuid": "8b11a0f2-90d1-434c-aaa7-c2e0c7ab4c38", "comment": "Malware payload (Mirai)", "value": "98d6f070e93ac3f3fe4f31b3ffb95fa91fe34a32bd60fb7cd40c9b627d479e32", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349015, "uuid": "e9426e5c-28d7-4fde-aa16-70555094047f", "comment": "Malware payload (Mirai)", "value": "b4ec20b36cbe45f2b3d34f23b329d9dbf6a23242", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349015, "uuid": "4953034f-3a77-4153-90cf-54fe78326d9c", "comment": "Malware payload (Mirai)", "value": "d39fd67b8ea5f44ef7f8bb1f5ca8c184081edb4d1ea3f198bb1b13320f64eee1beac2ab56af16606f472cfd73cc35ee8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349015, "uuid": "d39f99a8-deed-4e0c-814c-1db63b6cabe9", "value": "T1D4D33A07B5D180FDC4DAC1B44F9BF13ADD33B52A1238B26B2BD4AA271E89E305E5D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349015, "uuid": "c54107bc-e74a-40c1-8e1b-0bcde384f942", "value": "3072:DY8qaNugy/GIFe5uWnSKC5pgQkXoZkf7sAh5HO7ukA+NX:DYFaNugy/BsgW5MQI7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783349015, "uuid": "40e4ff8b-f3f9-4c57-ae1b-ceaa04824059", "value": 141192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783349015, "uuid": "f69ee4ab-06b5-4feb-8cc4-21c15712c008", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349015, "uuid": "b7c5cc48-d343-443e-b4f4-54371253ab5f", "value": "atomic.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ecac58-7948-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783348922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348922, "uuid": "4f0282ea-61b7-4d13-8803-c51a576b4493", "comment": "Malware payload (Mirai)", "value": "aaecb0aa9ea86cf18679791138beab22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348922, "uuid": "85aabb50-86c5-42f6-ad3d-7673e7193fba", "comment": "Malware payload (Mirai)", "value": "9917a1711c435532fd03e90e2328450716a58fcc00a8217473547102bd7d3c66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348922, "uuid": "b76c9c53-e825-4e8d-8134-7fc19b83a702", "comment": "Malware payload (Mirai)", "value": "4c582511e273bd09370cc6c18541769c3cb8aa06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348922, "uuid": "ffb4bfa7-c341-4298-833f-80bbd92a15b0", "comment": "Malware payload (Mirai)", "value": "69c8892ee4310cad1662ce911565b1545c978de94693ca45aaba72b0ad419afaa91c18ee76aa91d36537a319f6ef98f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348922, "uuid": "1148dc00-93e4-493b-bec8-c5dbed1c9633", "value": "T18743F1ED77108875FD5B187A90FA43B2E230B1C5B29DCF9583402CDAE69987DA18BC25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348922, "uuid": "746491b9-d7e4-413c-b251-88e6f70c033a", "value": "1536:l4TOGcQKfQ0mQwsXMNPy/j3vzomhLpDU056q8QnBb:lScNxm68NPI9hNDvkqDBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348922, "uuid": "92bb05ea-f364-4373-adc9-400242aa6a19", "value": 56964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348922, "uuid": "5b59e137-e104-4ea3-8668-7138aba8d8be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348922, "uuid": "51271ca3-b9a4-4b17-b36d-5dfe27b314a8", "value": "atomic.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ac0bae6-7908-11f1-ac1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783321167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321167, "uuid": "7f164cb0-83fc-4d17-84fe-564eb00d524b", "comment": "Malware payload (XWorm)", "value": "240abdc40625d5456f432e4bf513038d", "object_relation": "md5", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "hoteljune2026-blogspot-com", "colour": "#3B4D50", "exportable": true, "hide_tag": false }, { "name": "mineiicancry25june2026-blogspot-com", "colour": "#CF77C4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321167, "uuid": "fda36ab4-b154-41d0-b0c0-72e8bf5468d1", "comment": "Malware payload (XWorm)", "value": "99ef5b76507261c46a0c439da6ec77afcb5b01a127615baa64d017002cbf49a3", "object_relation": "sha256", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "hoteljune2026-blogspot-com", "colour": "#3B4D50", "exportable": true, "hide_tag": false }, { "name": "mineiicancry25june2026-blogspot-com", "colour": "#CF77C4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321167, "uuid": "3b19c93f-ed4a-487e-b332-c344a8dbac00", "comment": "Malware payload (XWorm)", "value": "e76bbfd21afeab40f2d10caaffeac5e2d678fda0", "object_relation": "sha1", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "hoteljune2026-blogspot-com", "colour": "#3B4D50", "exportable": true, "hide_tag": false }, { "name": "mineiicancry25june2026-blogspot-com", "colour": "#CF77C4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321167, "uuid": "495a0448-76ed-40c2-8cb8-b526dd29f1f0", "comment": "Malware payload (XWorm)", "value": "23d283abcdbf7195827348a282eaa9ea244c3c0adbce269542a7848dd48855307f97adce60653cb7542c8bab91e80933", "object_relation": "sha3-384", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "hoteljune2026-blogspot-com", "colour": "#3B4D50", "exportable": true, "hide_tag": false }, { "name": "mineiicancry25june2026-blogspot-com", "colour": "#CF77C4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321167, "uuid": "3707862b-fdcf-40e2-a3d2-a4d0d38b09be", "value": "T19A325B97E442D16E7D3FE93BF6CD2E61A9419ECBE9CC8702A0D8811E53F839560066C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321167, "uuid": "c8075d2f-88c4-409b-a487-4539b52e5c28", "value": "192:OCwkyM/vfikJCY7sS8vshOCdvoYZp6ba+8NN0YcQPGGEvkXHptX6Wd:OCwSviXAVXI+FbsQPxskpUWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783321167, "uuid": "e4d1dca4-d791-4b37-ac09-dea488f53916", "value": 11836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783321167, "uuid": "f007f666-f8f4-49af-b01b-a27e5a8ae36c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321167, "uuid": "cccc65f4-7e88-44e2-9a52-960d41b5b2d8", "value": "09c1d5_e167390a12384599b0bf0dc76170aa11.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499d9448-795d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783357699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357699, "uuid": "9282e09d-d8bf-4b10-a0ef-567e79934b91", "comment": "Malware payload", "value": "ea112a1e35a946539aa45d3fa705b8ba", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357699, "uuid": "f19595bf-fdae-417a-9eb5-ea92eb65bbc0", "comment": "Malware payload", "value": "9a34d891551bd469fa1adfc39c49cf9d060fb58fd6dce8c6f6c300c433552114", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357699, "uuid": "5584792a-ee90-4af2-bca3-1ee96f6405fe", "comment": "Malware payload", "value": "5767d13b586afa47a1db636823a14a89ea554484", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357699, "uuid": "388c665f-d995-4417-bf1d-de24f197c522", "comment": "Malware payload", "value": "0a872cfb2664f0a253557feb179d16e193013890afb9a6cae8f4f86b717ae9fa063866f48274f8c50228278edc4363eb", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357699, "uuid": "2e74b4bd-b175-48ea-92f8-5b61de45cd8a", "value": "T177F7331B1532DE1ED9277C32AB107E66CF4743BBA475665DB381844CFA9C0C2296C2EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357699, "uuid": "6536e1df-a4b1-4c97-a925-b5522b694877", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357699, "uuid": "a640d4bf-f9a1-437c-92a2-10636c4a20dc", "value": "1572864:2t9IKPMZpeqPRWYSTM9sbVlMUc0bajJ5GcsGaP0SnQd7:2UK0bPRWjw9srM1UEDGc/aPsd7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783357699, "uuid": "599c8839-e280-4027-af1c-a893eb9a3c00", "value": 76813476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783357699, "uuid": "89bd8ad2-0f1e-43ed-b67a-c1725eef9067", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357699, "uuid": "c9d433b0-ccc4-41b9-b2b6-d2fcba6741a2", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227ecfac-78ce-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1783296216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783296216, "uuid": "8639fe57-6176-464b-b22d-dd74a3d940d8", "comment": "Malware payload (SalatStealer)", "value": "f824a768273045feffb83b256ed6dc07", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783296216, "uuid": "f770f98a-a7d7-48c6-82d3-1c121d8ef052", "comment": "Malware payload (SalatStealer)", "value": "9b44ac08112b3a2bbd7627727f68aa1dea140b89878e0f9c4493567f115fdabf", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783296216, "uuid": "e35ea160-31ee-44a0-b604-cbdc019cb4dc", "comment": "Malware payload (SalatStealer)", "value": "a2c9c7cabeb88d04230c40ab15593ddddc71ce8f", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783296216, "uuid": "6b5b6c0c-3216-4d83-a6ca-9b9fd0553f4e", "comment": "Malware payload (SalatStealer)", "value": "44ab268d369bd6306460fb4b6ca998510a089645cdccb09b5459ad7cd4eb194f3fbb8d5a3f73cc54c0bf5659443cde92", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783296216, "uuid": "9e821fea-02fd-4262-b8c1-becd8fb7d417", "value": "T120F533719EC643D2DD6AEE3CC1D6588D083D5473E8D2BDE2BB5FA0428EC750EB026256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783296216, "uuid": "d007d38e-4571-41ad-9935-aab2351dad62", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783296216, "uuid": "44d6cdcb-694d-4b9c-8c21-0c0eea8f585f", "value": "98304:pATrwE8f6mSkLyA4pLYXi83Ela4DVS+Btev1MXBDO1c:aPQCiyAwq3X+73evCXBic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783296216, "uuid": "859963b6-9881-410d-a6f5-8dfaea5a7156", "value": 3591680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783296216, "uuid": "4bdec409-30ef-4814-b60f-2e892b7585d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783296216, "uuid": "faa41808-8970-4a0a-a9d6-1fff18383c49", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4010cf-791a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783328844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328844, "uuid": "c789db73-646c-4927-94d0-4fd8cd8d6128", "comment": "Malware payload (AgentTesla)", "value": "a6abfeb75c496d2cefb9061ddd992b71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328844, "uuid": "aca085a2-6ddc-4925-83b1-a642a77ae446", "comment": "Malware payload (AgentTesla)", "value": "9b51c77931a32be41eb1b4919951e063da93bd60dfefe103ba004e8c84c7e6ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328844, "uuid": "107e4d49-668c-4312-85e8-fb97d7429ff6", "comment": "Malware payload (AgentTesla)", "value": "59ac907b206d131077ec0dea4ab35b8c32adee52", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328844, "uuid": "e32ea64b-b593-4454-8d47-0378973c615d", "comment": "Malware payload (AgentTesla)", "value": "19834e30e43b7d9b0acc330925d42d6234846b5aa94095c2a7d48681e823fb877261f2456498e89a751a4aca499083be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328844, "uuid": "c395ed88-5b18-4d09-b53a-4a3529fefc03", "value": "T1E394123037E0C456CA732230D4BDA5FA19A46E28D7C8919BD335BFDE3DB63808D29665", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328844, "uuid": "844d68c0-5032-48b4-a870-dc3ea58b5020", "value": "46ce5c12b293febbeb513b196aa7f843", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328844, "uuid": "b9d389aa-dc0c-4d06-b8b7-14809ee6b72e", "value": "6144:2X45rw6WQbKUZrK25zWhJqN1MuT5SA94LhIOhR5IDLMcAXmewZ/9WP3:2X4nKSZhsJq/fNS/HhXIDIDXmewZ/9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783328844, "uuid": "279221ba-19d1-4be4-bea3-6b1af50d6de3", "value": 418824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783328844, "uuid": "bad58155-6bcf-49d0-b4dd-60852b785569", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328844, "uuid": "4cea7162-3102-48bc-8e97-3a9abd104d38", "value": "PS-PO0726-8406.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbcd7568-794b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1783350187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783350187, "uuid": "db859085-8931-452c-9e30-10953a654b10", "comment": "Malware payload (SilentNet)", "value": "e381459b568962a3843814f5860f7cba", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783350187, "uuid": "f6de040d-861f-4416-a7a5-7029afa4573e", "comment": "Malware payload (SilentNet)", "value": "9c0b8629844dcf8078506e2d07dd3148eea70854384e9ac48d6f195bf90ae56c", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783350187, "uuid": "e04ba527-e984-4af4-96bb-5217fb304523", "comment": "Malware payload (SilentNet)", "value": "920937d6a84ee5d7b13706b00af65dbd1c365bf7", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783350187, "uuid": "f35658bf-09cd-467e-9d8b-e6157b65eb21", "comment": "Malware payload (SilentNet)", "value": "d631aa73f3936fc87c83d7d64a55307914516bd396236ea87b5e59916d514ad6952b9aacbc41654d9e8706fac1752d28", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783350187, "uuid": "7ec35aa5-01b5-42b1-b1d4-5b846dac6321", "value": "T1DDD63350FAA58972F0534A7045560A3221E8E283D817737FBAF245DE27198D9F3E7BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783350187, "uuid": "9e3e9aee-3e65-4dba-a7e4-a790e56f5ed7", "value": "196608:OE4dwnx456QuYUKOuPbmouF+DZmIS1jTKrv32924U3lcmB+2Y38db2Ic:OE4d96QuYUEagIzjTPY46lc0Y3cA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783350187, "uuid": "2550da08-0c4a-4968-804f-da79b4fc8c54", "value": 13089318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783350187, "uuid": "ee848fd0-3a40-4567-9d47-cb037085033e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783350187, "uuid": "3b541390-9509-41b8-a169-185f7c5a7e1c", "value": "krytponcrackedbyu4xi.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b17daf9b-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783365175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365175, "uuid": "ffded6b8-1df3-4ec6-8780-f98bb303c1bc", "comment": "Malware payload (Mirai)", "value": "4b86ec40356d4b04c957c91081c33e0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365175, "uuid": "1412dce3-4242-44ad-b0c2-73fe53aabdad", "comment": "Malware payload (Mirai)", "value": "9c7a29eb83b5321700242247eb96b1aed5b141ef1b5adc6f1fe3489567e2907b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365175, "uuid": "6545af61-38fc-46ed-a1c2-bc5ad680c5d4", "comment": "Malware payload (Mirai)", "value": "f843a8e9fa8b2cecc77545bedf462c6a979a535a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365175, "uuid": "af516a7e-80b2-486a-81f3-fb7d1c05e4c2", "comment": "Malware payload (Mirai)", "value": "03d2ee4ddbe070915f153d39e98ea2eff0f07212f2e00c8af947805df193cfe59db5ac65c73a3cba1ee76a1b3741a569", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365175, "uuid": "c3c5dd28-00e5-4c60-8875-337ede84f50b", "value": "T1E3132BC4F643DCF1D85706B03176EB365B3AF1F6226CE543D7A89A72BC52202E94299C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365175, "uuid": "4da66306-f265-4dc6-856a-d6e9bca151b9", "value": "768:1y4BQvEURm7DjqdN8OVWzv9rlOUwGj2aTFaF5HEvms:n+8mm7DGdN8Oozv9rALGaaTQTHEvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783365175, "uuid": "3a70f104-a4e1-4aa1-be5f-b18200b7cee0", "value": 41776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783365175, "uuid": "146ca62b-0955-4343-bbf7-a8ff40e8cbec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365175, "uuid": "cf37df3c-8980-4eeb-97f8-3f6e14e30089", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc8e23f-7903-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783319082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783319082, "uuid": "0dbf43ac-d88b-4b65-a3e5-47838a288b65", "comment": "Malware payload (RemcosRAT)", "value": "615b6beb39b2ed54216ec3702269d99a", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783319082, "uuid": "dd003848-15e5-492d-b2bf-4b69598a4a75", "comment": "Malware payload (RemcosRAT)", "value": "9e09d3a51f169268e0adaecec1a2ce2d2d903d9993a19172ef0401645c00a546", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783319082, "uuid": "47fb4068-6c8e-46ea-ac6d-b8ba55d2760f", "comment": "Malware payload (RemcosRAT)", "value": "992940d711c54daa2a3801f57e9d81bfe8dd126a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783319082, "uuid": "b5aebf5c-e304-4f09-a924-42b24f15669f", "comment": "Malware payload (RemcosRAT)", "value": "8cd1ca5370ec2131dc1f28115bcb6e1346aee36f53eb5ce7e9388d16550abced4196d0821a528c644531e6f3638a8dbc", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783319082, "uuid": "30c44d1e-9826-411a-814a-51e07c16aafe", "value": "T161434C12EED40B370E8B479EBF654F66C4FCC614403978ACE96D771F8502A5CA7BA128", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783319082, "uuid": "5ebef75e-e9c9-439c-9708-3bbb8d4f9e4b", "value": "1536:bjXcfamXSlXiXCqtVAMMqZWpA7I0sh60hMH+Zl4:b7cSmilXi5tmMM2W2sh60ueZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783319082, "uuid": "6f6d243a-3d20-4b86-b55e-269083049ca1", "value": 58300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783319082, "uuid": "d3e6e31d-e8b1-42d4-b4ec-fde788b3ffa5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783319082, "uuid": "487d2976-878c-4850-ab6f-a424e58ba470", "value": "SHIPMENT DELIVERY- Booking AYN1343237-pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "171d9412-78ed-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RatonRAT)", "timestamp": 1783309511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783309511, "uuid": "fb503129-8710-4559-8db3-3fb7cd767f12", "comment": "Malware payload (RatonRAT)", "value": "5d1ddfd84a62919bfd7ec721349ddc70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783309511, "uuid": "aa1961ff-5975-433c-b457-e15c8716c0d6", "comment": "Malware payload (RatonRAT)", "value": "9e739748aecf8018fdb73f4d5abf6ca7335e5972eb1b85525eaf86f4a2c471f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783309511, "uuid": "91f776a7-bb06-4958-895b-b25ed6307fd1", "comment": "Malware payload (RatonRAT)", "value": "4afd3f4c10077b95b123f3eec079ce66257e2642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783309511, "uuid": "a72f52c2-c308-48f5-ade0-b3621ca15cfd", "comment": "Malware payload (RatonRAT)", "value": "df469c3973fd2ef518a823d33060ae7c416d4e7a1d6ac408e536c98898fc7fa03a9a13e34e02697dafeef52bba965885", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ratonrat", "colour": "#3010AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783309511, "uuid": "567fd7a1-fef3-468c-b8bf-f8eb53da701a", "value": "T1B4444B06B3A85179E2BFCA79C9A14841EB727C568B71E6CF074179790E72BC09E38713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783309511, "uuid": "0051de77-03fe-4a4e-86b7-4975480109cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783309511, "uuid": "21643145-29f2-41f1-b420-d6b69807a6f1", "value": "3072:RgTMWwBgAX4tnGrFPGOsSbPKfQCvrfXqeXA/4yIg9vkNPNu6H6xCYOihUE265AJn:RgoWogAXpBO8bwtvgvkNFNaxmpEgJ1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783309511, "uuid": "a8bb02e9-14a3-4f12-bffb-f4987bc838b9", "value": 264704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783309511, "uuid": "d4ea30a2-d947-4480-b772-f43f0b879b99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783309511, "uuid": "2a76d4c8-92a3-4641-b28c-4694394856f0", "value": "Xeno.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ad0612-7984-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783374733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783374733, "uuid": "48c56cf3-54c6-48ee-b8c5-ebe95b978202", "comment": "Malware payload", "value": "3311d2a09a143330380cdd63831f937d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783374733, "uuid": "dc58a1d1-bbe5-4747-bd48-f54b8421ee83", "comment": "Malware payload", "value": "a2ff251395e9f34a538c6692e41104eb4646fdaed03c06420bcb348b90162aba", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783374733, "uuid": "f0d5764f-672e-48a6-859d-23df725e02a7", "comment": "Malware payload", "value": "e769acd9bb6ee110e42720db83a5fe7df282835f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783374733, "uuid": "2d2f2c42-919a-41c1-a26a-aee0c1f178c6", "comment": "Malware payload", "value": "cd3e0feae287dd1c50ad33ff0eb2b4205b0175f65836a16f32ce62c8227f75b30d8c22792fd5af2cab387d760ba95754", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783374733, "uuid": "52f69ace-c7ea-4043-86a3-353bc903ba3f", "value": "T19FE6338CEAE011FFD677013CEED15285E6B8B4611775CAEB179483E1AC271E0C93A663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783374733, "uuid": "e11067c2-281e-402c-b03b-a5c434bde5b5", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783374733, "uuid": "d4077d38-294d-4232-9ca2-8c084ebfa9bc", "value": "393216:6RnX5SFdqHcDWpr1EvXOWNXMCHWUjXPcuI3/PGTAI:6HCdzypr1khXMb8XEH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783374733, "uuid": "d8654617-e269-47e6-99e4-33f48d0be818", "value": 14305361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783374733, "uuid": "b2ca23a6-ded2-4470-9404-2f7350e66e7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783374733, "uuid": "3fe13b55-78ec-4e3d-a1d2-7ada03d74619", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b34725-7921-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783332113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783332113, "uuid": "4634db83-735e-40e0-b17e-0eac4e34b1b1", "comment": "Malware payload", "value": "1b4f402cc7a47ae6bd6e7130cae567d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783332113, "uuid": "859a37e2-09a4-46a0-b57b-745fdf6cad51", "comment": "Malware payload", "value": "a3d6068222e48dd165adc71fb162149085b1f585dcdaaead56b8549098c78dee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783332113, "uuid": "32fd018b-32c5-4b51-a2e2-f03d8a8779ce", "comment": "Malware payload", "value": "5ed37eb8ddd6bad758f9c25096c470741f9e44c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783332113, "uuid": "eacae515-2b9e-43ef-be6c-64ad12a0cd76", "comment": "Malware payload", "value": "e000dd22a9ca486ce3d17dda3afa82f26b569e983f978d7a2b2bf91113992be2b3af514a62e108a625876b67dd907336", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783332113, "uuid": "0c9086ac-e007-4610-95d9-627b1e82be89", "value": "T1ACD733CDE0D56868C3278AF00AD4AAD67F493E8E07D46AA36870B6042973DD4FC7D479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783332113, "uuid": "5dd1d7f6-aa34-4ee1-a321-ea1b9d1951b7", "value": "d1ca302ca1d656940889f8c04579bc8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783332113, "uuid": "10c3a140-8515-42b5-989c-273f9118a81a", "value": "786432:N0TPYhnBLdZWICc2QM3PWfctdY6ztkjkmldqJAfOBjcWYRA2XwG/fW4zDE8gR2:aCBBZxwQMfNeQmldd+sRxjfJzDE8gR2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783332113, "uuid": "9ecf1bbc-b3e1-45ca-92ef-7b9fb8282310", "value": 58665472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783332113, "uuid": "9d22b5ef-061b-40ea-b65c-6b1e30cc2b5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783332113, "uuid": "ccf22232-0689-463f-9fa6-8e590564b33c", "value": "End.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43198b43-78ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783310014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783310014, "uuid": "7be125e5-4e3b-4baf-ab6b-8c8508e3dbcc", "comment": "Malware payload", "value": "b868ce5d2bb4c60ac01f431adb9d99b0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783310014, "uuid": "785f0189-6ede-4e7a-bc73-a9ffac27f154", "comment": "Malware payload", "value": "a3e6d85f127a80b641f5c4244341488d9cf02e9812884c33675d79c9e2617456", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783310014, "uuid": "3d8dc33d-387b-4236-ad6b-4ed960345d10", "comment": "Malware payload", "value": "7619c3c69be197c5840c9fc93afde1df58310fe8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783310014, "uuid": "bd9ef922-a652-4d7e-a3d5-add73f410b1b", "comment": "Malware payload", "value": "ca36bbb6a81317ffac64463ee1a77437430ec54a042f5979b56e72767264383e171ad30a8d89cb7a8adea00e4f5a62ca", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783310014, "uuid": "0ff33c06-aac4-4343-b4dd-422227d72a95", "value": "T1D31186DC2A61303A2738CD69B1D94B4E79C390EBA9B20E506B3C707772B8344B854B57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783310014, "uuid": "84bb3290-9619-4c68-a11e-d219743f6b16", "value": "24:3J3PygLYSfEyQWLYQIQOyhNIxLYciyNLY7Kw9fG9UY1E4CWk4fKToNP9daN9M/+i:Rd3ECKLIwUv+9UKE4CWk4CENP9do9M/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783310014, "uuid": "f5c8adc6-f677-4626-b9ba-87b4607a2280", "value": 1086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783310014, "uuid": "13b3830a-64a7-45a5-83f0-e7fb72c05a4e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783310014, "uuid": "8756013d-91d5-4e77-ad5c-1134855854e4", "value": "c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20c9a48-7930-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783338547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783338547, "uuid": "c1fb0db6-7f47-4458-847a-61e8877013c9", "comment": "Malware payload (Mirai)", "value": "fa0bb7c0fb02a88df55a05a0cf529d22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783338547, "uuid": "b225de45-7685-48da-b1ac-e37a0446ef7d", "comment": "Malware payload (Mirai)", "value": "a4d9f2bfc48bdf9afecfcdd323a988e2413da6d841685796e7e9d522794265a6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783338547, "uuid": "4d0a404e-4647-44e2-a9e9-df7254b3d2fc", "comment": "Malware payload (Mirai)", "value": "e52ccad804b4af6c0d8055134f5f63ea040448f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783338547, "uuid": "b560166b-ecf6-4966-8375-f32036b82e96", "comment": "Malware payload (Mirai)", "value": "80d45b95b56440b27a13b371945e07ece64534cfca15c71dba1fd1809bf8282b63f1306068cdb265093d62a4669f497e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783338547, "uuid": "e41bf296-641e-450f-9a37-385147625709", "value": "T14A256D5AF2B370FCD027D030439BDB62A83AF47501216E7B65C4DA352D66EA01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783338547, "uuid": "3bfbecb9-fe1c-4218-828f-7d53390a3bed", "value": "12288:gZ+iQJzYALzjf51mXryImU5vEXEWWmy9x4++L975k:gZ+iQJvzjfbMrHmScXlN+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783338547, "uuid": "45299b3d-b7f3-4db5-9062-0c941d2c5bf0", "value": 1033120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783338547, "uuid": "31d129a6-0fb8-48f1-89c0-96479443467d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783338547, "uuid": "0a26f785-3599-455a-9407-9db2c7949ad5", "value": "a4d9f2bfc48bdf9afecfcdd323a988e2413da6d841685796e7e9d522794265a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0484f871-791a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783328807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328807, "uuid": "754ad64f-f434-4da9-bee7-77ca1a5e78c9", "comment": "Malware payload (Vidar)", "value": "85fb231ecb3fb2c3880b29be30034b86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328807, "uuid": "83225dd1-a49f-4cdc-8ad5-5242633890c8", "comment": "Malware payload (Vidar)", "value": "a670b03c1da00ee2c8622fd716085358d7e36ee98c4adafc9bda53eaadd59527", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328807, "uuid": "3afc3bf2-b98a-4ceb-9d2e-0e8bfa5c3ee5", "comment": "Malware payload (Vidar)", "value": "28fb34a8dc7b82c4820891134e6f19941e502dc7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328807, "uuid": "11e6afef-44a2-4d10-9253-7c95d8c020df", "comment": "Malware payload (Vidar)", "value": "af1df2c8b8265b69c2f449b3ac9354a61872b1674edc33e98cd41fd838c1459a35e8ae2470726a69017540b10570a964", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328807, "uuid": "d2d34a73-1903-4e2f-abdd-ef15f293a037", "value": "T12B42E68573D3B1BCE569D17DDA8A22AB9B513082132F0EFF4AECC89466C355074B8B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328807, "uuid": "e18bd994-ff23-4465-af95-3e27ff790163", "value": "62e9a0cc2e038f56c705f0c6bd8e420e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328807, "uuid": "bd690774-3136-4443-a19b-99a1b81cf609", "value": "192:OlQ96MT50T9GoIzrvXv9DcqwcKGpE9rpez4K8VdcgdsA3V1V:OlK6S0T9L8rHRwc7porp+4nVDtl1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783328807, "uuid": "de8f5425-276c-4f64-94a4-2a0577ed4a03", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783328807, "uuid": "76d96b59-34cd-4cd0-bfe1-de51f9ebd8e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328807, "uuid": "f199d696-1123-4241-9d34-8fd0c2573265", "value": "85fb231ecb3fb2c3880b29be30034b86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b5ae0a-791d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783330123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330123, "uuid": "0e9fd35f-94ac-45aa-86f4-776368c3e36f", "comment": "Malware payload (Mirai)", "value": "d4a8163c0c358c443cf97b4583ba5454", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330123, "uuid": "ac5f20d6-4af7-486f-bd47-65e0482a1292", "comment": "Malware payload (Mirai)", "value": "a6f8bba8ae599363d7c03fb7164cbc23c3791774a47fbd9e1daa5cc876fba257", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330123, "uuid": "05dadb70-f257-4e70-9d69-97f309978c12", "comment": "Malware payload (Mirai)", "value": "d75e9ebdd709590daf1b9d8a7b496c2e695ddaaf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330123, "uuid": "d75b608a-317b-482a-9631-2dc3fefcde71", "comment": "Malware payload (Mirai)", "value": "61f425bc2ecb96b17aa332ac9f284742a06d8efdb68800290baedcaa6e920fb09c2bf0f3bf4c4f88ef9444cd4989bc37", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330123, "uuid": "2e11b02c-cf08-408c-a20f-0a3a0c0a9623", "value": "T1A3E32AC7F900DEFAF80AE33748570905B630BBE115921B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330123, "uuid": "2bd23fd1-580c-46e8-b2d3-c873e58c9d82", "value": "3072:SmzTDH86JS781+DBdjAj8GidMyQ9g4VvjbicLNPgym+Y1j:S2TDH86J+XjAj83dq9gMLqymx1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783330123, "uuid": "faaa2e4e-ce91-44da-9c22-bca4fc741e9c", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783330123, "uuid": "7729fa74-1e01-4e93-b162-7c554b1cd978", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330123, "uuid": "ab4f49cd-a88b-40d2-a4f4-11009b86d877", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa96c321-7993-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783381189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783381189, "uuid": "1c13fc66-ebf7-4270-81ee-0cba69a4f9c0", "comment": "Malware payload", "value": "55130c7671b3a9ac54ca79fb7ec489ba", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783381189, "uuid": "bf5ca3f3-dd1e-4876-beed-88e9f4dfcde7", "comment": "Malware payload", "value": "a7365f1b0defac950f0d60df3b1685f1e2f0d5d75f328a01c1cfaaa71f0690c4", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783381189, "uuid": "2167f6de-2e49-4937-a4ce-4f98f14aa620", "comment": "Malware payload", "value": "c5fad4d6d6c06082f9eb950268df55b90c76ce8e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783381189, "uuid": "8a7215b4-6c44-4259-9460-9b95874b2a08", "comment": "Malware payload", "value": "105739f8e7f62d8dae26a6683f1c49b0d61d19099d0c8b69a37b41af57e847502fab5ba899521bcc9ac65744a026de42", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783381189, "uuid": "d0e3c6ed-dbcb-4708-bf16-d82ed6384cbf", "value": "T187D097B76133027420B60808F1D2B040B421E7BE0C81C82AFE0B38722F4034AF0C32A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783381189, "uuid": "57e0775b-833b-4750-96c0-d389d950ad83", "value": "6:hT0omiCOpsrVmIuAulNXYq9DG+NjVsNXYrkJ:VpXCOQVmIuPiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783381189, "uuid": "9249ff59-d6df-4fe8-875e-bbb53a5cb766", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783381189, "uuid": "a14db6ba-3221-47d1-b24f-f2c74bc420d7", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783381189, "uuid": "c59a8916-e148-4482-9758-389a28076a43", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58bc193-7948-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783348915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348915, "uuid": "d352c876-783d-4bbb-9c6f-73344a7c2f69", "comment": "Malware payload (Mirai)", "value": "ed6a4f6fbcbf62d9662ae3a9e446fdf2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348915, "uuid": "15247ddc-3fc4-491d-9dc1-8152fc36cb82", "comment": "Malware payload (Mirai)", "value": "a755d3d69072ae86ac615b3c8d5203e23ae2921d1f8717471090402c11640a31", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348915, "uuid": "33a90472-54d6-4b21-a716-6ac99bf74e7b", "comment": "Malware payload (Mirai)", "value": "7b1a4a4874fc0dfd584b1b927f0b3a79d22a75da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348915, "uuid": "756dfb42-e74a-4f8f-bd96-c68a872bf44c", "comment": "Malware payload (Mirai)", "value": "7ec46ef27e9cdfef71ac151beba150df4404fb7ff3504aff0ef603431fafb50200f4ffaa95d1b1e8f91e0b7adf0a3026", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348915, "uuid": "d23ff8ad-b69d-4e2a-aa91-cdddc84bec8f", "value": "T14082D0B0815BEC72E6628C349DDE45495B034B38D5F838319621C1AE48966CEBEADEC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348915, "uuid": "13003bd8-cf19-4341-9030-3fe2d005d002", "value": "384:OkciRGxUP7zid/0yd+Ui4AUcDQ73nkUtBdK8hymdGUop5hum9:Tga//8AUAQ73ldls3Uozwm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348915, "uuid": "4ea7d1a0-5357-4063-845d-d5c36be13da8", "value": 18992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348915, "uuid": "64307fc0-6eac-4595-97d2-c3fbeb644586", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348915, "uuid": "4beb516a-df05-4cfd-93f2-f0065060881e", "value": "atomic.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ca405d-78d7-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783300060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783300060, "uuid": "d36f60f8-e643-4abc-8b9f-baded4d608cb", "comment": "Malware payload", "value": "39f30afbc5e2c11383b60ae8e769621b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783300060, "uuid": "e4657cf1-16b8-4282-9644-73b5571b1331", "comment": "Malware payload", "value": "a7a2d9d304e931bae66a1059abb0b9eeb7f70b67c64981227bcb22b2205a9493", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783300060, "uuid": "e8ebea82-64f9-4708-92dd-cf4c1573d3d0", "comment": "Malware payload", "value": "a003b606034295911091cb301b35dd0124bba83d", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783300060, "uuid": "0b4462a7-bb39-46fa-80d5-b593e0822655", "comment": "Malware payload", "value": "f18c26335f81237da4ca39e87cab45c694b1625af13569a621847a22cbd368acc686b9a616a253a59790a0ded87b8547", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783300060, "uuid": "af0ce559-9705-4819-b3a9-9885d871c202", "value": "T138136C6526913C28AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783300060, "uuid": "237f8887-7f5d-479f-8718-91fd5b9100e3", "value": "768:pXRWNGxV49GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:jlx3co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783300060, "uuid": "f5edf008-f604-4565-8e2d-6e2ae324fe3f", "value": 45517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783300060, "uuid": "5541132f-6c65-4359-ad87-bdff4a9ff0fa", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783300060, "uuid": "42febe4e-148a-4382-be93-b6f7bbbb92e3", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811d6c5b-7939-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783342331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783342331, "uuid": "86ed398e-6eff-435d-a689-a2a611035eda", "comment": "Malware payload (Efimer)", "value": "3d7e39e250a7999bea40388b423fa0cd", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783342331, "uuid": "2679fd75-4760-4930-ade7-9d7ea93e19ca", "comment": "Malware payload (Efimer)", "value": "a7e0ed9edda2624c3ccc57c30a63081eac4f07e48ae2b4e1b399742878bae7a3", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783342331, "uuid": "8c4094ea-7200-4980-a8ca-570f91067581", "comment": "Malware payload (Efimer)", "value": "82e0ee97f33b117c4cbe5af27907cbbdae1c8f71", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783342331, "uuid": "874eede3-4cc6-4a7a-a627-3de3facb512b", "comment": "Malware payload (Efimer)", "value": "a2f319350cc3aa19bf9fe7bba6dbd863fab182d39f75d27984ce77d335181ad7716e434eba37f834db097572216fb4a2", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783342331, "uuid": "6c7202e1-c4f4-4ae3-816d-3be0787907e2", "value": "T1BAE6334C56E022F6FAB7413CBCE10992E229B4B15775C9CB1398C791AF572D16C3AB23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783342331, "uuid": "d2af1b49-994f-41b3-aaef-704ae3ecce08", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783342331, "uuid": "66835ccd-b49a-4daa-abd9-93bfd8883784", "value": "393216:JRV4xSA+eYpC0GC9JRlJhXMCHWUjXEcuI3/PGTAI:JXCpCC0GC9XlJhXMb8XRH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783342331, "uuid": "5c26ff90-6778-484b-bd8d-06a0e410e4e0", "value": 14285088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783342331, "uuid": "f3734238-ef57-4757-af00-6ac39f789f1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783342331, "uuid": "04f44603-61be-49a8-b188-00b8a82aa36b", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9c7fc6-7920-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783331456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331456, "uuid": "5fd89511-dd6a-42b1-ad55-b3fb15882439", "comment": "Malware payload", "value": "7b452e037ac267b5c35781dce8e70762", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331456, "uuid": "bae6c946-ef04-4488-9456-b75f4b8b7192", "comment": "Malware payload", "value": "a8d23b7463779c5f95cc0f2d9c1605e7d2c88cec311679834240805a693483ed", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331456, "uuid": "4f09aa05-bb3d-4c17-84e0-a47e602cb75f", "comment": "Malware payload", "value": "98c9b0563b388e07279f6822335f6f1f25b4ff8b", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331456, "uuid": "0b901fd1-978c-4ae7-9872-a32228c6482c", "comment": "Malware payload", "value": "6aa8c1598f38e43e187289b0a60c535f3a41c2c810897ca59bda88655f4f4ef7d8acfeeba01ea1dceba116cd4da9b135", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331456, "uuid": "9a1eb348-9d5e-47ec-87e6-75ffca9bccb8", "value": "T10D57F9389D9E0B223B91D7F9209E52FDC52598372B013598F49D878C2B63790B7AF907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331456, "uuid": "77f5797a-abbd-453b-b017-82dcd76e7843", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331456, "uuid": "e17f57b6-0906-4ea2-9d29-840abe075557", "value": "24576:VN1nxiPH1lZO/oejVEfqM2IFKEmN8ZXio4ys2bthAdras04hKCFRld7Kzhh5sR+M:5L1PkLgqAXNQG9v8Ktl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783331456, "uuid": "78c83732-765d-455f-8548-a4eca293b800", "value": 29635584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783331456, "uuid": "7aff3bdd-3e65-427c-af06-6b19c37b2e86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331456, "uuid": "5aaaf265-772f-4e20-8c01-6a9c50497619", "value": "Bangladesh Delegation Details .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464e0727-7909-11f1-ac1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783321616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321616, "uuid": "c2310987-ed6e-4cdf-b576-113e6c8d0a5e", "comment": "Malware payload (XWorm)", "value": "634d5de51ac7a7431ab438b34af51b0b", "object_relation": "md5", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321616, "uuid": "abb56863-9747-4f9d-a45b-b0db2f6b8842", "comment": "Malware payload (XWorm)", "value": "a909c8cfe5d369e4c3afe9a03837c8d04b9345ae4e15ca1b2bee1cebe0aad147", "object_relation": "sha256", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321616, "uuid": "71ddcc8f-8235-437f-a7f1-fbdb1583c5eb", "comment": "Malware payload (XWorm)", "value": "f4f0c9c3656775a1f9cb08617d0f46cdad52fa72", "object_relation": "sha1", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321616, "uuid": "903046a8-cf82-469c-94d9-c8e86edf09f6", "comment": "Malware payload (XWorm)", "value": "fd356f1fa778204ad3aa36b7f48e5edb11fccc8ebc4c48145408fde83882e203efed4475733a3466814ddeb9beed9d68", "object_relation": "sha3-384", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321616, "uuid": "6a0f79bf-804b-4331-bf51-d6be07302a73", "value": "T1933712A59A2E0DBE01FD3073EAACD5CE51B14B76D02D6DCEA752058D7A7FE1080A3079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321616, "uuid": "4a977d83-7e97-44a9-a905-552e20772be7", "value": "49152:tm8IGcIkuoZ8VRO+jfpY+ONdMbkMoBE/ekpQmEGd95o6AG1SoogbKc7d2hbhLB7n:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783321616, "uuid": "2f01fc7b-cbb7-4a39-8fa3-22f77d274012", "value": 24053638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783321616, "uuid": "792acb4a-d001-47e3-9ff5-9a36bc80eb97", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321616, "uuid": "62dd1230-6e6c-4306-b264-e581fe23d6a1", "value": "a909c8cfe5d369e4c3afe9a03837c8d04b9345ae4e15ca1b2bee1cebe0aad147.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3e46a0-7949-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783349008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349008, "uuid": "e0c2379f-73eb-46a8-a3de-50bc4c39c609", "comment": "Malware payload (Mirai)", "value": "d6ea2c522d450f354d9bee11a388a150", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349008, "uuid": "3a8e3fea-b52e-4862-9780-8b10881aedcd", "comment": "Malware payload (Mirai)", "value": "a98023bce299a28e5a1f567adedcddab99f63eee2e9556a22f52058e9bf5cdcb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349008, "uuid": "58927887-d9fc-4bd4-82f8-e51ad74b70f5", "comment": "Malware payload (Mirai)", "value": "9dcd625199cd62beac8574029fc79d9c0b4812d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349008, "uuid": "66298d7f-2acb-4794-aeff-79dece1900ae", "comment": "Malware payload (Mirai)", "value": "8b08f1c347508cc73abf8ba926212d8acb1856301d908d853fdc8ad2170ee8070004e521b51072e6a0623f5dc75fe6af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349008, "uuid": "4e0b62b6-1a56-4a09-b7a4-524aec96f09c", "value": "T1309349C0F587C0F5E85309744067F33F8B32E535802AEA2ADF5DAE36CA67981971A359", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349008, "uuid": "ce4cbf0c-e6a7-49a1-9d3c-71d4ea02ba29", "value": "1536:oSRLpNskfFfawVIbkhI6DcgDyq2CeoxBAbp4T/aOHZWfKHriRL8yIWX:Bawabku6DcPqFeoxBA14baOMSHriRlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783349008, "uuid": "6346aed6-81ad-422a-825d-bc02522b2e25", "value": 97388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783349008, "uuid": "6c263d13-0bd3-4edf-9bd5-27c16890d293", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349008, "uuid": "fa982284-ad17-4d6e-8499-ab52310262e1", "value": "atomic.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2994da3-7948-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783348910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348910, "uuid": "a3dad388-56db-46c6-86d7-868ab83967eb", "comment": "Malware payload (Mirai)", "value": "f831a04c251b0f04b21da6e88d54fbc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348910, "uuid": "15550d68-f45d-43da-9548-f3aef924ba0c", "comment": "Malware payload (Mirai)", "value": "ab3dfb70e13bdc866264d4baf0902c9dcfbf318064793baf5eb9dfbd56f401c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348910, "uuid": "ce34de89-10eb-4715-b2ed-25d1b02827cf", "comment": "Malware payload (Mirai)", "value": "2ac774c728cd4fefd57b04a9de0013ff15153e69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348910, "uuid": "506bcc2f-25c0-4fe4-a5ba-d2af10669680", "comment": "Malware payload (Mirai)", "value": "6c467e4e4260f12b50d0bbcbdb79e4807937a088fb526fc006a2c128d97a9787a82df33059999ecdbbef496fccee234f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348910, "uuid": "0c2f1560-7277-4040-ace8-2bc11f660d0f", "value": "T16F6302DCE757D640D0502F36E571D085F26EFAB0CA7A279321769E3838B5AD67F24082", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348910, "uuid": "8495513b-0133-4c08-8c3e-89df837c844a", "value": "1536:UBywxDWvPpL1INpqkrnYQ2D8p7/zKVohLI3YdUzj+s6i:GxCvPpLskkzr2opvKahLtUzj+sR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348910, "uuid": "dafb97d6-57c1-454d-87ac-87f2c3290b56", "value": 70260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348910, "uuid": "c64b937d-9e43-40ee-806e-245f778674e9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348910, "uuid": "3740ea05-a039-47d7-b7fa-cc37dfbe4ed6", "value": "atomic.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29fecc0d-7955-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783354210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783354210, "uuid": "58018681-ae45-4a62-ba90-a5e338bce447", "comment": "Malware payload", "value": "f99be7974538164679301cc28289de43", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783354210, "uuid": "0e178695-4b41-4216-9ab1-f3d96b2c225e", "comment": "Malware payload", "value": "ac39d18b75cecb1c62e4b70e3343bc8b8fc2b69b10e6c7d4ab3340031073804c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783354210, "uuid": "3b39b3c9-4341-4994-ab47-402636ae4715", "comment": "Malware payload", "value": "fe04aab98bca17923439afd3423c61917bed8fdd", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783354210, "uuid": "4f823727-9e1b-4195-94e1-36e9d708c490", "comment": "Malware payload", "value": "aac8ce929f4b16be6e6c4ab860868e511708f53c76e43c499cf44b3b0b8f8c3ef26d98ece1b60c63939b2b6f394b3077", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783354210, "uuid": "368d1d03-b237-45eb-be54-b0922e4a32b3", "value": "T118624C0BA4818036EBE14474827F526645FEACB623D4F9DBF7E068894EB46E1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783354210, "uuid": "93c70786-0fe2-4ce2-b088-d71ea7b0b8af", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783354210, "uuid": "96847d50-f6dc-420f-9368-702066646e8f", "value": "192:AW5sGnjXgjk8LcRAWIdJDMlIfeF5oIV1BKUSf/zwcd1gJxTmv8U9cthg9ik:AAScqdferoF/Jyav8U9cmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783354210, "uuid": "e4881834-2fdc-4370-a267-09d5520accbd", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783354210, "uuid": "b23bd8e6-95a5-401c-a638-45c63f407a40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783354210, "uuid": "723d2270-0aaf-451e-aa01-27f93caf2723", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae217e8e-7959-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783356150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356150, "uuid": "1ddfca4f-9d8b-4bb3-8e2c-47388489e936", "comment": "Malware payload", "value": "2fe5e626e48660cf627b7e1f9ea64fa1", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356150, "uuid": "f6f57a6c-3cda-47fd-a192-87efb9bab05c", "comment": "Malware payload", "value": "ac4c78ac34e311f80c74d9ff375634095a753aee52911a5443a56281d38917db", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356150, "uuid": "c44e6883-53ff-4358-8dc5-0be48559ca47", "comment": "Malware payload", "value": "e98c19b01a0f992398dbd76f9683dad19a8c54b5", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356150, "uuid": "7c04e09f-041e-464f-b6e5-e523ab399f59", "comment": "Malware payload", "value": "39bb564ecfe27a685f0ee726280ffc2c22fc63c7390c593a08c648b1471133f13d9369e56404333686ca737bf51c7e5a", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356150, "uuid": "fc0c14ac-dce0-414e-b631-55d46d482043", "value": "T17208335E1829C0C6C57F5BBAB51234B6D204DC272DB4E51A2F0E4ADCB4E6E6210BD93F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356150, "uuid": "b507dfe2-76c9-46c1-b901-3ae1a6a82987", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356150, "uuid": "1405c976-d048-4a53-a37a-9329510c9179", "value": "1572864:pt9IKPOb2C1BcRWYKJImKljUoEkB9dNDsMLXgiMZrIuEt1nEZSZ7:pUKpGcRWjImKljUvOhLXMxIuwnRZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783356150, "uuid": "5cc85654-9dee-4822-832a-d48597cbd1de", "value": 77704838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783356150, "uuid": "4b12870e-a812-41c4-b585-43bc62aa5d1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356150, "uuid": "cf142b7b-6155-4b19-ab77-41b93aebc6dd", "value": "free-claude-app.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4ded055-7948-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783348914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348914, "uuid": "3e0934ac-4644-4f40-b8df-62c9e7bbc694", "comment": "Malware payload (Mirai)", "value": "8020796c50c2fc02ef828678e9526861", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348914, "uuid": "f1c20b5a-d8b3-4dcd-8a48-5ada587168bc", "comment": "Malware payload (Mirai)", "value": "ac4ff4dea85d5ff45cc2a33789a86ee33c281919eb90dddcf8ee5eb6f64d594b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348914, "uuid": "00288dca-0fb2-46c8-95f6-6fc608a1f75c", "comment": "Malware payload (Mirai)", "value": "44f237c8c7079f4a3a83ea7221b6a2deec34ecc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348914, "uuid": "b394c8c3-905b-4129-abdd-c46ab8931063", "comment": "Malware payload (Mirai)", "value": "885a2ad12d1252c610dd9465276ad0d907ff74ad9134665e4fd50a7ef17c9d7e29a86d47670a86834f463d2077a5261a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348914, "uuid": "8eab5288-174d-4dd0-94c5-812a6da602a5", "value": "T196D39DA7B70F1051C82506F81BCB57AD2A7325018F6B96E77CAE723E1E370DA58063E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348914, "uuid": "e9f2d67f-061f-44e2-bdff-07006c84dbe5", "value": "3072:1Gx5Ln9krzccMnO0t0afP3jqEKdZgNC9c5eFfbtq:1GxREzclO0Ks3mEiWC9c5eJtq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348914, "uuid": "fa4f423d-71c4-4740-a5d3-51249896d4ee", "value": 140972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348914, "uuid": "494c9380-2f64-4313-bf9e-74a7eaf85874", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348914, "uuid": "7141e2b7-07dc-43d1-a7f1-f6768a6a1e1e", "value": "atomic.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1584bc6b-791d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783330124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330124, "uuid": "630f21c5-997a-4f9e-b404-ffa6ad422d3b", "comment": "Malware payload (Mirai)", "value": "170369e694faa13b4615ce5a3f4e5356", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330124, "uuid": "b15a95a2-c0d2-43cf-837c-45fa55e0a5be", "comment": "Malware payload (Mirai)", "value": "ae15761aa60ce2017c872c2a71f8d2e020deedc21a2600b05315d6d078a684dc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330124, "uuid": "6c58680e-9e7b-42fa-beef-72a39feeaa1d", "comment": "Malware payload (Mirai)", "value": "d40541683d0c3ec3125c60294b8ec73648c87bec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330124, "uuid": "700b8163-0f71-46f3-bfe2-65d55f942479", "comment": "Malware payload (Mirai)", "value": "5ea14795d769fe7a43c689ec7df31038892b1d63c0d87794d71d5b5defa8460ef09f8ab18d433d048251c2738026d729", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330124, "uuid": "170d7971-7120-477f-8724-c81539ccbd86", "value": "T1EA937CC0F683C4F2E84705B1507BE7379B32F1B9101AFA43D3A99A72DC91551EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330124, "uuid": "19fe6205-a159-4dd1-8c88-6a03951f41d1", "value": "1536:W/QCZaxGdvts3i5JPhotAxPu++AjloUIKqI4FrS4LSx:WYCZa8dvm3oJPhIAxP5JlKKfUmDx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783330124, "uuid": "06aae47f-4a19-4f39-86fe-7182a861213c", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783330124, "uuid": "5b957c83-194a-4c27-bd15-5b8958722263", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330124, "uuid": "ef2849e2-a8cb-461e-b2b7-57e6e8cdf043", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35c9409-7948-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783348911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348911, "uuid": "6a35e136-05a2-4c4e-8ae8-f07baa7b28cf", "comment": "Malware payload (Mirai)", "value": "ac45144c2cb2455765ad83a987b90c6f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348911, "uuid": "0bc6f282-e603-48aa-a798-9d6d1971b4e4", "comment": "Malware payload (Mirai)", "value": "aed66867622a9602cb8450e0d577bf8b6411ab83109e83291ac30057b110fd1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348911, "uuid": "dc2384bb-6463-4623-9f28-c26d8f552c94", "comment": "Malware payload (Mirai)", "value": "47c7daf24b11968a7bbe6d65dce6fffe5bfb9eba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348911, "uuid": "d1fcacd0-76a9-4fd7-b886-9c7e9778b395", "comment": "Malware payload (Mirai)", "value": "0be7254c5fdd66d8aa69fc7c8988949baa27100c968d3175cd98fce4516adca5672a97bb2673a6ffa90bc4f892a929fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348911, "uuid": "d117be5a-8123-4f1e-94c8-28dd481e09fc", "value": "T15333023C0B4B4AB4D7B02436893766961706AF74E1FF63663324077D928A633657CAE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348911, "uuid": "5fc49dc3-9c37-418d-9a86-4265464cbee2", "value": "1536:wxvQ53Wq3C0/hkp2ymhAi2xIxOC8tB2dHIewVEzj:GvQ5by0E2y832q872dNiEH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348911, "uuid": "9c02680d-0aca-4e17-a08e-11158ca42856", "value": 51120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348911, "uuid": "0556ab4b-456f-4327-acf5-f4d0b3b88dd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348911, "uuid": "42cbb8f3-a73e-49c5-ab18-79f145ca572a", "value": "atomic.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65524eb4-7934-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783340137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783340137, "uuid": "e3ae7931-1cc4-4311-abab-78b21e5f48c2", "comment": "Malware payload (WannaCry)", "value": "6789fbc0c9a2661904231147e500bce0", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783340137, "uuid": "27a17b1d-4268-4597-a13a-8bac8983c048", "comment": "Malware payload (WannaCry)", "value": "afe399f61054f5855796a884b38b4d0977c03a216920980e44d776173ddfea80", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783340137, "uuid": "59dd4e50-70b8-4ac0-b9ec-b8e4b576ad6e", "comment": "Malware payload (WannaCry)", "value": "39c5062263296d8a39f3220574b0dcf3d959046c", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783340137, "uuid": "8f7d2eda-655f-4499-b204-bdb409c2ad78", "comment": "Malware payload (WannaCry)", "value": "ef7838b2029680fa56fee61b8161fc317ea2b49b80ddb9df870e2fbea9fe2e737c6bbc8650fae3ba1d57da7da6392fc3", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783340137, "uuid": "4cf3a79f-44bc-42ff-8701-d30406470445", "value": "T1E7364B0192E96A60E2F31AB726B99B10473A7F45955BD65E2225300E0C73F1CDDE2F3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783340137, "uuid": "002757f4-7410-4332-8d65-d245e7c21bb1", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783340137, "uuid": "cb2fd560-e539-42b3-979e-f6f8c3504f4e", "value": "49152:jnXn+iQo6SAARdhnvxJM0H9PAMEcaEau3R8yAH1plAg0:DX+i36SAEdhvxWa9P593R8yAVp2g0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783340137, "uuid": "db13a4ea-4ac3-4973-8f7a-922533ecd6f0", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783340137, "uuid": "eea8b589-8f48-4df0-b2dd-5cab970172e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783340137, "uuid": "485575cb-6da1-41c4-ab18-e30c872bbbb4", "value": "afe399f61054f5855796a884b38b4d0977c03a216920980e44d776173ddfea80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d017c8ff-790f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783324424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324424, "uuid": "3ff191ff-fa41-4950-aaad-f5a148b38f7f", "comment": "Malware payload (Vidar)", "value": "01c384de4a1cf8071a4938b0785862c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324424, "uuid": "01f16569-1ae3-4ced-a516-c578299cb99d", "comment": "Malware payload (Vidar)", "value": "b085871c02152af2c3446f728cb4c255e668adcd83dad61f4460580afeb36a90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324424, "uuid": "e61000c4-e223-46b7-a78c-4ee624755a83", "comment": "Malware payload (Vidar)", "value": "f9cd5e8d3524ec15de0436e5376d9921e2d51e9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324424, "uuid": "d289dfcc-72eb-4a62-8db9-549726ca5252", "comment": "Malware payload (Vidar)", "value": "da8d63a6dc558b99c83c0dfd6b6497b037605c9486c719197678581971ee7e5e4bcf3e83d621e36a20cdb84cb9a28a87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324424, "uuid": "b9e36ca3-4fd9-47df-acae-b0d6db8f457c", "value": "T1BAE57D07BCA089E9D499533289AA56867B75BC150B3233C76EA273383F36BD07D39714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324424, "uuid": "37f27f96-f69d-4397-a522-ff5001f56e2a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324424, "uuid": "c852ddcd-77ab-4c87-b3bd-844726295f86", "value": "49152:dcv2k6aQX44Y1VPN7Yb85IJb0Zh3jK4s6l2FAv4nl6o:dceCPPDDe4JQr3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783324424, "uuid": "af56ae93-70a4-4c14-80ed-cf0aa2387e3c", "value": 3279728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783324424, "uuid": "0c7b0856-e48b-45b9-97f8-37a731b5fa49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324424, "uuid": "6c56ad49-051a-41f6-9d7a-1a5b44580403", "value": "01c384de4a1cf8071a4938b0785862c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79fd921-7929-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783335658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335658, "uuid": "11d60042-98e3-45b0-ae4a-e022cd976d13", "comment": "Malware payload (Mirai)", "value": "9a160ba45cdc54eef49faf71048b63df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335658, "uuid": "3ec46cc5-cff1-42e7-a3aa-416803413fb5", "comment": "Malware payload (Mirai)", "value": "b1a6dba6636b519d76d7219f6264ac9f1456681c0855baef954fb435d3e25ce5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335658, "uuid": "532f894e-5725-41c3-adfd-4c1ca8fae136", "comment": "Malware payload (Mirai)", "value": "0510df6a6362d5e82a641433bc049cdae29c40a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335658, "uuid": "f4a5d569-46a5-42b0-9e4e-dd21918b7360", "comment": "Malware payload (Mirai)", "value": "df5bd5291e3b18793efd55b8650732231f12aa1e6c674010a62e4d9b3a2ff2933f452ddd2a1387a0c6a2bd653a1257c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335658, "uuid": "068d92b3-e5de-411a-ad7c-bfa63d3a63d0", "value": "T19AF35A12B5D094FEC8E5C2B84BEFE136DA32F4595134721F23C8AE262E5DF212B6D650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335658, "uuid": "afdb503a-1dd1-4b2c-bccb-c8b3c1d81394", "value": "3072:wQU4P4VklB1Imd10qb8ODAhH4y1jFgOS1tZE:w54nwOB2xdAZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783335658, "uuid": "94809950-0610-455b-97eb-773cde402e2b", "value": 164272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783335658, "uuid": "9ec767c3-bee9-4805-96d2-1577695b3bc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335658, "uuid": "841e0950-9b39-4bf4-8a09-da686370450b", "value": "iran.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcb74128-7929-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783335666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335666, "uuid": "590f7439-e209-4448-85c8-74d5946ea029", "comment": "Malware payload (Mirai)", "value": "9fe09b70d70e8d0b328f1d9defc2e642", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335666, "uuid": "15d877df-feaf-4437-bfbd-272ffde61dbe", "comment": "Malware payload (Mirai)", "value": "b1f2808e05cb42894790c12172ffacf8673a0a7e14c7af5ad43d5bedfa62a5e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335666, "uuid": "e9ffe5cf-0a3e-4c6f-93ff-78d8a9719211", "comment": "Malware payload (Mirai)", "value": "0a06e1cb65c5048db90368eb6a068fa2a4f1edfb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335666, "uuid": "425024ac-e00b-440f-a4a2-ca9fe3f27145", "comment": "Malware payload (Mirai)", "value": "b18c0e3581b5e3477e84fc553016830194c2ab2994e2eb5fe9a1d51ebb07ef53e09d1854dc997e2fe8500bfb58c6da6d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335666, "uuid": "fb72e193-ee5f-48ed-afcf-362ca01bfea9", "value": "T119E30749ED42AB00D5D636FAFE4E428973535B6CE3FE71129E245B2127CA92B0F7B101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335666, "uuid": "691ecfa7-cb8d-410e-a1eb-6642be3dc7d5", "value": "3072:6nZpD+/4jw0P4GmyvC/frevbzQpgMCa5bo0nIQc0r9vI2mmCULXJWcGd0:6nZpD+/4jw0PpfvCazzQvCalfnIQc0rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783335666, "uuid": "da3ca1a1-a13e-4ce4-ac49-f424b29af235", "value": 146264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783335666, "uuid": "055865a8-2b6d-4113-9b9f-f917a74c23aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335666, "uuid": "d4b7e91b-099f-4b0f-872f-caf8caeaf56e", "value": "iran.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5330d726-798d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783378331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783378331, "uuid": "9d80011f-8521-4db1-aae1-02ca8561f6aa", "comment": "Malware payload", "value": "1f087b8b69ef7340a7df9330190a360c", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783378331, "uuid": "cee4ecbb-bf20-408b-a0d1-373fe3521443", "comment": "Malware payload", "value": "b2609edca5ece9fa595ae63c619ea84f966280e1c831fbee0e8be4fca20d801a", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783378331, "uuid": "eba386b6-16c0-44b4-81c9-2e205bd974f1", "comment": "Malware payload", "value": "9db6835f11acc54381d8b7258efb748f4bfa3d00", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783378331, "uuid": "240bcf6f-c33e-4776-83e5-41ad171e65f9", "comment": "Malware payload", "value": "8f7dc892e5322584bd1f1755c41aee405f80e022110a140c9365bef04eab5f384c1c6004c438e04aeaae0941e08bf2c9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783378331, "uuid": "61c6ce41-b1fc-46ad-a06a-eeb0b4a389c4", "value": "T188E6330C6AD415FEFE63903C9EE299E4E47874B40BB2CA8B075887E4EC531D4993971B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783378331, "uuid": "1128caa5-f6f4-498a-8788-cf02232ecfbe", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783378331, "uuid": "f6b68a01-3952-4847-801e-d919cd72d65b", "value": "393216:imsW1iwhmr5jvXMCHWUjXucuI3/PGTAI:ic1iwhmrVXMb8XDH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783378331, "uuid": "734be1ed-d946-4e30-add7-c2e42e4d426f", "value": 14287020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783378331, "uuid": "5913b4e5-a1f2-4f5b-9b1f-471efec48819", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783378331, "uuid": "6e77b1d9-e420-4e95-9de5-5f725e6ac437", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e762b612-791f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (BlackNET)", "timestamp": 1783331335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331335, "uuid": "2247f083-227a-450b-9784-c4008781d8d5", "comment": "Malware payload (BlackNET)", "value": "f612967f1314ebf94d636fb9dc20e84e", "object_relation": "md5", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331335, "uuid": "b16353d0-74ee-48e9-8d5a-4116cd9e98e2", "comment": "Malware payload (BlackNET)", "value": "b3ad1389f9962206c973c4acefbb32f3c26cbdb884c6f01445deeeb6f9f9f8e9", "object_relation": "sha256", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331335, "uuid": "42dcbc93-9bf5-4ab1-bcc4-67a6d8c94518", "comment": "Malware payload (BlackNET)", "value": "45e25f810c84427f1c778d42a6cd1f6d796917ae", "object_relation": "sha1", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331335, "uuid": "5bb97975-5400-44aa-8848-96f828c5de8b", "comment": "Malware payload (BlackNET)", "value": "b373e4c1a3ddcab9365759dd12c2709c3508f0d34e29205c4562f43dcbc7cd9bc4e25ee1f27cc38a636654278037d604", "object_relation": "sha3-384", "Tag": [ { "name": "BlackNet", "colour": "#964CF3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331335, "uuid": "0372fa9d-9396-4813-be5e-6e2c68d557bc", "value": "T138D52345776492F6D0BCC6BDCDE65F2142B678010F3AD7EE4CE2609918B6B819831BE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331335, "uuid": "21ae96da-d1e2-4fe0-975c-508782cf55bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331335, "uuid": "3f130cce-2eab-4fc1-b458-1e327ac5aeee", "value": "49152:sc3Jk48pEiaNfclhG/6anu5zQreEOxTIeSqwGcM0XTfRe0RqIqeIYjH5Nlsw8:v3mHpELNf3/6an6QrJOxTIkwGc5rR3Rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783331335, "uuid": "9c2dd5d2-6112-4315-a95a-a41320b9601b", "value": 2771456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783331335, "uuid": "5fb8a018-df08-4f46-a04e-5becfbce285c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331335, "uuid": "3ce0abec-d8f3-40b5-b990-9d7d6ce9aa9b", "value": "matcha-installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94986f2-796c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783364410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364410, "uuid": "761ad479-621c-4b74-821e-3f06a7841e5f", "comment": "Malware payload", "value": "e3395921c195b14deca0908aa0131d59", "object_relation": "md5", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364410, "uuid": "497416d2-ad35-45c6-8594-6625b1e35dce", "comment": "Malware payload", "value": "b3fb3762edd5c26da3b55dcf98c7acc6e1c4ec7445c26a468c1659c33af4dc10", "object_relation": "sha256", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364410, "uuid": "8891762b-7af8-473b-a97e-ec53f40ad380", "comment": "Malware payload", "value": "9eba182c5c739b212090920391b688015b32c3d7", "object_relation": "sha1", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364410, "uuid": "09d2e506-4d5b-4660-90d8-edab500dbaf9", "comment": "Malware payload", "value": "6e3ef947a403c320147f835ed95d3738df90fbccebd3522e0441283ae7e43d7ba7f35eb4804ffd7a7f5f71fa2636fdae", "object_relation": "sha3-384", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364410, "uuid": "fc8e8045-9740-4bd7-aab5-b262c667d628", "value": "T1A32633CFC8FAF2EED8B75020C6DC0992436740B69BD31E2B45524FD2E1E0B90A577999", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364410, "uuid": "ea999f8e-f717-4d50-a76f-28cbe0efa984", "value": "98304:SXrg18sb7bEU8oDoSJuoKAFXr8YO7A24FhLV/jvVLOrn40K0aBfrzd:S72lb7bEtpa78YO7A2oVvROrkpzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364410, "uuid": "03dca14c-6ad9-4738-97ca-5f1f533827d6", "value": 4698339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364410, "uuid": "a8d10706-6e55-45ab-8c23-7371c925c103", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364410, "uuid": "6eaf482e-770b-4652-9e58-5aa2aa1814ab", "value": "kenwillzltd.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae89eed1-790f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1783324368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324368, "uuid": "73350068-a452-4bcf-b839-7cb405eb5db3", "comment": "Malware payload (Prometei)", "value": "95bc970c351d960286d701661aabab8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324368, "uuid": "6709c45a-7f28-4662-9e1e-f2751e698ed8", "comment": "Malware payload (Prometei)", "value": "b453b81bf096565b0ccde97dffb90818b4fd7989bf2a4c5bb43888cc38a2ad75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324368, "uuid": "93086223-064e-4c44-bc49-b78c0c353cce", "comment": "Malware payload (Prometei)", "value": "8179fd2d8f7c30a571ab6720d6b184035aa46715", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324368, "uuid": "108c6193-8111-434b-ba79-ef515f951240", "comment": "Malware payload (Prometei)", "value": "372243e595747fc10e2dcfd82fcf88a821a6e4b0b6e5bdfcf7dacb5c7110cd294d336e72df57aeca8fa7a867a3d0afe9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324368, "uuid": "e09d974e-357b-47f0-9a63-62074d97bcc1", "value": "T1F6A423B4F9219E9F6DD76DB91B24831DE182C172589D4C2313AE94E34F3D632AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324368, "uuid": "c57c9465-ecba-49bb-8319-2d69f4027edf", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdc:Fs6pyCC/Ya2hpi6T6N4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783324368, "uuid": "f3fd38a8-81d4-4df7-be02-946e4c9fa51e", "value": 449078, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783324368, "uuid": "833b5337-ea5c-4e33-9099-d2c7f8533f45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324368, "uuid": "fe85f230-2d13-467c-82c5-faa0013285be", "value": "b453b81bf096565b0ccde97dffb90818b4fd7989bf2a4c5bb43888cc38a2ad75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6b62e1b-7929-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783335656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335656, "uuid": "6ea9f1f3-385c-4d5f-8946-c6d067d8dd8e", "comment": "Malware payload (Mirai)", "value": "9cad6798c8812d8f48aad5187a0e13ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335656, "uuid": "98ce16a2-dcee-4afd-9438-6cb1722207cf", "comment": "Malware payload (Mirai)", "value": "b4acd1ab65624b694946b1181bba0732bb63c88c51b8334914c26c1805b2e1aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335656, "uuid": "917fbc93-d8cd-406a-bace-bf03f7d1527a", "comment": "Malware payload (Mirai)", "value": "eb246c036c901b81b89793a2f9cd7b1366938744", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335656, "uuid": "1145fa27-6f1c-4750-a69b-4d3f45fe8e3b", "comment": "Malware payload (Mirai)", "value": "b01c560f5d5978214cab7106ceb5cfa85a9eb3c69cbcb7929aa4d1e29f3a50ce75165dbfb305df5310c4400c72a09e76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335656, "uuid": "f3d2447c-503d-4059-b6fa-b6225750d74b", "value": "T104D35BB3D825AF58C564E6B1B0318F781B939A6082471FBE19B7C6748087DCDF6163B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335656, "uuid": "4e28cc1f-b50f-4e25-82cc-87ba113b102a", "value": "3072:5WbCJEcdQ29RHrmP71xmbdspxYNWtrcVhQTUm:5WREQuRHrmjebmo4trkQIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783335656, "uuid": "9942c040-7598-4ddd-8749-8f8b4d689436", "value": 142140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783335656, "uuid": "552abcc9-d824-40a6-a18f-dfb8df35e5db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335656, "uuid": "a718e87e-107f-46db-832b-bd5f02d121f7", "value": "iran.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d92559be-7948-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783348921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348921, "uuid": "c338d14d-5ad8-4167-bf92-64d0c3f40ee1", "comment": "Malware payload (Mirai)", "value": "a5febdfc4243eaf282743c1ca6d2dbe0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348921, "uuid": "84ecc999-514c-4825-9cdd-3b44f3c43ede", "comment": "Malware payload (Mirai)", "value": "b686ee7f93768a14799dc52ef58b87583decd0b10a4efa73c4cb2a971b942da3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348921, "uuid": "565623f5-701a-4f3c-bb9a-ccf002f49552", "comment": "Malware payload (Mirai)", "value": "d324186eff78e570902d0dba5e7f2d2559450c2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348921, "uuid": "432d171f-5351-4784-9552-f570c95af808", "comment": "Malware payload (Mirai)", "value": "dcefab023e7d01c0e0891d380775ac4f353988d1ea292ea87d9579686ebc469079496d837f4d31fb6697bc96215bf59d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348921, "uuid": "5909cca7-2af0-4f70-a0c9-d31e80feae6d", "value": "T15233F1B7536AA6B6C5375CF1403DB5D8FBB2B6730340D723A926A57DA812B2B72043C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348921, "uuid": "7786009e-f19e-4141-b62d-80c10909bf9d", "value": "768:V+jEKiKCWKaI9WZWiqZauXx8NQSI8jBoha0fWNZr4p0Fipigjs7LD62Qx0kg:EjTiKjuSsa+aJ6g0uv7FEieymlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348921, "uuid": "2a16a875-8da6-4991-b338-523b4390ca4c", "value": 53584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348921, "uuid": "7668b354-2b11-4ed7-b2f0-d31cb9c9d26d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348921, "uuid": "1e34ceec-2fd4-47bb-994b-8c0a5a4b1351", "value": "atomic.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "350e13b5-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783364966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364966, "uuid": "2fd4d723-2269-4887-a068-ac09975ef434", "comment": "Malware payload (Mirai)", "value": "5b7d420745c79601e81085ae61fbc80b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364966, "uuid": "7a28d7f7-75e5-4cbf-bc76-6199d70fd205", "comment": "Malware payload (Mirai)", "value": "b6c75912dc0fb738b35e2c0706fb7b9c964e7644c6bcb0662165c89a7d81cff5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364966, "uuid": "150f95dc-7c5f-4465-b97e-acf037d438a3", "comment": "Malware payload (Mirai)", "value": "d3ae454670150caca119bc4ae58df97becc55ed3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364966, "uuid": "dae8baf4-fc99-459e-a1dc-1eba20ad40f1", "comment": "Malware payload (Mirai)", "value": "ce292c270da70497fd09247e4feb3ab1e8cbd0bce834ff749f5deb2ae2deee37fd93ad3fb8b54fdadfdc42a2a018241e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364966, "uuid": "54fd9c72-d0a0-4211-aed8-dfd9fd3982db", "value": "T1D0A2D16563299862E7F0DD3E9D10C647B5BA1FB8E6EA36333E18123883D110DB17C6C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364966, "uuid": "6a23a96f-adfc-4f23-8678-5cb595862b10", "value": "384:um+DsHSkBedsaJ1y9ftwhWY4Au3lV/GwRwvIsUFPphQQhymdGUop5hu:umlSMjaJo2WUuuwOITIQs3Uoz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364966, "uuid": "07ebbe01-b3a3-426c-8ada-322fd0fc733a", "value": 21384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364966, "uuid": "5d581690-5771-46b9-b00a-59da0b9b2258", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364966, "uuid": "4ee7c9c1-d778-49cc-89de-6f78e722c259", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "562021bf-78f1-11f1-ac1e-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1783311335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783311335, "uuid": "f684bd7c-9f86-4dd3-8f59-c1c612e10158", "comment": "Malware payload (WannaCry)", "value": "234ff3f8195600dd7c0fb68f0bc32314", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783311335, "uuid": "b89a995c-dbf1-4341-8190-cc8d8f73116d", "comment": "Malware payload (WannaCry)", "value": "b71da069dbe51522e224cca30a57f157051f792561e29fd457ee55ff836f3bba", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783311335, "uuid": "7426390e-18f6-40f3-bf48-f9259ce43326", "comment": "Malware payload (WannaCry)", "value": "d74560eeddf7ca5bd893f3e67bfc56fb41f89758", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783311335, "uuid": "66bf8305-7957-4862-af4e-83aebaafaf6e", "comment": "Malware payload (WannaCry)", "value": "5c13d8ff887dbe15cbbace02ed8bba4b2391de9c1142ef6f4a0ec77d64cb4825678a79b9ec235a2d51b334195eaeff7f", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783311335, "uuid": "7da9f6fd-b788-4fb4-a849-ab0d725d2d54", "value": "T1263633586268A1BCF0110EB084A38E56EBF77C5777BA4A1FCF8045660F43B5B9BD0B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783311335, "uuid": "073ed2ab-e5cf-4bca-8371-d4721241c697", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783311335, "uuid": "20fb23a2-b709-40b1-a514-8f434f4b9cb2", "value": "98304:DYDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2x3:DYDqPe1Cxcxk3ZAEUadzR8yc4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783311335, "uuid": "7d2a5da3-e245-444b-87cf-19f25e82a85c", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783311335, "uuid": "8235815f-0898-408a-adcc-d6f18f0f0cb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783311335, "uuid": "b3c5c319-36a3-40a7-85d8-34b9bd93a60f", "value": "b71da069dbe51522e224cca30a57f157051f792561e29fd457ee55ff836f3bba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0fa24b-795d-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783357836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357836, "uuid": "1b3bc5d9-bc16-4ebb-8c94-95a008f3c318", "comment": "Malware payload", "value": "16b4ca7d518450fe635586581d9c3c3f", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357836, "uuid": "cc014a96-3c5a-4d97-a99a-038b5ea46e29", "comment": "Malware payload", "value": "b74168c64c6b0d54e89c0c2b704788f592e76658a5995f6cf421190cd6f22cae", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357836, "uuid": "e0d6c544-dccf-4692-8b10-160befb628c9", "comment": "Malware payload", "value": "beb45925520783e2df4c34dae2ea9c0d08dad9b1", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783357836, "uuid": "6130c967-5286-4146-a3f3-722bf049cf31", "comment": "Malware payload", "value": "b3be96b18661ad198613526e4c0dc7214634b7ef745cce63d9fad823d429529210674ddec9ae8f875541a0a14acf4c79", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357836, "uuid": "b96ae8df-4b53-463d-a11b-de016af65d7b", "value": "T1CC08331B4532EE2EC936AC325B107F5ACA4643BB6074A95F3382804CF58D5C61A7CAF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357836, "uuid": "d90b61f4-1f33-411f-a31e-f35686dbb220", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357836, "uuid": "dd86e89e-bbc2-41ed-b82e-8eb2a16e3eba", "value": "1572864:zt9IKPeXkiRWYSTM9sbVlMUc0bajJ5GcsGaP0SnQp7:zUKmXkiRWjw9srM1UEDGc/aPsp7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783357836, "uuid": "274c841d-c63f-4590-86e8-19980953c539", "value": 77711645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783357836, "uuid": "161c3bc8-df6c-4b21-8031-e895ddbb7ead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783357836, "uuid": "ecebdf12-2fe9-4b00-9021-c00fc7943e90", "value": "Lossless_Scaling.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720171d2-7919-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783328561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328561, "uuid": "0bef134c-4eea-454a-8bed-33a5ff8b2669", "comment": "Malware payload (Formbook)", "value": "e83a712c54d817c52c88444f49917116", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328561, "uuid": "0cc149a0-f11c-4a91-8329-d0708a4247b2", "comment": "Malware payload (Formbook)", "value": "b7a3fc527793301bd39eae5c5ae037730cc2132ccb8a59bf45d02f246bbaea19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328561, "uuid": "8e9a05b1-aa74-435c-80fb-609843d4d6d3", "comment": "Malware payload (Formbook)", "value": "39a677efad24acc47fb15ab64426920250c2bb61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328561, "uuid": "f9b38438-1f27-43cf-8eb9-5eceaa1c1b39", "comment": "Malware payload (Formbook)", "value": "f23f3729ed5c313b552b692318b9eec87e82336673663b2f3c580df7713c9db52c78e5fecf50dd1d8e12e6e84276a538", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328561, "uuid": "cb354636-66a5-47a8-825f-5fc8c5f1bbb7", "value": "T13135F1290D873A99DABE1FB8C176189833F4D8439396E7272FED01F5DA62B84CD13452", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328561, "uuid": "bb598524-5dd4-4a85-bbdc-46bd28bee176", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328561, "uuid": "9a9f811d-9e7d-4be6-a14b-a9b24026bcfb", "value": "24576:q5qqigNf0NSIXtbJXsFxWVVALNUSPkQOrh:q5qP200IpJXixWPALm7QOrh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783328561, "uuid": "1989abec-5bb0-4fbd-9788-ac3febe292e2", "value": 1135104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783328561, "uuid": "da9ee0dc-7bb0-4e7c-a716-c0e96868d3c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328561, "uuid": "1801744a-5dee-454c-ae1b-b09ffb3079d0", "value": "QUOTE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7047d3-78e0-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SalatStealer)", "timestamp": 1783304314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783304314, "uuid": "9faa5bb0-70b7-4cba-b85e-3986021423b3", "comment": "Malware payload (SalatStealer)", "value": "93e7e3617fec42ebd2a1efc00180d6c7", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783304314, "uuid": "a1b9000f-c45f-4bdd-bdfc-8888a4e4450a", "comment": "Malware payload (SalatStealer)", "value": "b7c7bad857795718070d5e63a6f3c0f39c1b06b4ff293f6d47d18ad2bf76af6e", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783304314, "uuid": "0be00273-abef-4d66-8eba-25c5cb41c706", "comment": "Malware payload (SalatStealer)", "value": "18b993c7e5a3e473a1d9db5a627267407ae2cc88", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783304314, "uuid": "e233aa6f-71e4-4ea5-a744-2eaa15983af9", "comment": "Malware payload (SalatStealer)", "value": "0005afa7ad08b93c4cc943b8e9b5d3f2a75fb40bbb4ab664f2d81d3eea3cd82cda904b40c47541c99631aab502b96ce0", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783304314, "uuid": "8c970ba8-6f60-4c76-9714-76437364cf2a", "value": "T12AF533A6184A6CC3D039DE3A1C6617CDA963AF2673D574B192DD305FF2ADE0031294BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783304314, "uuid": "75d80152-f45a-42e6-a409-25e7dbb294d3", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783304314, "uuid": "143b5110-4090-4de7-ba79-94eeac506c64", "value": "98304:Kj6mbpZJlnFGoiGbilxQlxTXWBIXbn7L9oUSkMx:gZbNitM4IXbNox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783304314, "uuid": "45f991cc-6cbe-4444-a8e0-ff6f15ebfccc", "value": 3594240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783304314, "uuid": "e25a5cc8-d637-43c6-bc95-be1fdabc9720", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783304314, "uuid": "96c64050-9d76-43d6-942b-1aa08e947bf2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41cc2451-7943-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783346519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783346519, "uuid": "d9572fe3-9f1d-4048-96c2-16af5f4c0fa6", "comment": "Malware payload", "value": "c802de939f4eda0ab3f3f6b98d020282", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783346519, "uuid": "2a9f3f9b-110f-4b07-b821-cb63b9b22bb4", "comment": "Malware payload", "value": "b84760153ae52dc472772bec07bdd435c2d27bea6beb3e63918f7df475f5fed6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783346519, "uuid": "4a2d72b5-84f5-44c7-b3d6-026942be1b0a", "comment": "Malware payload", "value": "0958bdbb542bf782c6b7a3e7b732ded95fa869b6", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783346519, "uuid": "ad3ab7cf-8216-4db0-bfad-b89e17ac5ddd", "comment": "Malware payload", "value": "ef1498217c13227386e89c276704af6acb90c0ad884dc0b3a68b234bc79107ff0f46a732608f727f54d377b512ea5868", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783346519, "uuid": "ab06435f-c743-45e9-9358-ce727111898d", "value": "T1D3137D6956857C24AE9D883B1C7E2F0CB9A983E1310851DDBFCB3CF58C49A9CE21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783346519, "uuid": "f3504ba6-a4c7-4f0d-8c1f-cb1ed67da57a", "value": "768:3+A9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:3+9co", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783346519, "uuid": "5e7a1760-8c19-4d7b-ad5c-a055a69ec4b8", "value": 45517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783346519, "uuid": "5bfd70e0-0871-4fd4-b3a7-87be4657a15b", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783346519, "uuid": "ad647d0e-e154-4960-946a-956d92ccb77e", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fcde198-7974-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783367588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367588, "uuid": "f3c2b31c-9c6e-4997-b1bb-cf9dc16de341", "comment": "Malware payload", "value": "6bfa56f0c2066a3b6b581aaf0bb080ed", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367588, "uuid": "04e7deec-f07a-4465-91b5-07fa704c61fa", "comment": "Malware payload", "value": "b94f04ed23e299dcabcddbf467dfe029f839bda0d5250f7c983d1ade04aa23d3", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367588, "uuid": "18bf910d-2c85-4056-9cd2-8047f8fca067", "comment": "Malware payload", "value": "ef6c9141d114667136cd8ffc94e94dae22e9d71d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367588, "uuid": "09b6f66d-0346-42a8-b1af-bed347e4616d", "comment": "Malware payload", "value": "2c68ba2459722abc199179f913c909e937e5243d4bd79c511315a0f4eca2824da2026940938eb76feea392a11a5be256", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783367588, "uuid": "a52cb0c8-9eef-42e3-a386-f2dfb2348864", "value": "T1CDE63349B9E102EEFAA7813DEDE352A2D46570615771CCCB07AC8266BF132D64C3A317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783367588, "uuid": "23011b1c-4a18-470d-887c-80bece217d28", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783367588, "uuid": "e3dd021d-782f-43fa-8f4e-6efe633f4fb0", "value": "393216:onuak25IFuDQgUIOcpoHX/yJXMCHWUjXzcuI3/PGTAI:oSFhc46JXMb8XwH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783367588, "uuid": "e59c56f9-1e90-4b65-ba43-53fcb7b1f7df", "value": 14292067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783367588, "uuid": "c84d6a86-1fba-47d5-b486-bdf755774ede", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783367588, "uuid": "60ba3dc2-f6cc-4a85-8cf2-811f03d76c28", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8690bd-78e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1783306546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783306546, "uuid": "daa0f84e-fbb3-438d-b109-c2267e145f12", "comment": "Malware payload (Phorpiex)", "value": "263318d12109482836e1c33bc0ea313a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783306546, "uuid": "c9803758-51c1-4854-944a-2fa1ca08140c", "comment": "Malware payload (Phorpiex)", "value": "ba320569fc72623c8a869dcbdf824af3c668dbe17759876535ec33ebf4bdd6dd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783306546, "uuid": "7162b125-9237-4dd1-aff8-0a40bef85a40", "comment": "Malware payload (Phorpiex)", "value": "10e2dd96ba44da76b98e4dba8f91e59ce625d44d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783306546, "uuid": "51985b47-fcca-4ea3-b9a0-e517ad1c9343", "comment": "Malware payload (Phorpiex)", "value": "9eea48dac59133a07c69bf4947d0d99fe2a3fcd881c9eec0ffc19122c417943c7e7f3ebaa78ce60f7c5764909dafe2ff", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783306546, "uuid": "b10ac5ee-0378-445d-ab8e-a4378d49c019", "value": "T1AE825C0FB9424726C0E110B49676873BDA796871338854DBFB944AED0B686D2FC3365F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783306546, "uuid": "f3a86c2c-3c63-4505-8cba-86438e9381d5", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783306546, "uuid": "d5d29aa2-a816-424e-9eac-4dccfed4fd82", "value": "192:UaISCngTBvqQ1jV6lXwIXZ5qF4le6qo/fKUSiu9zw+gj5tKCgbOBqmEdEFWEo/GR:UIqQlV6lOF40uu9JgFt2Uhav8U9cVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783306546, "uuid": "c663d2a0-cf1f-48cb-8f48-c0e8ff124d14", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783306546, "uuid": "dd8849a6-e4ea-4719-9e74-e5a7da6e0bec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783306546, "uuid": "3f5b1a94-67f1-45d8-a1fe-6fe9b213594f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52696f6-7960-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783359222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783359222, "uuid": "18bd7254-b39b-45fd-8727-988b62a524ea", "comment": "Malware payload", "value": "e86e8374812fdef93324f6366becf51c", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783359222, "uuid": "de6ae181-9b13-4c26-9442-1d16a752d295", "comment": "Malware payload", "value": "bb7554b559d6d3d336aff85cb331b40513b9e9e5235b24401e15ec0810aa61d3", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783359222, "uuid": "f6008f02-55df-4b2d-84b7-d81635e02af2", "comment": "Malware payload", "value": "23d7955647bb6de7f757a419e9670f18423d5e6a", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783359222, "uuid": "0c532549-72a6-4832-a322-7f8809aec0c7", "comment": "Malware payload", "value": "cd2c9cfbe11bdfa0693f41d692c194e1dbd1655d275b79025cda6d00489efb3c6df35b94b156740479ca63a61ecd1913", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783359222, "uuid": "c000de36-21c7-45d5-ad56-38358fefb043", "value": "T1A208331A2D0AD73BFDABC8751A33A7528B02C7B702794466323F1DA17CF2656A53C253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783359222, "uuid": "c615fa67-eb43-4194-becf-cbdd2ed2ed9f", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783359222, "uuid": "6333b2b5-b1ad-42ac-ad3f-b2cd00aee80d", "value": "1572864:3t9IKPbeMUKxGYFlGmWlwPDOuUJ5UsyuRuGDzp67dnNEskao+W+7:3UKqWcYull+q/FyuT6hGskJX+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783359222, "uuid": "8188318b-22c6-4f2e-9f0e-1707c56981e4", "value": 77418372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783359222, "uuid": "001b0b08-c590-4f33-a08b-d1ba3d21945d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783359222, "uuid": "84b50b36-ef25-4434-9bba-703d39622fee", "value": "Nightmare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13ab3a5a-791d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783330121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330121, "uuid": "01b95c4f-e79d-49b8-a4f9-168023bd26b5", "comment": "Malware payload (Mirai)", "value": "ea82651e7d0e7c621652d77b7741a07a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330121, "uuid": "7b8ac794-512c-4e68-9d64-b7ce6efbdc1f", "comment": "Malware payload (Mirai)", "value": "bbf0df252fcbfa4becd303f4fdbd3f6ae17e5dd6467541b07f41292af5452710", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330121, "uuid": "3e833ec1-c323-4423-a88a-86ffcfc86c78", "comment": "Malware payload (Mirai)", "value": "97bdb6cbbc5a4fe8e1797160b1e50256445904bf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330121, "uuid": "1b6f2c0f-69ae-45d0-9f40-dc717402234c", "comment": "Malware payload (Mirai)", "value": "7c81fdd74e33965e1eda14cebeade8acc8e23776166dc16960a21140c26ad06ca13d36d74de53901b2913e2a59ed758c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330121, "uuid": "21440460-bd59-4935-9e5b-392226e5e0bf", "value": "T15DD30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330121, "uuid": "e32e4cd8-b83b-4ca6-9e93-762b13fc744b", "value": "1536:QKdzElm18uZJNb4AxFa8eAZHk4VB7fzTTnf5mgYivCyeqZ/Z20lCmwyw6RNPUTuE:QKp50uU8e947L3f5mziPtRZ55ZKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783330121, "uuid": "2d3831df-41f8-4dc9-b1fa-f6cc3e622a78", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783330121, "uuid": "6c24ae36-93d5-49bf-a5c6-394297fdc027", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330121, "uuid": "9bd936fe-d75c-44cd-b8f1-d41f569a278d", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f443e23c-7929-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783335652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335652, "uuid": "dbeeca36-5ab1-4632-9317-52dc270f5e5e", "comment": "Malware payload (Mirai)", "value": "1197730bd6c8467d85d9a33561cdea08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335652, "uuid": "0f59fe31-6829-4b33-ab98-8b578491eb73", "comment": "Malware payload (Mirai)", "value": "bf38b3e5d645c78377599a6c218a347312c5a3daef693c7931f2710806d85317", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335652, "uuid": "2c4a50d6-9531-487e-a085-84c875918b93", "comment": "Malware payload (Mirai)", "value": "3b4cb0d32581d32e1cda3beb3a701472ba70da8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335652, "uuid": "e9a8d720-a164-4384-8215-dd2cd61e6a98", "comment": "Malware payload (Mirai)", "value": "eb5a2e05a6c2b512fbeed70268ad82a90d8924b41a0c3d47631e4bde6af8b2b52debbf78ff09cc0c02fdff433eb8d48b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335652, "uuid": "20145b11-7374-42c0-98dc-171b091cc354", "value": "T172246BA8BA0F6C01F2C3D3F8DE8C87E13A1735E3C7768971791212EDDAA39D95990512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335652, "uuid": "78f7cf23-3ae9-44d2-8df1-bf0c1e605f08", "value": "3072:CwS1OScpwRz0maXCvz9P+HyC37HbKG9P9nKMh1GboqN3y:ZuOScKRz0mayvhPIyu7HWwnKUGboq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783335652, "uuid": "72d52c66-f67d-461b-a2e6-2a55268e6dc9", "value": 210936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783335652, "uuid": "92aa31bc-9a98-4b65-84c7-ccffb2e29dff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335652, "uuid": "2f803a0a-ed80-4149-bdfa-cf1651883d7d", "value": "iran.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512c5128-7902-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783318628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783318628, "uuid": "2a8fc5ea-b40c-49c9-b66a-edbe972cf12a", "comment": "Malware payload (Mirai)", "value": "769cd1ffcb8e241c9b215f324fc2de0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783318628, "uuid": "fee3ac5b-ba33-4573-977e-0c1b3642b722", "comment": "Malware payload (Mirai)", "value": "bf5fab6173946184299c8c6f40abcc916ae4657913d70104b5fb22a1f6abe413", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783318628, "uuid": "93629ec7-814a-491c-8600-c1ea4e0c6cd6", "comment": "Malware payload (Mirai)", "value": "3bac9698d05558a2eb258563dd0c7a3583490cde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783318628, "uuid": "9de1bcb2-5088-40a1-881e-3ea69a300b94", "comment": "Malware payload (Mirai)", "value": "7754863c6a04b585e755d477ef7bfb908cf68db4a3f8e035be3c3f0a0aa26dbfcf8b3bd5a2028162735ebc6769298fbe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783318628, "uuid": "9ce2cf08-20f0-4bb4-a6e7-3d22b5f918da", "value": "T13E17BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783318628, "uuid": "5314880b-3091-49f9-a5f3-450626aaea73", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQr:cqYUQuVDt0TZEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783318628, "uuid": "3f2c5dbe-1305-4912-a57d-9847a871d8a7", "value": 18743296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783318628, "uuid": "d8cd0d9b-af9d-4807-bde6-efdabe8f39ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783318628, "uuid": "58890b22-6f62-4a94-a80e-b7a690d1d066", "value": "bf5fab6173946184299c8c6f40abcc916ae4657913d70104b5fb22a1f6abe413", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f8ad2b-7916-11f1-ac1e-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1783327171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783327171, "uuid": "07c517db-9768-4ca1-bb96-416f60668a16", "comment": "Malware payload (CoinMiner)", "value": "71c8888a76a1307c4d3d9449e9908a18", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783327171, "uuid": "71be9816-d280-4880-8019-60eb8b0ba877", "comment": "Malware payload (CoinMiner)", "value": "bf9ce3e8cba342b104dbf929f02e933fd9d3df472273fbf07d08993d33566e22", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783327171, "uuid": "17b23041-091a-46ae-b88f-be753d180201", "comment": "Malware payload (CoinMiner)", "value": "4082dd0939a02f4ed9cad405e93088e2ec91359e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783327171, "uuid": "7f1d33ba-4d84-42f2-87cf-66b67af9c6d7", "comment": "Malware payload (CoinMiner)", "value": "e4f54b6487e9cb9e025a9634a87df18478943c9835fa1cb106275506ab54444e3ed4a080716532650abc15322f3adc18", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783327171, "uuid": "e7cdbd63-f500-4bfa-9f27-d1cdc6f891dc", "value": "T1809633A4705E0C2CCA2893F0F29B755644F8377A7F6B0E83E1150E545E1A3CE9BA786D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783327171, "uuid": "4302c463-4ee5-46e1-a30c-b70d634bdc34", "value": "35a81d16af9f2ba6d515f11152d0364b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783327171, "uuid": "22c15e8c-1fd2-4f99-a1dc-151eb11f037a", "value": "196608:WyN4PBZdXnWQVvZWSipqJWkLDNAbK2xtc1oq21CA5t2wwxeNHD5kAAZVjRCY:VedWmE5kLDCbJW/21FtzwMNHVk/HVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783327171, "uuid": "bad82d3d-7b00-4822-bcaf-f108b76adaed", "value": 8872856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783327171, "uuid": "f89537b7-57d4-43e1-a17f-fea19bd4bed6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783327171, "uuid": "5026d028-9700-4b13-b1b4-c138230b6a3a", "value": "SecuriteInfo.com.Trojan.BankBot.3375.31629.24773", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2536f3-7963-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783360333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783360333, "uuid": "74929850-6861-42eb-9a20-339831b8e13d", "comment": "Malware payload", "value": "ff9c9242bb0e7e0bbd4541c11fb6b9a5", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783360333, "uuid": "1edbb251-3539-4be0-96ed-d74cb5e90b06", "comment": "Malware payload", "value": "c1e96ce8ad5188fd896e3d1b908d2fb381ceb89561e28960bdf6700668dbda0b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783360333, "uuid": "2aeff804-5c3d-430d-b8b8-0d3fdd3dc9fb", "comment": "Malware payload", "value": "eb4313ed8bea2071187e663cda83d282258f84b3", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783360333, "uuid": "924ec23a-4981-4274-8a5e-595264eef19d", "comment": "Malware payload", "value": "2f3586be4360fb89da6dcbe6b33a3bdd00d182ac6687067c32b8585c638f4d612d93ae2af6d9b01b15ab87f972d333bc", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783360333, "uuid": "afb60ae6-5e85-4606-89f0-9a8210457aa8", "value": "T1DBE63314A9E406F7EDB38138DAF147D6F975B0B20F72C68B67848396AD5B170883A713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783360333, "uuid": "3fc0b162-84b1-4c36-a5a5-8cc302cf9739", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783360333, "uuid": "5ba3d200-c5fe-4e96-95c5-4594f009565a", "value": "393216:Hrb2z2VB2r7qlJpyvrsL+XMCHWUjXIcuI3/PGTAI:Hr+OAve6jsL+XMb8X9H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783360333, "uuid": "7aea444d-fbca-4bd0-878d-2ded9de268e9", "value": 14252665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783360333, "uuid": "f1420d44-c992-4be4-9bdf-9e0482ff4a1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783360333, "uuid": "931b96ac-8309-4a08-bd68-24ac6aa685c3", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c822cd45-791c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783329994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783329994, "uuid": "c8d0f353-f1f9-40ed-a4f3-e41fd70c4f89", "comment": "Malware payload", "value": "d9abe87318737b78bd27a58a85849661", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783329994, "uuid": "6a6ca90c-60aa-4113-ba54-3958640e6fb9", "comment": "Malware payload", "value": "c3177047906608f639b9f94c33bba57ac154e93714c1ccf6cf0abae5e03cdf41", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783329994, "uuid": "d28d9047-7100-4d83-bcb4-4800335f9306", "comment": "Malware payload", "value": "b53b32b2d3de45fddf6366ee5eb9f2135b0e9727", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783329994, "uuid": "3b1f2044-0928-4448-bb76-ea4795b6e714", "comment": "Malware payload", "value": "252f3b24bf0cd05da4d48cf92af1175b4b7e73286752f46623290c5c0e8ba79bf89dcc539cb69594c55f1c67de1e3ca8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783329994, "uuid": "d257b0e0-5ca3-47f1-8b9e-c8be163d23a8", "value": "T19721832CAD5E2CB4B60E107CD09586707110471F01AD4F7475FEA35C6FBCD02E7A6852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783329994, "uuid": "3d919771-39b0-42c7-af5a-abe8adcbf6f4", "value": "24:akmbPcXCdEYxFQaAou6XsGPQoypagHalQ+ayfx39MMxIGJRwq:a7tEYxGndjlaealQ+ayJ39zIARwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783329994, "uuid": "c86e3d8a-8024-4799-a78f-58201189feb8", "value": 1414, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783329994, "uuid": "395a7b95-852b-4f60-96a0-3f420d64a678", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783329994, "uuid": "46352e0a-3744-45f0-ab20-ed74770183cb", "value": "adb.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16321d59-7974-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783367492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367492, "uuid": "e2a8fd0e-00d4-4800-83ac-e6cf6beffb19", "comment": "Malware payload", "value": "b41d72c1c9b7af192e5014343c91a8bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367492, "uuid": "e6b6d51b-e59f-412d-a4be-275e6f1b2c9d", "comment": "Malware payload", "value": "c45d98ff74ce79277bcb8e298115511b618e0b94bff33dddec56a440afae59b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367492, "uuid": "e77f8deb-5701-4a82-8f43-ba5717abe2ac", "comment": "Malware payload", "value": "783a260abccc22585ed7aded55bef09f37c5298c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367492, "uuid": "4bf1110f-2283-4d22-b569-741731672a3a", "comment": "Malware payload", "value": "6b47a82588de97facbecf140193949f03d61329ec719c7b411dd83125fc46c850100e635ab14abe265e9fe14cf7d7ecd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783367492, "uuid": "ef3bacf6-9003-4ffb-89a9-53e862b7b86f", "value": "T1FD83022E2E145EE8C433F47F20AAAF580F774B46DD41F189FE69E1806A9171D5800EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783367492, "uuid": "60370502-1b04-4933-bc79-c04f01e9d9c3", "value": "1536:0+a9/Qom9Tnyjo7DxpvsB/9Vf78VCj+DsT0UcskwNer4pZwV8A:0Pxm9TxXxpyKCj+DwcSfsVt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783367492, "uuid": "bc3fa1fa-d6b7-49c7-abc9-0bf27a8e6e8d", "value": 87940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783367492, "uuid": "071fa3df-17f9-493e-b1fe-2f4915e35be5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783367492, "uuid": "c06d54eb-bc02-459d-b23e-7f5060fbcf3d", "value": "dg.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd13c819-7928-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783335130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335130, "uuid": "1e2cf002-5a28-4ca9-b130-21ed385b4f78", "comment": "Malware payload (Efimer)", "value": "4c36ad2c50190c8a447056631cc0187d", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335130, "uuid": "8617531a-e886-4180-86ed-8b22a400cd25", "comment": "Malware payload (Efimer)", "value": "c5d2d995c4421410619876b87cf8e46b7619654626cb5f78c1515fbf166d9dae", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335130, "uuid": "c5478a8e-0008-4aba-ba1c-61b764688606", "comment": "Malware payload (Efimer)", "value": "9522394f0e33acd02dd5de773797b07ac4ac62f8", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335130, "uuid": "573670e2-2f87-4fca-bcda-3b6f0c6cec61", "comment": "Malware payload (Efimer)", "value": "1ff4b85b9ca6935ea768089d2a998884f8d192c5b015fa3561ad5c8fd893ba08571a4efc1f9a891fd98113eff41a15fb", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335130, "uuid": "1a7f3258-4a3d-4561-9217-7e8d24d7679c", "value": "T174E633589AE013EDE5F31238AEB251D1D468B46B0776CEDF135443F1AEA71E08C7922B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335130, "uuid": "85d24c25-7263-4bed-bbb0-1dced7100e7b", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335130, "uuid": "2d17efc2-f3b6-4cff-84e4-0376c0e171b8", "value": "393216:Re2910Idv+kvy5XtJxB+/y67E6DXMCHWUjXucuI3/PGTAI:RdttZvqtJxQJQ6DXMb8XDH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783335130, "uuid": "bc099f80-969f-43fb-853d-2c1c85ef5e73", "value": 14289705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783335130, "uuid": "05f35bad-4d81-49e4-a4fa-08e08d119985", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335130, "uuid": "c66a5c34-7920-49be-83f1-0fe60422591b", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14275063-7949-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783349020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349020, "uuid": "7d9596aa-2bce-40fc-90dd-4d10a55b21b2", "comment": "Malware payload (Mirai)", "value": "32dd69f7ecd56e3f80278842a30a6379", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349020, "uuid": "43879b63-e2f0-4867-8477-83c5382b934f", "comment": "Malware payload (Mirai)", "value": "c5fd9f8213152dd02d29f12f0b88e0c0afee27997b06f8c13ec527363a5498e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349020, "uuid": "2e129033-b65d-4714-80dd-378afc19af7d", "comment": "Malware payload (Mirai)", "value": "bcc942db0568f122d94665cbb64a65e8fcbe3a84", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349020, "uuid": "6b470340-2c39-4592-b6ea-0393b82b6011", "comment": "Malware payload (Mirai)", "value": "5351065f5fca14793681f8be997754ffa68a708ba7aaedb85398e922e1e995b272695e5464429d0e1f3847af0312e32f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349020, "uuid": "d4aef3e9-079f-4c33-989e-db19f5a72443", "value": "T19E04B606AB610FFBDCAFDD3706E9071235DCA50B22A53B353674D528F54A50B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349020, "uuid": "886bca63-dd27-4189-a7e4-b3a9dcd33931", "value": "1536:ZtnChm3LwYvHbICFsaOVuDwrU48INcx64O+kIIm8XUfOEcZCyz0En026C9yVMt0d:vCs37HbjIhl8MDXUcJb6CMV2RFfv5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783349020, "uuid": "32f9a62d-072b-434c-9973-b774b8f95368", "value": 181964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783349020, "uuid": "688bb8d8-2e1a-4ac4-aafc-97421a8b787f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349020, "uuid": "a3e1174f-0c43-4a8a-aae4-48a5cd1d523c", "value": "atomic.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0965746b-7949-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783349002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349002, "uuid": "099654fd-d8f3-4f47-8f06-d17e398ee21c", "comment": "Malware payload (Mirai)", "value": "054765f950874d0aa66514571b0de0d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349002, "uuid": "6cbce1e7-8d50-4b7e-87e3-884f7e374c40", "comment": "Malware payload (Mirai)", "value": "c60db62a541a61b9f5027a5f8aebac69634d8a46c0be6906aed117001713930a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349002, "uuid": "0afee680-f5f0-4d5b-8ffd-82def3b5cdbe", "comment": "Malware payload (Mirai)", "value": "e3192020b18c9d189307d9acff197e10f48d177b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783349002, "uuid": "f5214015-0c08-4e81-9af1-d5201f84455d", "comment": "Malware payload (Mirai)", "value": "c4bed13103ab23b6d825553bc84dfb383c917652c51a4c68218de52dd5bfedc9cb6b0df44d16a171f0183c0843bd165e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349002, "uuid": "d9aaf71c-e69e-40d6-952f-fd5aced3ccc6", "value": "T14204A91E2E228F7DF668873147B78925975C23DA26E1D684E1ACC2145F6038E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349002, "uuid": "25805bc9-eb8b-4356-b565-12fdbdd2f562", "value": "1536:o36caLrlCZpq5vfueLb2wTF9Uxxm9tTm0X0YpsjjMCa85eF0s9LHBe2uRKByV3TT:gLaLhCMj4MCaGeOs9LHbuR3kQ+yqYW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783349002, "uuid": "9f53564c-1b39-4ae6-b991-f4cfb0b10288", "value": 177868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783349002, "uuid": "8b16a484-680e-464d-bc44-bdb391837278", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783349002, "uuid": "f5dd7fe3-4318-4029-9148-80f8e5cbd428", "value": "atomic.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe6f1c10-7919-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783328797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328797, "uuid": "268b7b43-8901-405c-9396-81acbce6b1f6", "comment": "Malware payload (Vidar)", "value": "58a05bc174cdeb9829c63303be3c6d48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328797, "uuid": "a1364848-c93b-4fca-9a4d-51d0d9052c5b", "comment": "Malware payload (Vidar)", "value": "c71f9fc111d318fabfc2a7f79ce8ef89247ccc6bd4f2848838bf6474cca1abf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328797, "uuid": "1f440c2a-be69-4f69-bec1-f9b7f9cacedf", "comment": "Malware payload (Vidar)", "value": "07ad13454e055449d3743deef5ef1e7c1034ca9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328797, "uuid": "25cd84d1-79e5-4dc3-83d9-0101e7b05e38", "comment": "Malware payload (Vidar)", "value": "1bceab6059cd7b7ec98f6c6a82da15e71b3ebadd8e0a00745a680e911c63e551d24697110ee02846aae0f63eb3e9674d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328797, "uuid": "71ce3162-190c-4ae2-865e-c326a327820f", "value": "T11F521A8AB0A3B1B8D06AC278CF5F0177DB623855162B5FFF56DD88A03AC26313538A55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328797, "uuid": "086b07c5-5edf-49b5-b1a9-79a2447b10e1", "value": "f6ed7a812e36f2c87231645354e7939d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328797, "uuid": "4d25bffc-6983-4d81-8e02-72a3f5b00a1d", "value": "192:kycssF0rknN5/YdCKbzDP1Wu5PjFBIpzs3Vvl:zsGkNleWsPjvIilv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783328797, "uuid": "a0fbe235-f096-43b3-9771-fcaaf8aa3a50", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783328797, "uuid": "5fa52c8c-f271-41ad-a333-f3be174ea04f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328797, "uuid": "51234e90-53f5-403c-9ca5-27989d1b7cf3", "value": "58a05bc174cdeb9829c63303be3c6d48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f2e97d-791f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (SilentNet)", "timestamp": 1783330950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330950, "uuid": "affdd04f-0874-4d1f-b2f7-4757f0f90c7f", "comment": "Malware payload (SilentNet)", "value": "c1301154fa89fb76e3a63814de742adb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330950, "uuid": "e24f969b-c7c9-48c2-8295-9d57a0e4b4b9", "comment": "Malware payload (SilentNet)", "value": "c78c0d5a451d2e0934a853af4716a6df4c64cdd6a71f14b82971037b8c1f2d35", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330950, "uuid": "0e009af6-2c92-4930-a81d-635a8bc464a0", "comment": "Malware payload (SilentNet)", "value": "298e8f72a160fff415789ebbf675e0f3aaa37fa4", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330950, "uuid": "4b6f4c6f-9998-4ae1-93b6-6116d4c70a71", "comment": "Malware payload (SilentNet)", "value": "ec58729937c40283ff60f7ba5b9c7aabb35a5e01c5d1371ac05772f3e185b69daacb18c668f37c0f30d6f5f6d0f020bc", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330950, "uuid": "a9920f80-e640-4b49-8d81-5e10b30debbb", "value": "T1B9E312ABE0D95028DBD718FFD4080A5DDE382AB395AB11CF454210F5A88392F9F53D57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330950, "uuid": "c778360e-1f88-47d8-af9f-56889d2992ce", "value": "3072:gQ5OOiiHS1Vvj37qMprfw/vykzepnAdaSgN0PCfqpvCbmdza/gmTwTGC:gQ5OxGS1pacfPAepAISg3qcmUxoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783330950, "uuid": "f0c7f1b4-e3ff-4b8d-93da-7f0f4fecb7fd", "value": 153954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783330950, "uuid": "5fd62540-881a-4192-a869-27d864ea0a15", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330950, "uuid": "acb7a88a-f098-4308-bbb1-030abf3b7438", "value": "afkmodule-0.1.1 (1).jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2213d6a-796c-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783364371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364371, "uuid": "01ebbe4d-80fe-4cf4-8074-dbcd83eea1c4", "comment": "Malware payload", "value": "4453194b7f2360d52dd562e4bbb5f81f", "object_relation": "md5", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364371, "uuid": "0ae51ef1-9509-4d53-9636-287d9bd01cfb", "comment": "Malware payload", "value": "c873275988a682f0ff2ce15a3ea1adf456e095f6e84e0e31260173cd9fa7265f", "object_relation": "sha256", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364371, "uuid": "6788a6f6-8714-4397-8010-b6ee05f3b42c", "comment": "Malware payload", "value": "120b444ce8e39b6d4681fe57de97135299a78280", "object_relation": "sha1", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364371, "uuid": "2aaba697-79be-4563-adc2-df637d6b4f3f", "comment": "Malware payload", "value": "1694c4177a8fd98cb31d18d2bb30ee5bc9b4d36708ca39bdba9b093c6256bcb315309154b34a39316861cb187af0542b", "object_relation": "sha3-384", "Tag": [ { "name": "0zbqnac1t4dv2t2wuodv1m-com", "colour": "#2DDF16", "exportable": true, "hide_tag": false }, { "name": "booking", "colour": "#9F592A", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "sizyrotiqnsa-com", "colour": "#4DFE18", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "v0hkpadr04mbz5lkearqa-com", "colour": "#1F9750", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364371, "uuid": "ccef1757-271d-40f3-9385-5d7a6a433d24", "value": "T15511C2211BEE4A00F2F6DE34ACB9A3021B303D0C8D31864D06CA181C1C62E148C34F32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364371, "uuid": "a21b529d-c3f2-41dd-9dd1-7fae068e16c9", "value": "6:4xtiyd8deczKlFcnlj+SEEgykQLPfBMlpINSKKQV6SaU/k1ARokJxt:8oOMREkCikQLhMbU1VMf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364371, "uuid": "f5ba8892-a554-4495-96d1-166907087d6d", "value": 1046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364371, "uuid": "647609a2-e136-48c5-a70e-86049050a420", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364371, "uuid": "2fc3e395-c96b-480a-ae1f-96c013094dc5", "value": "photo-55869729845700 lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "402245d0-793d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783343940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343940, "uuid": "8a3e9abd-daa0-4f87-9556-b25aa342352d", "comment": "Malware payload (Mirai)", "value": "0da12d60040ad1995082ad9c66e6d338", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343940, "uuid": "a1606374-0be1-4b11-ac60-194595d8bd61", "comment": "Malware payload (Mirai)", "value": "c898a3b1b23f2288da389cb0680fd880618c211fa3ea1e7093d13db0eca03716", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343940, "uuid": "fa1e033b-14f1-4217-a77b-8f5b18f96713", "comment": "Malware payload (Mirai)", "value": "56c1b55b6649f7c23943d0d91b5125d676bee3b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343940, "uuid": "69cc61c5-eb53-44a6-802e-ff284d3d2e0d", "comment": "Malware payload (Mirai)", "value": "9bab8ead77b8c1ea477c1a6a1df36e1c16473fee02107920b7c4e5a0ed8c9b6466431900dd1d0b08fe0fafb23af1db88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783343940, "uuid": "cf9be8a6-7a0f-40e2-9278-b411de5e5f69", "value": "T117457C5AF2B370BCD067D030439FDB63A839F46902216D7B65C4DA352D62DA01B29FA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783343940, "uuid": "867356d5-59b2-4725-a2f3-9b0e8c892bc6", "value": "12288:XsOAQqIHo9wqHZvBYQEJxR3zwRRnKj4yETj/SgCgmyyjoEsKtdv5k:LAIHoGqHZvCJxR3zwRRKj4fT7C8Eftd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783343940, "uuid": "622886cc-849e-4520-b371-8dcd91064c3d", "value": 1182080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783343940, "uuid": "2d0ba091-1dfc-495d-a710-5049542860a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783343940, "uuid": "44f6434a-ea01-421d-9afd-508530456cf5", "value": "bot", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "835917b0-7909-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783321719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321719, "uuid": "af4657b1-f4e5-4366-869e-eefc96ff3737", "comment": "Malware payload", "value": "73700632e25fa648d996cded35749768", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321719, "uuid": "7b06196c-1eb4-48cc-a3f6-f88fdb179025", "comment": "Malware payload", "value": "c8bdd98e7a0cac3b571307bc6e5c2321dd31972c5e232ce5e0ff4a64c0cea6dc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321719, "uuid": "4584d8ac-bb18-4939-94ea-bf3dc7d28d70", "comment": "Malware payload", "value": "be49b0121bfa609202621bce2fc1857247f914fc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321719, "uuid": "7d5c7d5e-db8d-41f4-b51b-d42fd824a3a6", "comment": "Malware payload", "value": "9401961a6558935535756810b41a9212e391c99e65917cfd6ec5734fec771874ee9756b77369367f39c6ad05a9df9b37", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321719, "uuid": "a110ab22-2d3e-4641-83f9-830c90312cb3", "value": "T12F136D6526953C25AE99883B5C7F2F0CBDA983E2304491DDBF8B3CF18C15A9CE718719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321719, "uuid": "3167c41e-c3b9-4dcb-aaf8-be440837403b", "value": "768:ar9NyXsZztCA9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:kHusZUco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783321719, "uuid": "6a6e27d4-6e21-4289-8959-aad007e5d1da", "value": 45513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783321719, "uuid": "76d40f5b-502f-4a7b-a130-722ba287c44a", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321719, "uuid": "1e375ef6-24fb-4c4f-a6b6-0579b88d6ff8", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7958ad-7992-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783380600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783380600, "uuid": "cede4fc6-e5ee-4912-8b1c-0c29ee2601e5", "comment": "Malware payload", "value": "0d8c0025ba0d1ee7a92fdf94be9e6476", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783380600, "uuid": "a52b7445-792e-424d-a40a-f054bd5f22fc", "comment": "Malware payload", "value": "ca9c127d65c5e9839cf02053e8dffb3869f086bd606badbfbf866e348db12612", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783380600, "uuid": "5039afe2-441b-4c8a-812f-8d6125ce63d7", "comment": "Malware payload", "value": "c3f7d5b3b26dd52d238c215f561736e0e3c89c54", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783380600, "uuid": "356c2f79-0664-40e8-9b02-e70e47e37f6c", "comment": "Malware payload", "value": "395556367152b7d435d9b8e8eb1ec9edf98415c884ab19203d87855c0e7469cb2a187bd3f4fb43f707bd897f702747fd", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783380600, "uuid": "60c84308-65d8-4a76-85ce-014c9ecd218b", "value": "T15E32901E2E4B0332DE5049B4E471424A552C1EE37347EBEBE633D6DB4AD6E4484C1AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783380600, "uuid": "ac7c3a84-1831-451b-a963-cc70dca45d09", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783380600, "uuid": "e8fd7fdc-27e2-4564-ae61-73adbe5018bd", "value": "192:yoTW/S5BQWxSHO865hyPFJxTEZmFhquc:yoCWsufjyPFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783380600, "uuid": "ebf5728c-1e88-4978-a5b9-6453b17720a4", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783380600, "uuid": "a9cc2198-ffa8-46f9-9cab-8d899fbd2760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783380600, "uuid": "15d1a303-aa38-4a99-af7e-0a18c22fb67e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7447d0f9-7996-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783382252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783382252, "uuid": "c3e035be-d066-4c09-b48f-66a12a931a26", "comment": "Malware payload", "value": "500b3ec4308048b37ce8a66f3614d7c4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783382252, "uuid": "ed065395-4a51-4144-b242-c00f9307d289", "comment": "Malware payload", "value": "caccb7aa5c67860ab942576d7466e126eb94c538a91bb4e7d2cdf3eb9992f818", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783382252, "uuid": "f8400ba5-358c-4fee-888a-57c13100c72e", "comment": "Malware payload", "value": "e48b683ab9577ea681bfd76e363993f94ed10ffe", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783382252, "uuid": "8fc21b59-5c18-4bab-8542-9e190901bc6f", "comment": "Malware payload", "value": "da883c0f8feec98b92f4169471281b5aad4df4df92185eb256d888ea00404b31dfbf14ec9a132560032d0c93e5697227", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783382252, "uuid": "204e2f4d-eb6f-4104-92dd-af198171d362", "value": "T14232921DAE4B0331EEA049B4E475424AA46C1EE37357EBEBE333D18B49C5E4488C192F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783382252, "uuid": "0e041534-feff-497a-9692-af4496a50e43", "value": "d9cdc56d00b82d68dd1cc6a7338127bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783382252, "uuid": "44382a6c-259e-42e9-961d-3727da2bdfb8", "value": "192:R0o92WaqBBFQlSHO0UOJu+PFJxTEZmFh3ScP:eobQwu3OJu+PFwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783382252, "uuid": "b78ad5c5-cd58-4962-b55c-f84c7d14c057", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783382252, "uuid": "6e2da5f2-af5c-4fea-8d91-8e417ee4d537", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783382252, "uuid": "e748be54-2035-4b60-92f1-5a405de25e13", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37890294-7907-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783320732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783320732, "uuid": "1f082d8c-9a85-4760-8168-f84e812869fd", "comment": "Malware payload (Efimer)", "value": "49771feb8b4ded5fcbec1eb16aa4345e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783320732, "uuid": "82b54863-2b5c-43bc-a680-99a9a404323e", "comment": "Malware payload (Efimer)", "value": "cba5a5f654198222030e8134ac86bbfe705bb2fce061ecaf40f20571eb584d76", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783320732, "uuid": "4113fcf1-7854-4d58-b90a-a23ca71d7cf1", "comment": "Malware payload (Efimer)", "value": "887081d4549632ee2fd8a31924e10dd519d5b147", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783320732, "uuid": "e33c7573-f234-43fc-b288-29b32be9e629", "comment": "Malware payload (Efimer)", "value": "16f376030ca4da495618065f97d0b6a68e61b6e499d22e1f0686f0139feb8cf4fec9e112dece6a260c5c46f426a9bc72", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783320732, "uuid": "e0481c28-516b-45fd-afc7-65184acbe4e9", "value": "T1A5E633089AE010FDE6B3813DDF92869AF598B4714B32CB9B16BC93A63D731904D39717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783320732, "uuid": "d62d1753-b8cb-4e16-b5be-8cfcec6f7768", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783320732, "uuid": "3c20286c-96e6-4516-90a1-dd925d323322", "value": "393216:XnonHyF5z50LSYqHYiSXMCHWUjXTcuI3/PGTAI:XMHyFH0LSYqHPSXMb8XQH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783320732, "uuid": "e0451954-4356-4ece-98bf-c3a574817a8d", "value": 14254601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783320732, "uuid": "f95eb83c-6838-445b-93c4-b566ccb7df7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783320732, "uuid": "fcad1e66-7557-4df3-a0ed-1d7962a276a4", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10cdcd01-7979-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783369630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783369630, "uuid": "5c03d02e-05d5-4bf5-ac0c-f0ffe75f0ea0", "comment": "Malware payload (Mirai)", "value": "cd91111603d3a7cbc16ef04105e19bb0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783369630, "uuid": "3fd5be86-3d8b-4cfa-b1f3-7f98a7ceeb5d", "comment": "Malware payload (Mirai)", "value": "cc668803553940c2c7ee1f6e7929d487b7c07fc41d8bc3f19c773bb67bf27eaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783369630, "uuid": "83bf3e07-039b-4fa2-8d50-6b4200b5d95d", "comment": "Malware payload (Mirai)", "value": "eb4eedc53d642b38bd928cb75dc0cd6a9496f2be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783369630, "uuid": "9a17ce6f-d8f0-47a1-ba58-370e7922a67e", "comment": "Malware payload (Mirai)", "value": "e69d41828b167b01eb164e1a567df25a42d5470b4e5a6767ea8b2667d01fde94a358cdcd4f6f79e06db0ffb1a23d33f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783369630, "uuid": "290a60d2-ea6b-4d0b-8c81-e8bc777b68c6", "value": "T12A230681BC82869689D413BEFD7D81CD331273B9D2DF7112CD115F18B6CA94F0E6AA92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783369630, "uuid": "8914327b-61a4-4607-8b54-fb4bed8c9a68", "value": "1536:CMn12A//SrRftY97WARbIcbboW+zLsYtJ913DA:T2s/ITo7WCkybotgsJ913DA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783369630, "uuid": "37164c24-f320-4db7-9738-3d6c65bf5d8c", "value": 49700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783369630, "uuid": "54797409-9bcc-48d9-98d2-bf6471979a8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783369630, "uuid": "ec10d781-82db-43ab-a9b5-bbf7a822d480", "value": "Mozi.a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9130da-790f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783324415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324415, "uuid": "c601933d-25e7-424f-a892-6e522b6f101e", "comment": "Malware payload (Vidar)", "value": "9af6410602197a7374d0d5dafbb0c4d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324415, "uuid": "cd5a8f52-e713-43eb-8bb7-6a3473a85001", "comment": "Malware payload (Vidar)", "value": "ce76501a32a9144a8bec1336e3796e9ccc48ba648244c79f868f60cc605fdecd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324415, "uuid": "d6f250fd-7c77-4a7d-a62f-863a733d829a", "comment": "Malware payload (Vidar)", "value": "a952ad662ba7e9dc929b17f9852c86fb33505e7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324415, "uuid": "5f6836c9-96ac-459b-9b40-d753ea25bc03", "comment": "Malware payload (Vidar)", "value": "08c83a816e17db6c9c7759acccf2e83d475e68e334f2e059223db01b4259002905d4e9b89fe9805bf98f83e8489da9c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324415, "uuid": "d2fe17a0-0f38-49b6-abd0-df62701418d8", "value": "T183D58C076CE109E9D4AA933288F65196BB75BC194F3223D72E90B7782F727D08D39B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324415, "uuid": "bb5fa791-b153-4b02-9ca1-593398b04af5", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324415, "uuid": "63d04559-a5cb-4dcb-8d58-c874386e5ddc", "value": "49152:mrH2WzE7RvY8OYuyLChiSVo4e0nW0+gLyOC9i8ngUjYgZkBf:mrZJYsBVoqWGuOC9iRUUqk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783324415, "uuid": "8bde9b45-c144-4344-840e-bc6e2a1df28f", "value": 2969952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783324415, "uuid": "ee09abd3-b0eb-45a0-bd42-6f65bb898112", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324415, "uuid": "dbc130ab-c5bf-4219-98dc-eb53279fbc87", "value": "cf60bbf8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6be97a39-7973-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783367206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367206, "uuid": "2180bbea-9223-4d86-b30e-8c39ea00825e", "comment": "Malware payload", "value": "7dd9cf50fdf6e042f914ebf9904bd036", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367206, "uuid": "8b0f63dc-1fa8-4197-8217-a2c8bcdb02ff", "comment": "Malware payload", "value": "cf284583db104e7032876733467e77b25637a8a5d908c7b0d1582bac6c576eb7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367206, "uuid": "bc1a237e-5bed-4483-b998-1187bc34895f", "comment": "Malware payload", "value": "063e006e2a67193b0fa8604895bb3d5f4b79c268", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367206, "uuid": "e506b129-97fd-4e5d-99be-05ccaf5136e3", "comment": "Malware payload", "value": "7e168963ed8cdf6c0eb0d702e591773009ccb065683e4923807c2a29ec12c61e11675f2f11da23b49bd71be7caea71f3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783367206, "uuid": "f46a425f-f759-4a08-87d3-d08398230656", "value": "T142A0110EF22288380E2808B2800AC0A08200032888AA8AB00202A0B2AE08328228A882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783367206, "uuid": "d8b3d231-104a-4ee0-9f63-a01274bae930", "value": "3:TKH4vSNMOY8toKBjIShldh:hirtLBjZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783367206, "uuid": "8df935c7-094d-4419-9107-e3e783eeb379", "value": 81, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783367206, "uuid": "062a6721-fab4-4c64-b239-2c0ae31556be", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783367206, "uuid": "d1671bb1-40eb-40ac-a753-44d1852b0eb5", "value": "cf284583db104e7032876733467e77b25637a8a5d908c7b0d1582bac6c576eb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8cabf3-78dd-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783302729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783302729, "uuid": "60217a94-48e5-47a4-960d-05b350f051b8", "comment": "Malware payload (Efimer)", "value": "9803213d7b54b24a040ea9b0ef331810", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783302729, "uuid": "275123fd-a42a-4ff7-a31e-df0015556755", "comment": "Malware payload (Efimer)", "value": "d007c5834094b0060dcf8c7b84fa124935b3d92dcdca2917da93a9ae266d72ea", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783302729, "uuid": "269ac0a4-06c2-422f-88a1-6f91a78298dc", "comment": "Malware payload (Efimer)", "value": "d7c553c80747c8610b4903b17d375922ac32b4fe", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783302729, "uuid": "de659d5a-2c74-4c57-b225-38d2e4c80aa5", "comment": "Malware payload (Efimer)", "value": "a668454801281b5da7c099b6ca44283d846d13bfdb9842b5d3848e41cc2f2e2b309f85471588ef770286958e8061d9fe", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783302729, "uuid": "55ca532a-a807-4c03-80c0-d689c7a56c06", "value": "T187E63318AAE053DEED77403DEDB156D8F1B934AA0F32C6DB179083A26D532E04E39752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783302729, "uuid": "79439ccc-c935-4ef3-9dd5-79cb403e80e0", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783302729, "uuid": "0d1028ab-92e5-4a38-b751-4b3669015e3a", "value": "393216:fk3B7hFv+8CYBPJnecacXMCHWUjXicuI3/PGTAI:fkVhzJBP4cXMb8XfH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783302729, "uuid": "e8909c70-7cff-4977-9ae7-e9f215b15666", "value": 14321630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783302729, "uuid": "32b899c9-f700-4f6f-8399-d4c1d8c6276d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783302729, "uuid": "efe59a6f-d8b7-442f-995e-a2e158a409f5", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcbee94e-7926-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783334324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783334324, "uuid": "32d47f04-128e-4093-a024-e0c9e7b17ca4", "comment": "Malware payload", "value": "af45331d40f54192d9d20c05ae99d981", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783334324, "uuid": "ddfe5d8d-00d8-4dee-9eb4-f5a27c736b7c", "comment": "Malware payload", "value": "d19b4ef16558743c48200f86d123685e529dff63facc6038902eccfad711deba", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783334324, "uuid": "6aade31c-5118-4d8b-ba20-9da5436bd455", "comment": "Malware payload", "value": "576564d6ff5bd14534e1ba2fa345a889f2cfc6db", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783334324, "uuid": "4ab6484b-8370-40d3-a835-c092f867dc07", "comment": "Malware payload", "value": "0122e8d27a7a22d11740d4420f16dd0a895a789da606f15337030bb4074b47eac6c9f68ea6634df897119814a350f1dc", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783334324, "uuid": "83b3ae4f-4463-4309-946f-cd74e2a0f597", "value": "T1BD45339A41A53833BD1C527E8D82E7CE07D399637FF72562C90ACCA50118BB176D0F6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783334324, "uuid": "153e62a8-2d43-45c4-b49e-ecac9b69b2a0", "value": "48:jA6RN1Ef8Nna6EkMVr2m2rHvP2T8PEfJnglouQpg8epEekv/YulpuQUXuQvvPrXG:jA6RvdMtwG87OHCcCQkAsKNdzs6d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783334324, "uuid": "48267a56-9e39-4f0b-8861-edeff92477ab", "value": 1236729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783334324, "uuid": "92d6a28e-7532-47be-baa8-e57baa011616", "value": "text/csv", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783334324, "uuid": "07c383dd-1c5a-4bf3-92b7-c5f81dd7e82b", "value": "1064-3L50050098CR807.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a7909cc-7967-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783361942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783361942, "uuid": "3d46e3b0-8084-427d-be4a-dc294783764e", "comment": "Malware payload", "value": "f6809c0692264567e908229ea3808bab", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783361942, "uuid": "2be5bfa5-e31a-4ed5-8df7-bf37f5252b33", "comment": "Malware payload", "value": "d28d0c1386d7ee295987c0953173907e876b0af8092897d96aa19b7327940ed7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783361942, "uuid": "f189493e-a8f6-4a30-b516-bfe08a154d24", "comment": "Malware payload", "value": "b8994c22edd60231925aa0d02c979916ac6997d7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783361942, "uuid": "cf5af139-2cd7-493d-951b-0d6365bbdbde", "comment": "Malware payload", "value": "f36f1ee5a8c634278eb977fb800f2eb6ba51870d9a973cda76207994a73588ea97fe81277da046336d3e044351cc4682", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783361942, "uuid": "b4d54a77-df63-43b4-98d6-a721ec22d691", "value": "T1FB1413754BF183BDE62382B139C134D9BF48E392C641990A766081666B03DFD7C8DB6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783361942, "uuid": "ba20920b-5e0b-4f14-91a0-801188662448", "value": "6144:84lT9HHKd3K2UabjnVDm6CEGw5uB75/f2:ZlTc1UaPnVC6HDuZw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783361942, "uuid": "a4976a51-5249-4f0a-b009-ebd05ed57cc9", "value": 200673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783361942, "uuid": "18cd426a-fd71-433f-8d72-fcc7dc7213c3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783361942, "uuid": "bd94f940-c2dc-409a-aefa-5afc118327b4", "value": "wishlist_P067939.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154d5d65-791d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783330124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330124, "uuid": "4730dd44-f2bd-4e8d-af2d-818259df75e3", "comment": "Malware payload (Mirai)", "value": "4dbcddb99563920d1ade2f464979e07e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330124, "uuid": "4de6ee49-2551-4139-8377-8f82d2a18602", "comment": "Malware payload (Mirai)", "value": "d3b3023bd463e36454d6ddc46c09a4e53e4fe9e8f8af8b5c0a4fcd9043771fe2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330124, "uuid": "69baa6a8-631d-4cc9-b298-3abc64e92a96", "comment": "Malware payload (Mirai)", "value": "98c0154b4460311ca8355f8cd72260ca3f341a60", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330124, "uuid": "6d77de83-042f-4304-89bb-f6ae500ceb5f", "comment": "Malware payload (Mirai)", "value": "f26dfe4ef57db4d9cf698f7dcf6c5be3abee8b8c1687d17fde18971ed4a4826a1a4b447c682a5f2ad0a86536f5881230", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330124, "uuid": "c1c6912c-cd4b-4831-a10d-9c4aa9ce4f3e", "value": "T156D32A06730C0A47D2632EB43A3F67E193AF9AC121E4F640355FAB8A95B1E335586DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330124, "uuid": "2aab78ab-4fdd-4dd9-95db-d5dd3cbaa14a", "value": "1536:troGHNTUZND5IBUiCxfytKteQQvhDajwso7lbEJvAhh3rp+JuQfqAE87enJ:3mmUiCxRteKwF7lLhrManJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783330124, "uuid": "3a63a7ee-98d6-4fbd-a793-da40fbc9fde5", "value": 134036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783330124, "uuid": "b5cf094f-14a3-42b8-8cab-9978673bbc54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330124, "uuid": "b48ec37d-e981-4aa5-abc3-f226ffd79e15", "value": "main_ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ac4171-78ee-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783310015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783310015, "uuid": "2c7122d8-d650-4f65-8894-7f0b0614e8c1", "comment": "Malware payload", "value": "2ed12e21e8e64fda217ed6af079e35cc", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783310015, "uuid": "c7f18771-9686-4502-99ad-025968a0cd61", "comment": "Malware payload", "value": "d70686e8512c344d9a840869be34fe60311051cc5f36c47131e2eb402990f5ec", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783310015, "uuid": "e9268a5d-d34b-4cd1-9400-59b4ad4e5d53", "comment": "Malware payload", "value": "038c6785b4ac004424dec0e88e999562c78c57df", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783310015, "uuid": "e8c8bcc3-25a7-4e92-9f98-89e3bd6f955a", "comment": "Malware payload", "value": "979f735907a0b86f788ea7f6aa610d4d6b4d4a7cfae00f4cedebea3c44f33bcf29309351214647a76652f60b2f63b78e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783310015, "uuid": "c8d06ec5-1865-4b86-a3d1-8541c051137e", "value": "T11B21C4DC2A6031391428CD6931894F0E79C395EBA8A20F982F2C30B373B8E54F854E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783310015, "uuid": "6344a050-3c3d-4ef9-8dd1-db491c9d1667", "value": "24:0ygLYSfhyQWLYQIQ7yhNIxLYc/yNLY7KwwfG9UY1h4fWklfKToAP9daA9Mi+7p1n:0d3hCHL1wUS+9UKh4fWklCEAP9dV9Miy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783310015, "uuid": "ac99d520-fcd3-4696-9f49-f044e91cb5e3", "value": 1182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783310015, "uuid": "a2ed0b09-2b33-46ad-8055-8691745c7d42", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783310015, "uuid": "0720fe6d-5c58-4eca-a7e1-bb287f0851ee", "value": "w", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88c24c8-790b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783322640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783322640, "uuid": "cb8ab5c9-b0e0-49f4-b40d-05e7c8ca923f", "comment": "Malware payload (RemcosRAT)", "value": "817c2e9dfef35b8f970d18c0a1019440", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783322640, "uuid": "0bae47de-38bd-4062-b0cf-84287bf3743e", "comment": "Malware payload (RemcosRAT)", "value": "d81d50ec4e9c4c9706134fad084ae169943a374ba9c587ebff22c1e952e50ad1", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783322640, "uuid": "6c9dce75-0455-41a0-8094-280c217e6573", "comment": "Malware payload (RemcosRAT)", "value": "cb06d81094af7d0cde044e98bf0bc5591f2f1069", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783322640, "uuid": "87229b01-4af1-40cb-8ba2-340a5182733c", "comment": "Malware payload (RemcosRAT)", "value": "ff0eb9ce2b28914dfc526685087536a92962273139854997c2c7a586f8fcb5b38b14bc3ed45254e4fefec465b3508db0", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783322640, "uuid": "cf931676-9925-474e-bf9c-e0e2befbc0aa", "value": "T11F132A31CDD107BA0E4307B9AD553964D4FC876D413381ECAE6D722A141A2BCBB3B6AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783322640, "uuid": "64bdc477-b8e5-4209-a261-d2a84816f7b3", "value": "768:56+RuJb2ZjbzcjEIhkxOb4imRkOU7aF/X7sTbPaVrlSXURPVLIrOS/:57wpUuhieE6OOaFzplYXWVUyS/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783322640, "uuid": "51b9d354-8ea2-4adf-95bb-497d3dbfc1f6", "value": 44675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783322640, "uuid": "3935308f-860d-4324-906a-750e95e8d6b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783322640, "uuid": "79e27e82-d47a-4aca-967c-195390dbd752", "value": "Folliklers228.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd5576c-794c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783350296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783350296, "uuid": "ff38b41d-852a-4db5-9f62-2abaec945d05", "comment": "Malware payload (Mirai)", "value": "8660b81ec9cf689a82490ddef97bb8b8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783350296, "uuid": "f3981d41-9b69-4cb2-aebc-464437f6861f", "comment": "Malware payload (Mirai)", "value": "d8aac66db728aab1f449af160b6c5ea5a340b75e51af2a898f25b9cc8a7d06cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783350296, "uuid": "fca98900-5890-432f-85c7-6978d776491d", "comment": "Malware payload (Mirai)", "value": "9ab5056526d286e2a266fbb48b6bf8d0c1742dde", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783350296, "uuid": "e1ef3282-2e75-41ec-b265-c2cc5ddd79d9", "comment": "Malware payload (Mirai)", "value": "b8a4956b1be0ddd7c29120b4d7db7404dab735a34b132f4012a82969320241208b29078a4b560174eef3f4032e3a77c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783350296, "uuid": "71510ad3-8cd2-4fa6-a130-1dc37a5b2b45", "value": "T1C713F19271A802BDECF6803E49DF724B5460E5B9D80113B89DFA306695F27983371795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783350296, "uuid": "e47a22f2-3933-48b9-b211-587baa15daab", "value": "768:NZqM4o73Kh2eMfaDN0pgDMRdETOg1yDlZJ7TzpD9vK2MOoBUxRPl9shZJfWa7Znn:jqHWaAeMfisFRGagaXzpRy2MOPxRjyW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783350296, "uuid": "39e914c6-7935-4bfb-81b0-373d677aef85", "value": 43880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783350296, "uuid": "b669ed20-347a-4c27-bbbe-7333bb2173d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783350296, "uuid": "89c09f3a-9dd0-4d0c-a987-ce9ea412d9f3", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe13095-7929-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783335665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335665, "uuid": "8a74c2c8-aaeb-4f0e-8198-a3ba62c98183", "comment": "Malware payload (Mirai)", "value": "83e2de2fe3ab20a741a29e153b8ce32f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335665, "uuid": "1c0f3989-1e1c-45c8-89a0-9e89c8f20917", "comment": "Malware payload (Mirai)", "value": "d8cd1d9f8c092aa4a6c1b1b2b97c7de71d55c2af8332532d2956e4f5becac17e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335665, "uuid": "2d5ada7f-7f5b-46de-8904-377dc05e3acd", "comment": "Malware payload (Mirai)", "value": "d2555898958be7ba1d484cf1c46c4da3ed51badc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335665, "uuid": "fa8d289b-0a9f-4019-bb1c-2d47f868fe33", "comment": "Malware payload (Mirai)", "value": "b36dbe1dbf777a6e4864d170d5f233cfac4dddd6aeafdc8592118f687200b3bae93ac0b7e6841488f67d6b2b9c5c69c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335665, "uuid": "bfc6458b-da5a-4c9e-b034-8700c8a99017", "value": "T100E30845FC518B16C6C662BBFF4E428D772A5768D3EE320399256F20378B96B0E3B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335665, "uuid": "cc0885b5-9c9d-4840-a799-09223ea2507b", "value": "3072:3OtstuCDxzd9TOBDZf9Qq94cZwiSXUtgKh8J7/8ZMEhlf:3+stuCDxzd9qFfDCcZwiAUtgKqJIZHht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783335665, "uuid": "6f95c147-97f8-4e59-b824-868bdcaba5ba", "value": 154360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783335665, "uuid": "a3b1615a-30ea-40c7-8933-0d29b53a7584", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335665, "uuid": "20bb369e-1d38-4b61-bc4e-0d8f9a81c326", "value": "iran.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de99f7b-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783364954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364954, "uuid": "3cbb40b0-e47f-41af-8ec7-70713e8df677", "comment": "Malware payload (Mirai)", "value": "5b675d0bd6ddf42a2d9259a67ba66e32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364954, "uuid": "cefa6255-9450-4f41-8289-c96a6412d3f5", "comment": "Malware payload (Mirai)", "value": "da8595d1467da72c1f2e120420ab91e4a06d6cd065cbead1c9ce3a4d28011494", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364954, "uuid": "4947f1c8-efd0-4e44-8aa5-1a3cf528d9ea", "comment": "Malware payload (Mirai)", "value": "e4f6516a830f4b52c4048d9567af4d9574c5d944", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364954, "uuid": "917b5210-034b-4503-9f2c-a042c9f8cc81", "comment": "Malware payload (Mirai)", "value": "c3a10901c6c7a0a3b3c98cc01771af2e3f60353f0272beb291701c5359ccef45fd2509229e24274972065cdc74ee21ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364954, "uuid": "502c54b8-60d1-42a9-9e70-7701846f3231", "value": "T13E92D0C5629B0276CC2DD237B25F81D794F6F98C52CC738416939DA9D88A83ECB6C64C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364954, "uuid": "cd9642ee-b4ed-4314-8c7b-05a1b1871034", "value": "384:ME2VapcuS61t2ce5NTzgWx4ggLgRAt9zDUoH7UB9u6+v1Rn:wQvKP5NPR6v0ifPUoIB2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364954, "uuid": "72a86956-3341-45cf-87da-f78d7660f8fb", "value": 21128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364954, "uuid": "d52d7741-a222-4548-b0a2-47b7e3a11220", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364954, "uuid": "9be151ef-e71b-4356-a366-0c7f4dee22ec", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24521778-7961-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783359355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783359355, "uuid": "440cb039-b9ec-4e23-9b2b-eff1fa35dfaf", "comment": "Malware payload", "value": "62726772aa43545899af2c7d8dbd565d", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783359355, "uuid": "0e89dcf1-4982-488b-8f75-233ccfdd6c36", "comment": "Malware payload", "value": "db023a90f2815b9ae7200d024ed8c75b3fa219104b26e2a30da0767721773615", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783359355, "uuid": "e5d06c23-bbd6-45de-ab30-b9ba70ee20bd", "comment": "Malware payload", "value": "1404097e55127638994014cb7790066a6a88681b", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783359355, "uuid": "38d50dd1-accf-442e-8334-e2bc569e5746", "comment": "Malware payload", "value": "886faddb4a98f33b63b73f5f7700ebbd289100e423f6312ce2d9c988564909b55d264ea2f6113f75328848fc954d98c5", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783359355, "uuid": "bd3a04c4-80ef-4643-ab7d-3b701ecbd84a", "value": "T17CF7332C87F9A29FE97E5CFC11B0D6B3EA2C24295F2C38575EE83961703301905796DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783359355, "uuid": "ede81846-bee5-439b-a158-99b1f7c7aefe", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783359355, "uuid": "ee325b9b-9aea-4bb0-9f3a-127880d863b4", "value": "1572864:6t9IKPYYCelYdeTqowzKYypCPRfYLgRLlPBnU6InslAvy1HyA/7:6UK5CelYHoyKYyuB/5PU6InsgwyA/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783359355, "uuid": "bc033e4e-98e8-4fb2-87c8-97e31e0a1230", "value": 75302484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783359355, "uuid": "23c2634e-a86b-4d81-84f5-39627b2c8c35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783359355, "uuid": "5c0392c4-3364-4e08-a0d7-ed77a9149a7e", "value": "ecore-release.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6260568-7965-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783361291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783361291, "uuid": "0dbe0f46-850b-43ac-b355-a99a3891ed88", "comment": "Malware payload (Mirai)", "value": "6e4ae59985e32e1f4c8eee0d44f484bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783361291, "uuid": "431cfe90-1ca5-45f9-95a3-bd61c392efd5", "comment": "Malware payload (Mirai)", "value": "dcb41da443b9e8dfea70780196b9d36ade0079ea8b048792a9a74bfde8de3bd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783361291, "uuid": "67070463-d3f6-4b36-96fa-fb1f4382b773", "comment": "Malware payload (Mirai)", "value": "e0b8be2986ce7f4eb4a6a066fdbf92ce864294f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783361291, "uuid": "d84d544c-60a9-4b2b-b1fe-c7e02e0161de", "comment": "Malware payload (Mirai)", "value": "1fae320ae69fe5d2daa71947e80b962b9b6277e491f7482b8c4f7deabf09a9ab26ad06f97911ca6cb50352601ca73419", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783361291, "uuid": "8944d708-f4e0-458a-a840-74bde252dbb3", "value": "T176256D5AF2B370FCD027D030439BDB62A83AF47501216E7B65C4DA352D66EA01B29F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783361291, "uuid": "0034cd5e-e96f-46a2-94a2-f164106b5587", "value": "12288:pZ+iQJzYALzjf51mXryImU5vEXEWWmy9x4++L975k:pZ+iQJvzjfbMrHmScXlN+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783361291, "uuid": "fb76e42b-020f-4723-8f92-8004e2feb1fa", "value": 1033120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783361291, "uuid": "210b4ee6-f5dc-460e-abfa-b27802d7782d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783361291, "uuid": "35e2a484-4009-4d94-83cb-89667db90e61", "value": "dcb41da443b9e8dfea70780196b9d36ade0079ea8b048792a9a74bfde8de3bd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe29d405-7948-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783348983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348983, "uuid": "3b77778f-cbb7-4330-a2d2-c1efac0f7426", "comment": "Malware payload (Mirai)", "value": "7e8f197692eac5d2666a83b145872c22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348983, "uuid": "991b2506-ec5b-4fd9-954f-d79f35957f11", "comment": "Malware payload (Mirai)", "value": "dd5b9b0f440c24e2c573c8912fb3785874dbf680a2f1067391806ff93b5c1439", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348983, "uuid": "58141091-c003-4380-8a12-83a2b1a6ee14", "comment": "Malware payload (Mirai)", "value": "988415ce225dcb58d945eaecf604c2e6feb2bdaa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348983, "uuid": "c325387f-b986-4ce9-bf6f-22e636ca4335", "comment": "Malware payload (Mirai)", "value": "41aabf2b0591d6020e0756f9ba4bd72614890f1dcd969f924e95bd693437d1d0421df85627587a9dc8c7f00dd2153561", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348983, "uuid": "0a4f9b5c-d072-4ada-90b5-eb1b2c41c4cb", "value": "T1E203F882B8935A77C5E0237AAA7F568D73A563E8C2DF7727C9210B007B8651F0D23B45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348983, "uuid": "02f45055-5823-4487-9bf1-e9278a6b10b3", "value": "768:5nZRTWTbYuzXC3kG5N94SUs7PvPe+Hqaicz1:5fT+flG5Na1srPe+fiC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348983, "uuid": "45983f9e-f2d1-4123-84ea-3afa93adc7cc", "value": 38408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348983, "uuid": "7edc7fda-6e64-4dbe-b906-6e4e35c12fd4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348983, "uuid": "c45c5f63-bee1-4386-a4fb-4f0445663990", "value": "atomic.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab38b3d9-7952-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783353139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783353139, "uuid": "4b1947eb-e09c-4fc9-b854-9da2f910f27f", "comment": "Malware payload", "value": "b3a63eac7420e7c2747976d7915362cc", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proxy-fluxautomation-cc", "colour": "#9DEFC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783353139, "uuid": "fb5a823a-df19-4cc0-81f2-cbfece5078e4", "comment": "Malware payload", "value": "de13fc09ba8a1213989f6cf30e6612d7f8bfe939fa02d2ea12f15a631d696525", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proxy-fluxautomation-cc", "colour": "#9DEFC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783353139, "uuid": "114c9ffc-4ca5-4b2c-953a-2f1665b1dc5d", "comment": "Malware payload", "value": "02a74fdd2730411ca5451a0d8ee10780fb0e30d0", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proxy-fluxautomation-cc", "colour": "#9DEFC9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783353139, "uuid": "06877199-40a6-48b7-a38b-fa3f885caa82", "comment": "Malware payload", "value": "4f57d1ce196e060aac31e1e025c0df74b2bbab76e7627c289564f5f9e1a08a3608ec38ff1ab9bd701856d4093c42de7c", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "proxy-fluxautomation-cc", "colour": "#9DEFC9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783353139, "uuid": "a4e73899-8c1d-42cd-9572-5851405b4b86", "value": "T17C256CB905CDB991E4AEF4F905223E3E9229BCC611F963F716631126B27C48D0B1AF74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783353139, "uuid": "f742942d-1f70-47bd-be6b-3f4a9ace4aaa", "value": "24576:L8+3pGIu4jGkf7hWVFm+wQWpdDM4qRWQj0W3sO/:lJRf7h2rAtqRWBqsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783353139, "uuid": "5df6624f-4175-4ee1-8bee-1a45c1f564aa", "value": 978072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783353139, "uuid": "2420c3f8-a8e2-47fe-8468-28e2f6d482b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783353139, "uuid": "70732dca-c9df-4884-93b2-d4b7c8a42c36", "value": "QuickFetch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0724e0-7907-11f1-ac1e-42010a9c0009", "comment": "Malware payload (PureRAT)", "timestamp": 1783320690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783320690, "uuid": "cb8598bb-defc-406e-8771-e1dfa95836fe", "comment": "Malware payload (PureRAT)", "value": "3777e8df07bbd61e68de044a57563fb8", "object_relation": "md5", "Tag": [ { "name": "5-101-81-210", "colour": "#426F21", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783320690, "uuid": "e0d6fdb3-7fd0-4f16-998b-54b218ffb669", "comment": "Malware payload (PureRAT)", "value": "df012b61ba220a13b7da5616a48f5ad422800c7bf6ac5b098343cb04e9c67fff", "object_relation": "sha256", "Tag": [ { "name": "5-101-81-210", "colour": "#426F21", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783320690, "uuid": "0b6f300c-615b-46ea-b412-14ce8df01579", "comment": "Malware payload (PureRAT)", "value": "98b68f324c85306715b41e7d18d8b60cdd2cf09d", "object_relation": "sha1", "Tag": [ { "name": "5-101-81-210", "colour": "#426F21", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783320690, "uuid": "839affb5-44cd-409a-a077-722a0b66e324", "comment": "Malware payload (PureRAT)", "value": "06856418e470cc146e0c7aac81f59492a6562e2b735323fcd2ab1c4d6f8690801950c478291dd085d7fcdffc630d6909", "object_relation": "sha3-384", "Tag": [ { "name": "5-101-81-210", "colour": "#426F21", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureRAT", "colour": "#269226", "exportable": true, "hide_tag": false }, { "name": "solar-sanat-net", "colour": "#3D903E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783320690, "uuid": "bd725b3a-8cd5-4509-87a1-f3994c4a5de7", "value": "T1EF05AE2732664E20D1881237D1E7144183F66A87B977F31F768467A62C033FEDE866A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783320690, "uuid": "094875ba-d16b-422c-accb-75c3bdcbe92d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783320690, "uuid": "89364141-067f-46f6-b3e0-3b462422c81e", "value": "12288:MgxMt9RVpL36nkt4B8iXtklW7QxmF2tVap6wunBR4/MRlclq1Jjl1:GbLKnkI8sooQWPunyClRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783320690, "uuid": "cebe19e6-ba06-4a7b-934c-a2e5c5d20d9a", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783320690, "uuid": "858fff37-7eab-4e32-86dc-e2b58592bad5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783320690, "uuid": "e1ba48dd-a37d-4ca5-8ef0-ed8fa129903a", "value": "00231.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2864930d-7945-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783347336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783347336, "uuid": "d3c62032-94c1-4c92-af28-f06f37ec3030", "comment": "Malware payload (RemcosRAT)", "value": "451752995564964160b9a762ab13ed29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783347336, "uuid": "aa7ae2c8-9080-4c4a-8c35-8c775689a33d", "comment": "Malware payload (RemcosRAT)", "value": "df42728a561dd9bdef18a9d5e8f3795137ace647bbcfda68fc2108c1372fe5e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783347336, "uuid": "0c1d22cf-66d0-470b-a713-b45212e2553d", "comment": "Malware payload (RemcosRAT)", "value": "85ae553ede2681c17f5722aa7b62c726cfb082b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783347336, "uuid": "508a14d9-a812-4c95-b1f3-fdded99884cf", "comment": "Malware payload (RemcosRAT)", "value": "4f91d1ba9b24192b595d1091aa4628a93bf6e31a6486d6d3a5108d59fb9f95014584edacede99b0385e383b3650fd449", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783347336, "uuid": "53828607-cff6-4797-944b-ef2247f2718c", "value": "T1A25512085798D903C42E57B86474D2B81B786E69F912E3171EE8BEEFBD777228C10187", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783347336, "uuid": "53ac2a82-346a-4804-b852-2ed69481b1c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783347336, "uuid": "9b6c6ffd-8f3c-422f-b78e-fa5fedd84f7b", "value": "24576:RASvV0L6O3AozfYTDbr/NLkqMItNOEqu7OTXzQ37aIhvx+RgqvH:RASN0LlcT/jpSIfPn3p1x+K0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783347336, "uuid": "5324175a-0cf6-4014-80a5-354e6ca713f8", "value": 1403392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783347336, "uuid": "c33f8598-894d-4398-9373-7badc8d61e56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783347336, "uuid": "537623a8-1979-43e5-8941-6aef8f42c9f8", "value": "103_FT26187MJC6J_12220260706CBAFKENXXXX0706130123-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d73f14-7973-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783367417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367417, "uuid": "0d0f2454-0dbc-446b-84ff-fefe90b597ca", "comment": "Malware payload (Mirai)", "value": "edf88c7816498966c788625c9fbcb2e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367417, "uuid": "3f0486c2-94ec-419a-a269-1aca349e8b5b", "comment": "Malware payload (Mirai)", "value": "e065ef98932486261dd7fcb412521e987b0884b1e9feddf25daae2ad7a52420c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367417, "uuid": "0f816f7a-951d-4362-aaae-ac401019e6a3", "comment": "Malware payload (Mirai)", "value": "3a8a993d2feacb766eaff31161f5ec863b0260aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783367417, "uuid": "34a00f2c-cb3d-49a0-879a-e26609070092", "comment": "Malware payload (Mirai)", "value": "b0fc1b873c2ff054f07d51e0ebf9104a380d644b41a6e9c1308822b8e490e31d7d3bf532bd8ee0db98c57357940f1f7e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783367417, "uuid": "fd49eaf1-37aa-4a62-9227-692dbb805c0d", "value": "T128C35B46F792D4F3E18302331053CBA65771EA31014ACE0BF7083A759D667898E6BBAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783367417, "uuid": "e12c7b02-17aa-4263-97c6-b7b5cf2c9226", "value": "3072:1NbL8D/4ytg1xi+uU+a63iTrAo4ETlb3VGvXgWnjt5:1NbUg1xvEIAEbsvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783367417, "uuid": "c6bc08eb-72a6-485a-aa48-9fe42f1b4198", "value": 123664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783367417, "uuid": "8c2a5725-2d2c-41d8-b7be-2613ebb6e4ac", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783367417, "uuid": "7a53d638-4ebc-4bf3-9c5f-e10e6cb8cbcb", "value": "i686.ghost", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94aa0e5-796c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1783364410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364410, "uuid": "8cac83ab-958a-45d4-bb8e-3af1e1a2a691", "comment": "Malware payload (AsyncRAT)", "value": "5270fcafecaec9c59785dc8f6a316b70", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364410, "uuid": "312d6209-3326-4ea6-85a8-4d0119a2cee6", "comment": "Malware payload (AsyncRAT)", "value": "e14a32aaaa2b8610197b48e8cd566f9a913688c69dffc2666bd676a881005e43", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364410, "uuid": "a8ff7490-e0ab-4a12-981b-1bdb132e52e9", "comment": "Malware payload (AsyncRAT)", "value": "fb25d459e5c5d4582b7457e714b9fbec32da7476", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364410, "uuid": "ee2c3fb5-2f28-43a7-8dcb-9571d9f1b65a", "comment": "Malware payload (AsyncRAT)", "value": "9e068fe911d57c78ea9c45733b103f9cda2c5e2b3f0a4a38daac25de3e12abec73fe906798e0a2180581c3e797f0dba8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364410, "uuid": "904d1002-a50a-4843-89a2-0d86a634b817", "value": "T13094F1023710D66AC8EA9A3B8C4B97E64B50FD585B509F177364BB3F3DF26019A0E385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364410, "uuid": "cb6e6db7-b89b-490e-bb7a-7d0dc2174433", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364410, "uuid": "e60db0f5-ad70-424b-bd75-8272bb1ed633", "value": "6144:k6bAcJuMn7pb+YwPk54PCHuh46MPnoEw6uVWcH+v8w5lVenN:rbNKu4PCHuhOLuTZw5lVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364410, "uuid": "17dbb6fe-1ee4-4233-ab0d-bd4b544ffe6e", "value": 417192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364410, "uuid": "55598af4-df0e-4494-8fea-69ddc93a0644", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364410, "uuid": "f861ea5e-dbab-4cb0-9404-5f58fcb2e348", "value": "z61FAC8770987654567890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b662a81b-793c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Formbook)", "timestamp": 1783343709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343709, "uuid": "83f2b1a4-27f2-4477-ab2b-824392a46dc5", "comment": "Malware payload (Formbook)", "value": "313e45cf274c709143e3803e7ee222c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343709, "uuid": "e1e434a0-d754-46c4-9b1a-c96cac242251", "comment": "Malware payload (Formbook)", "value": "e29156986137877f199fadf905f7fd2ede4d261982f591001712f3c734dff621", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343709, "uuid": "0a254cc6-7890-42e3-b4b9-8d18c57d0404", "comment": "Malware payload (Formbook)", "value": "080a9a23bea0b86fba98febf147bb5a5e6e43d2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343709, "uuid": "adc4f641-1f30-4766-ae1a-afa023c08c23", "comment": "Malware payload (Formbook)", "value": "4e7b2e9468de5f39ead184af9e3659c794efd97c2a15bf6edadc9a46f283b17ceb8adaa5e6041d3e7761f7cf14b3b53c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783343709, "uuid": "c0a1a59b-56c0-4f8b-abcf-954c72414a1f", "value": "T17C4533111F334F260CEC9579356B8D9D1B3567D6884CE2FA42FCB5C9A74A680407B8BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783343709, "uuid": "eebe7e1b-38e7-4d86-93f4-77c7229979bd", "value": "24576:FrvVQ/jhZ/lD+3eH/9cAxTn98W7FD5boDizPUrW6LDMJqJX74xQXeXdJci7jc:/Q9ba4WwCHLlkiszci74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783343709, "uuid": "98642261-30b0-4844-9634-da3d1eac4cc4", "value": 1278543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783343709, "uuid": "00713ad7-be50-4d16-a1aa-fffa47b7ed93", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783343709, "uuid": "59c2bb52-482b-43c7-ad4b-5e99f1b776e6", "value": "Literature Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a083dc-7994-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783381285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783381285, "uuid": "0c58d955-2313-423b-a539-5a4e5a1c6c66", "comment": "Malware payload (AgentTesla)", "value": "e97a23b000d8b8955f1fdbf1d7576675", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783381285, "uuid": "49c0dca5-3f16-46d5-b619-4a4b2e396200", "comment": "Malware payload (AgentTesla)", "value": "e3070290906a9eda5855e73545e4a349e3db06a6be3479e46ec19b26dd073c33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783381285, "uuid": "06d0c21b-e613-4a5e-b8bb-7312a4ecf943", "comment": "Malware payload (AgentTesla)", "value": "7c9000955642ce7a1f2aa06bc053ad4aa9a8e461", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783381285, "uuid": "40022951-1341-4f27-84c9-d3a6fbabfc89", "comment": "Malware payload (AgentTesla)", "value": "140a0b9a4ae6bcec32de06da10eee8a51750b69d7301f17d2240d251d01a6477bbd26cac49f2405eaefebd4451d704fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783381285, "uuid": "a0d04228-adbc-4057-a870-c2e6ca36cd75", "value": "T1F93501446B5CDE02C1AA177464B4E2380B786E5AF910E3171FD4BDEB7DBBB128C1528B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783381285, "uuid": "9c8f85bc-dc3e-4a04-a078-7a67eff399de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783381285, "uuid": "b604f4e6-6f19-4513-89aa-5815251fbb2d", "value": "24576:PAfvV0LAfT29SgkZFtcopU74g4aT2sJN6Nsslyv:PAfN0LAr29bklcoDXTsJNwsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783381285, "uuid": "c65d3075-e23e-4075-b6ae-1f504d3704d9", "value": 1115648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783381285, "uuid": "bb968d9d-4e69-4099-8ef2-16536fcb6c7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783381285, "uuid": "0a01a722-d7cc-469e-824c-3d0deb50ba35", "value": "Muestra y especificaciones del producto.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77054435-793c-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1783343602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343602, "uuid": "11658275-6490-4b74-a242-477b6212ae84", "comment": "Malware payload (Prometei)", "value": "689f24447e67e8aef41c362fb55af598", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343602, "uuid": "7b890c0b-686d-41fe-9fdc-86e4dc357afe", "comment": "Malware payload (Prometei)", "value": "e34fe7837e6b02396e7996369c790ca1ca23be9983d449dddecb235339d91833", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343602, "uuid": "44b8a758-9532-4752-b421-d2eb88b5ebde", "comment": "Malware payload (Prometei)", "value": "6d95a47537b553f9fbf65a8aaa75d15146d1bd4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783343602, "uuid": "091c54a1-a1b7-43ed-ad3a-637037ec1f59", "comment": "Malware payload (Prometei)", "value": "1a8431b8ae636f96b643247d7afa92e6a24c1bcb35ec085337d9991bc12a85b044214ceabed017c2cb9875f486c273d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783343602, "uuid": "9a5817cc-18c5-4605-a30d-5ad8108f5b87", "value": "T105A423B4F9219E8F6DD769B91B24C31DE182C172589D4C2313AE94A34F3D732AF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783343602, "uuid": "74efc551-43ed-4acd-b496-e2ead63b6353", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdg:Fs6pyCC/Ya2hpi6T6N4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783343602, "uuid": "c1cc4483-e1da-4b39-a8b0-9f7362f57385", "value": 449085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783343602, "uuid": "849d2e84-65de-45e5-82fd-bcf0214ee8d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783343602, "uuid": "5c9dc7c6-60ad-428c-9a09-112e407ae385", "value": "e34fe7837e6b02396e7996369c790ca1ca23be9983d449dddecb235339d91833", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bbed2d2-7920-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783331531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331531, "uuid": "7373fda0-d496-4268-a970-7ad1de6ff563", "comment": "Malware payload (Efimer)", "value": "19efa701546dd30fefa3f452063b2a88", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331531, "uuid": "871528b0-7863-4829-97dc-4dbedc33424e", "comment": "Malware payload (Efimer)", "value": "e3574240bdd79cb8b2fd5d3b936bba9ff4f883df38f07711af8df2ac0cce1a64", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331531, "uuid": "0094b17c-4bad-49c9-83f0-72a92485f955", "comment": "Malware payload (Efimer)", "value": "0f3537c8058607f9d33849ab321880d450b8fe12", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331531, "uuid": "3ccf4e90-583f-4a9d-9a85-369a15ad3ad5", "comment": "Malware payload (Efimer)", "value": "bfb024eba5a0bb77e97df4974f54363f1bb65e36ae339c9641ce71cdd15cd5354a219fd68feb582e2b05505cce3f4224", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331531, "uuid": "266d0721-616b-4219-aab2-35be5500f7a7", "value": "T1D8E63358BAE112FFFCA3413CDAA0464AD4A5786A5736C88F17A053FA6E031E15D7E343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331531, "uuid": "eb4e5660-db01-4012-bfc6-8e54f6faa42d", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331531, "uuid": "da9f90de-d9b4-4a51-9a21-cdc2a6a9a9ec", "value": "393216:omhOlmxL2Ovdd4bgROSlxbXMCHWUjX9cuI3/PGTAI:omOWL2wsbgVlxbXMb8XKH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783331531, "uuid": "8a5e3a41-a9ed-4740-9d3f-842e088e8d1a", "value": 14261545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783331531, "uuid": "0806ab23-4eec-4836-8ebc-b6c73cba2b0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331531, "uuid": "9cea40cd-3a1b-4d1e-8767-fdb7a96ce6c3", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94601af6-7920-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783331626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331626, "uuid": "e2b1e5e0-a8df-4871-a4db-1968bd92784b", "comment": "Malware payload (Vidar)", "value": "88136d0f1895e9e4788e43a3279d9cc3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331626, "uuid": "f01af4fb-b43e-4003-b4ea-dc1fd28a5d8f", "comment": "Malware payload (Vidar)", "value": "e438003e81399afda1a4801bdd3d347a757c2068c4dbbaa99d4f554972c546f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331626, "uuid": "bb66f09c-d926-4979-82b9-3e55709015bb", "comment": "Malware payload (Vidar)", "value": "15f77ec84529bac93e5e400113c146dc2b9a89ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783331626, "uuid": "8a901e5c-edbb-4daf-802e-cfaca12622e0", "comment": "Malware payload (Vidar)", "value": "07e541532c709f8fa8e7946b6a2878b7442c059207668f14d7cd1aefad16661c54b2d9af7326fb4c5cafa8867014c52c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331626, "uuid": "5706de52-d306-4bb9-a5ea-0946fe7854c7", "value": "T153D58C077CE049E9D8AA93324CB651A27B75BC190F3623D72E60B2782F767D09D36B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331626, "uuid": "516187b2-62e0-49e1-972f-52f1f1d1f650", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331626, "uuid": "0d2f7536-ff90-4070-b68c-4139b6bb692b", "value": "49152:efBvSnuJbkXxLP4LMc9iM515RcLTsLIQgzDV:efwNukcEsMQaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783331626, "uuid": "be9ce4ed-71b2-42bf-9c93-6798cade918c", "value": 2989424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783331626, "uuid": "43be2f75-99cb-482c-9342-b77e2ba4be1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783331626, "uuid": "77ed9c48-3aea-42cf-905a-9e3e924e1633", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63ff6c9-7948-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783348916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348916, "uuid": "bd39a311-1774-4d25-b337-aa65f950611a", "comment": "Malware payload (Mirai)", "value": "56de4979eb19d27e7756f5e83080f5c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348916, "uuid": "7674a59f-3856-4335-8c0a-aa9e0ae75d2c", "comment": "Malware payload (Mirai)", "value": "e442ece0002d6f6615de64a2e5a962a0cb857e63ad5c6624ee347baf507f0e0b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348916, "uuid": "3782e782-e1d5-4307-9372-5affd4d67d3b", "comment": "Malware payload (Mirai)", "value": "232660f91297975e3de314a1e718234cbbd3e25e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783348916, "uuid": "5eb38c56-477d-446c-a608-8fe651ad5859", "comment": "Malware payload (Mirai)", "value": "1945b534d7320252288c075e37e8f2bc54b1fd549ee889351fd0b9ef4ae7737357bbadba709d6d6d09db71befc3ffd97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348916, "uuid": "1c953f8d-0926-46bb-82da-22cc8b6924ad", "value": "T17903F1D2CBD60054E5BC04B296FBB25FACD1F84B1218E0739A9017538B9FB717AE0882", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348916, "uuid": "23cee204-5561-42e2-b0ea-f97a62ce9a28", "value": "768:r6Tt//YlmGHYsNnfHX+zYqQaKLyhRPlHTBVShoEPEtmFIwu3hQIKWnbcuyD7UtQU:w1/YllfwYqQaQyhvzbQ3P1hChcWnouyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783348916, "uuid": "7b658004-daff-46c3-8b0b-f867e39ac9ff", "value": 40744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783348916, "uuid": "b211057a-f140-4380-ab4a-acd38b2f74e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783348916, "uuid": "f7809ab4-289f-417e-83c9-d86dc5aa5d8a", "value": "atomic.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da53c2be-790f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783324441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324441, "uuid": "78e6290e-bd30-4216-a6d7-4017e8118244", "comment": "Malware payload (Vidar)", "value": "1fa80229c335e4f4bd80e8cdcd2d3c7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324441, "uuid": "c6e9ae3a-0f90-4c89-87ac-ff41581bdf3f", "comment": "Malware payload (Vidar)", "value": "e562b98bed096f568b0c87445b783f9764e05dffdfee6f52f15778da6e7f41f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324441, "uuid": "dea0c2a6-7522-4924-a01a-193b6fc12634", "comment": "Malware payload (Vidar)", "value": "0fc220f4e436ddff8e3685292b6c331a5e84ae51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324441, "uuid": "2297105e-b5fe-43ed-9314-746b02fcfab1", "comment": "Malware payload (Vidar)", "value": "8a4a8140c3266d1bb7ac2fee20db85aff600a710aa617637fcafa165a6b936aa6b8220ed4906fc656dfb9cced31cca55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324441, "uuid": "ed058547-76c6-48c6-b02f-148d61c859fb", "value": "T112F57A87BCA449E9D0AAA33189A38286BB75BC480F3123D72F50B7782F72BD05D75715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324441, "uuid": "18fdc179-d28b-417f-b9bf-6d2048a09077", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324441, "uuid": "190fe2e2-dece-4f71-8b50-44dcbcb00b4c", "value": "49152:d0juTaKlRuRFf1pilFreBuHAEhnAwl6sRgQ/3xxAcqa+0esxT5WnngCcNvJQ:d+o/AEhnaspPU9HV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783324441, "uuid": "89202e40-b588-484c-9b6d-449c26ddd10f", "value": 3340120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783324441, "uuid": "d8699b4e-8483-43eb-bf68-9139c5cbc363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324441, "uuid": "374fb698-03ea-4dcc-a95b-b3facdac4a25", "value": "1fa80229c335e4f4bd80e8cdcd2d3c7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9927cf0b-790f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783324332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324332, "uuid": "5aff596c-9fb7-4256-bf56-85ba159c0d2e", "comment": "Malware payload (Efimer)", "value": "765f552c4888ae9c4c6c12b6e7b1f5a0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324332, "uuid": "79bff26f-4243-43a7-9d2b-f9e4354c242d", "comment": "Malware payload (Efimer)", "value": "e5f6c4d827a3dd8ce5aa80fa8e2cbb5b9892d12ef1c8ff379bafaee383799bfc", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324332, "uuid": "f1a7ac58-71ae-459d-adcb-e4248732a513", "comment": "Malware payload (Efimer)", "value": "a3f93f4e53a06c13fc60eb1d35c9148e38520879", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324332, "uuid": "76bba7cf-8ce4-4901-b9c6-f02c63e0447e", "comment": "Malware payload (Efimer)", "value": "61b63f6c937c783801ff19d004d9bd771a21dbe27e2bedf2b56b509fb597e9f102766f7432405512636714d7349b5a66", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324332, "uuid": "91b75537-0a12-4d24-a4da-b0edd3fac3be", "value": "T128E6338CA9E012EEF973423CAED1A255E455707A1731C9DB07B487F16E472A08E3D727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324332, "uuid": "46c3b075-9f40-45a4-9873-6d303442fce3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324332, "uuid": "e2a448e1-9b72-4a62-9319-59885d101241", "value": "393216:JJbuALbAly1zCb3kJVzAmXMCHWUjXzcuI3/PGTAI:JNuw28cmXMb8XwH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783324332, "uuid": "20b6925c-588b-4a46-adc3-be597980471e", "value": 14266329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783324332, "uuid": "916bf2e2-7652-42c5-8147-e0544385f0b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324332, "uuid": "cfb8078e-2d1b-4c37-a64a-2663f8004671", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b527a8ea-78e4-11f1-ac1e-42010a9c0009", "comment": "Malware payload (RemcosRAT)", "timestamp": 1783305911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783305911, "uuid": "e0736e43-248c-4214-b3c5-772687c47aaf", "comment": "Malware payload (RemcosRAT)", "value": "d1fc3917c6cee3037d870a78b709dec8", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783305911, "uuid": "b1b69aec-458a-446a-8433-bec9cd79a8cf", "comment": "Malware payload (RemcosRAT)", "value": "e70340a81f494769700bcdb5ffd0a9a4fe6a34d87aefa27d725d8072965d8905", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783305911, "uuid": "856f9062-c65e-4628-8cdf-06f5062b3487", "comment": "Malware payload (RemcosRAT)", "value": "b4656594f64e03b7c904409c12b70cfc5f4f898d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783305911, "uuid": "8b118c2f-0125-473a-93d5-352df5281c1d", "comment": "Malware payload (RemcosRAT)", "value": "ea6a50c662c7ff89481bf8f63bd8353701fabe713a5322ed0c3219600435ef2de1a95341ef9351708511d21f24a19460", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783305911, "uuid": "ea716a74-148c-49f8-940a-250e02e61032", "value": "T103133B10C8C05B7D5E5743BAFE952921D4BC4739423180ECEDAD732DA40976C6B3A6BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783305911, "uuid": "a5371d4c-7456-416c-a010-bd44d5a36135", "value": "768:x6+RHjEGG1LBpMPN1Ky9Lwk3E9RK4UIUwTEOAQPlifUdRVLIZURat55:x7tjQfMH7LU9c4UBUQf8VUDP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783305911, "uuid": "d238e7d0-b0e5-4119-b3f3-7d55be5bf34a", "value": 44114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783305911, "uuid": "82c5da13-1a8c-4f0a-a8e0-730080e3ee05", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783305911, "uuid": "42fec64f-7a04-4dfc-85fa-bb4d9baacfbc", "value": "Skovflaaters.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151f69ed-790f-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783324111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324111, "uuid": "ff93e852-c7a6-4535-afdd-157e0b371d43", "comment": "Malware payload (Vidar)", "value": "d8b100e75a0820b3a0e8580b9a8d21ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324111, "uuid": "9615330f-c06e-4610-9c85-47faf90de5b1", "comment": "Malware payload (Vidar)", "value": "e88fd6587c9bd407075fd34385ee42c17e02e68e99446b011d9f83932c802db6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324111, "uuid": "7fc65658-f016-4ccd-9085-8630f30d2675", "comment": "Malware payload (Vidar)", "value": "375cbc700f808642e585204c1ce238d93bc1ed75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783324111, "uuid": "6dff83e7-97e1-4c72-9fd0-5556be49db6f", "comment": "Malware payload (Vidar)", "value": "6d1d103395e63f10a84224aee5620fd6f9a3f256d92a97a706e32a3a17e44e320f614fa8a30cb563394f62bb9ecc1999", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324111, "uuid": "fcd11333-dee2-4ccd-805b-9e9a01831ba3", "value": "T134752348674CE806D8461B380D71F97C16397E99F910C29B6FECBEAFB9727224C50792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324111, "uuid": "7b84c511-85aa-44db-a153-ff8d782fcf7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324111, "uuid": "5286e7cb-bdd9-4191-8e18-97cd3697a3f3", "value": "49152:wMda4turPGlvMLn6/UMslrF/YguzkN0L:wYvurPgvM76/I1WDk0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783324111, "uuid": "7c794313-9b8a-40be-a769-8675ae5a471d", "value": 1623040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783324111, "uuid": "7c7b66c1-6242-44a4-b72f-33668a5510a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783324111, "uuid": "27bcbca1-8536-4fb3-bd54-c1f1926594fd", "value": "5833628372719_20260706.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d20059e-7933-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783339586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339586, "uuid": "0ac21c69-bf74-44b7-9b5f-aded8af487dd", "comment": "Malware payload", "value": "094efa912a95dc30796cfb711c4907fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339586, "uuid": "7c1de1a7-6fd7-45ad-a662-ba44c6a024f1", "comment": "Malware payload", "value": "e9334fc3330e12d013ac896b8e78d85719d2beffe7206ffbd78395586d8092e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339586, "uuid": "b2d5a72f-833e-49f5-87e3-88f1d08b2662", "comment": "Malware payload", "value": "e51bfd93e03b971a0ad19e672d23a6c72aec570f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339586, "uuid": "95a3e73e-901d-418e-bff2-338b66a9afed", "comment": "Malware payload", "value": "099fbd16b4c46901bca7a9907890ecab6821049102577a1e0d748b837df5026cc975874423d6549a51c1a5b782ed54ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339586, "uuid": "8f857415-ad15-4509-9175-f32434e7335b", "value": "T1FF854D389724A119D2E3A4927CC22073AD26FFE7272CCD7671CA4749D76282C5D687CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339586, "uuid": "178f9deb-a930-450f-93c3-bdca8d51a359", "value": "12288:8IUtQKd+s37MwpjTBRmxdQ4mVQ0RwcFexpDx5J3opqJkZgFIwE:8zj2bQ4MWFzFIwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783339586, "uuid": "f50c4c83-5be7-4c8c-8176-6246bdc31522", "value": 1856086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783339586, "uuid": "bcce8cf1-728b-472a-a94c-0b49b0a1aa6b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339586, "uuid": "bff0c6a3-b6c6-4af7-a9f4-01e8887e04aa", "value": "SOA 593107480.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2bd405-7929-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783335670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335670, "uuid": "a4c656e3-0940-44f2-9972-443949233f26", "comment": "Malware payload (Mirai)", "value": "7a54b3e04e36c2f726796abe0e969203", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335670, "uuid": "74899e2f-6033-421b-9349-ac36ac7c73d3", "comment": "Malware payload (Mirai)", "value": "e987bb8b32facef51c3cc5a94bd51e01d8c3be8a19c106de70147ab5ce84dc66", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335670, "uuid": "a89e4d6c-9970-405b-9ecd-ff6df28fdb33", "comment": "Malware payload (Mirai)", "value": "5f925c87cc0b461eab85102b6ed64d71a2f7c7fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335670, "uuid": "8f90debb-39ac-4875-a038-e16ff31c208b", "comment": "Malware payload (Mirai)", "value": "78a00f8bcc3ad51f1e90db334abe06f6cbdb363a0a304bf0f8bb6088240e01dda42ad7ec4be2bc5fc08ae464355c9c1c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335670, "uuid": "b253218a-393e-4d9b-a141-b13c969ddccf", "value": "T19F24955E6A328F7DF368873447B74A35975D22D627E1DA84E2ACC1041F2434E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335670, "uuid": "9593ab37-6ed4-4d17-ac02-77a5ca70ae72", "value": "3072:sPvQqinW06qBVrDuQ5SPkCekMcJXs9op/rziM9om:swqinW06I1DA81qJQ2/r79om", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783335670, "uuid": "71c8bbad-1cef-4443-bcef-698c1e7ed436", "value": 209376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783335670, "uuid": "7e79d548-aa37-4db0-b111-99310fbb1e82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335670, "uuid": "3aa19e6b-81d5-4956-a819-6a0ad58331ec", "value": "iran.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0484ab4f-7912-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1783325371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783325371, "uuid": "dc9df961-6a09-43f2-87be-8cdc0f9e38cd", "comment": "Malware payload (AsyncRAT)", "value": "db4ed279438155a1d9d0705b306562f2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783325371, "uuid": "0454ef61-b355-42b1-b972-042c1ad74228", "comment": "Malware payload (AsyncRAT)", "value": "ea36d8066bdb8ffa534897822ace62cbee70c793c87a3edd6b411f666dd13f23", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783325371, "uuid": "7bd0a623-4255-4e54-bc24-3a9adcd64d40", "comment": "Malware payload (AsyncRAT)", "value": "b5ceb80ff1f33043068ec73a81269fbd5c4a4d55", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783325371, "uuid": "4733185a-1a97-42bd-82d7-0ca2fe742607", "comment": "Malware payload (AsyncRAT)", "value": "d3e663899dbd69c3e7ec58e7a02beb0d4e6d75e2fcd023ad5fe4d22e2a175cb479c47d91eb7c5084163e75763fcf4d89", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783325371, "uuid": "e8dceba8-b0e2-4e45-871d-7b53702429eb", "value": "T11C65027612D828448928A4285CF69715DAF381B86AE25BC87C34E1F57837C05B5B7F3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783325371, "uuid": "27a0db86-2f7d-46bd-8411-edc1678e3eb8", "value": "96:n/Lp6M3+U36SjAw8WrE/ao9zB1imSdXEzex+/V/4yS6SjC9/OnXkhzuITzbsCy7r:n/Lp6M3HIGoVqXKeF+k0hzuC2wI8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783325371, "uuid": "2e65815b-a42e-410d-b24b-14342b096643", "value": 1501333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783325371, "uuid": "d4b7c373-6458-4f2e-8944-3f8112c8cf4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783325371, "uuid": "e9febb53-77e2-42e5-a91c-33aa2bd55578", "value": "NEW ORDER - 5191.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "514633f5-7909-11f1-ac1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783321635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321635, "uuid": "99f1d734-34f9-40a5-95a2-2d1f1eac5ee1", "comment": "Malware payload (XWorm)", "value": "83638433f87ef9fe2c75e0c3d014fcdd", "object_relation": "md5", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321635, "uuid": "33b6a532-a3dc-4684-81f7-cbe5a275e390", "comment": "Malware payload (XWorm)", "value": "ea4a18303e2fab5b968f91a9a33978405dac7a7a4023f599dcb4ab55ebb21c76", "object_relation": "sha256", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321635, "uuid": "d4f2382f-098e-43a3-b025-3c7122dd33f6", "comment": "Malware payload (XWorm)", "value": "dcca5d0781be3534eeddd471314f8e4a04a7fc29", "object_relation": "sha1", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321635, "uuid": "93fe1e01-2375-40cd-9ceb-8a4144291ac7", "comment": "Malware payload (XWorm)", "value": "72c9898ae430fce86b46a9906472427a389d20c75e437265dd214c1295f57776ccdf5e426582b4c5e5b2dc4f31c31c3b", "object_relation": "sha3-384", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321635, "uuid": "fc764fe8-7805-4281-9495-ddee1bbcad7c", "value": "T1E937234DEC77C6A438F891DE04FD4D8593D4CB615E065A7243BB6B87AE3B0C638610AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321635, "uuid": "d2701dd5-0c0b-4160-aacb-de6a0c13be3c", "value": "49152:FNDN9N5NhNLN3NUNYN8N7NXNhNRNZNMN/NKN/NwNiN9NKNiNmNNNVNtNYN+N8NCI:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783321635, "uuid": "830ce5a9-71b7-465c-866f-978f77bfefc6", "value": 24454357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783321635, "uuid": "a8b6907a-d273-49f7-9823-6b12133bdde0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321635, "uuid": "5e6d6036-723d-4018-b0a1-7337972ac11d", "value": "ea4a18303e2fab5b968f91a9a33978405dac7a7a4023f599dcb4ab55ebb21c76.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340402db-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783364965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364965, "uuid": "6e91a2d4-2174-4ec4-81f3-f9e1f84731a9", "comment": "Malware payload (Mirai)", "value": "59cb3065831367f862dcd8dfe3955170", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364965, "uuid": "ccdb11e3-f929-41a2-aa80-23227679fa26", "comment": "Malware payload (Mirai)", "value": "ea62ee769f7c022f8443741081e8ae49e90904a8f048328ac72eaa30c58a6ca1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364965, "uuid": "4697edde-2f3d-43de-acbb-f724d8a184f8", "comment": "Malware payload (Mirai)", "value": "36c3670d61fb3b1af4a1c0e57127a5f93a59d098", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364965, "uuid": "c4f1e2ed-d14d-4af5-afdf-eb18de9c9bd8", "comment": "Malware payload (Mirai)", "value": "e49e806989e5c03b35e8843e8214139453cce0aa0279524c850b1b9ce2ae2a4d7652e80cb04c2ce2f4f5f2d703de72a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364965, "uuid": "92eb478b-d63a-43bf-a99b-8dff2017d657", "value": "T117332A24B9760E17C0C1647A61EB4B24B6F153CF26E8C94E7DB20E9EFF619406913AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364965, "uuid": "608d98b9-699e-47a7-8400-d704d7de9b2a", "value": "768:0DaozBBMC9Xbu1sPt53sgrtrX+inn/jMsnpfgzfeO+lsB55bOPOw2:0Daw7MC9XCO53sg5rXPjTSsl0Gv2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364965, "uuid": "09bf9f3e-b998-4661-8bf3-3a79aa1e6bf0", "value": 51840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364965, "uuid": "8e76b3b6-4eb7-4c19-813d-e6debe799bd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364965, "uuid": "7e62aaf0-162b-483e-8d9f-e8e48b965909", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304aba0a-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783364958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364958, "uuid": "0e0521ba-acb1-4e4b-985b-09f06dab1819", "comment": "Malware payload (Mirai)", "value": "3209e1081034163929cf323ad3646dd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364958, "uuid": "975be28f-ced2-49ae-8d17-d085f826a095", "comment": "Malware payload (Mirai)", "value": "ec3b2457d48f1dba9b8ca71dd89de10ef433f5f6de682ab42a2130d024866823", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364958, "uuid": "349c7bf6-3fea-45aa-8778-477c2dd9bd4a", "comment": "Malware payload (Mirai)", "value": "62a5641e4698aab8b93cc40f7aa2a0992497506c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364958, "uuid": "8b6e398a-c7a2-42e4-a9e8-bb69d1cc96db", "comment": "Malware payload (Mirai)", "value": "5fef4f86eec169b1d39370f35eb93923aba99053d5b6177415596085021ec0ed99785a1452b2859c6dd5507bb7724770", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364958, "uuid": "2c29b579-49a0-4c8d-ab6a-abcc219fd163", "value": "T1A4B39CDBF64716A1C86246F007CB4BDE3E2322825F5789E33D6D213A6C791CB4D06B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364958, "uuid": "a9cb8f73-30f8-48db-97b1-c7016ebf09af", "value": "1536:C7AUdB5VdhQlMHfBkIkk+WC6+iOg0i/LWi:C7AUdjV7TH/b+WC6+dg0iq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364958, "uuid": "83570b72-3eb2-4272-b1ed-3984e48c0245", "value": 107804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364958, "uuid": "e90aa81b-d869-45ca-80a3-fbc6e3bb7195", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364958, "uuid": "c4988fba-eb59-467a-a741-2b2b2ee1011b", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e4937a-7929-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783335655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335655, "uuid": "19ec084f-3bc0-488e-9605-1fc5df11a0ed", "comment": "Malware payload (Mirai)", "value": "343e0575c8054eadb5ccfcaaba2fb3c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335655, "uuid": "3d7b0377-d5eb-4e81-8990-e2944f83afb7", "comment": "Malware payload (Mirai)", "value": "ec442a132f27486d1dfa3faa92c03e10012afe2b8de39fa9b42b367f7971c989", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335655, "uuid": "ec35d60f-0eaf-4b69-b0fa-461b472723c1", "comment": "Malware payload (Mirai)", "value": "c13acd2e23b8ffc57c798780ac5d08695283d39b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335655, "uuid": "51944340-72d5-405c-a3e8-e5f690b3c923", "comment": "Malware payload (Mirai)", "value": "7a3df4e1b76bd8f36e629ed109c091592d9a82413f352b50df6a2176ac5647e9d7a99a686c4cadd078b21b41c3ee7dce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335655, "uuid": "8009f269-1135-44b9-a39f-1205de83ba22", "value": "T1ABA34C86FB93E0F0D94605B1111FF77D9634EE625024DE5AEBD4BEB2AD32602921B31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335655, "uuid": "d0ce7129-5cfc-4be0-9cb9-c72be5b9a407", "value": "1536:fw1BTZX/rhDtZx6q/Wc3Ra/oiDQ9VPJUN310vntiZvnwl7/4qKU7yr1xr:+hr9tZxoc3A/oiDYIClSC+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783335655, "uuid": "ae1771bf-babd-4935-a729-8d5559de3d14", "value": 100420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783335655, "uuid": "8d5a573a-e357-4302-b24b-5f9bbab441ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335655, "uuid": "92a643fc-a702-4fb5-a85f-b07692f4a813", "value": "iran.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f151184a-7964-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783360987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783360987, "uuid": "f63d444d-dfa1-4d28-8a49-1e6e4a56a6d3", "comment": "Malware payload (AgentTesla)", "value": "cfeb9676e36d55fab86a0d3cc931244d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783360987, "uuid": "fba29b63-7618-424c-b904-bf0f890cc5d3", "comment": "Malware payload (AgentTesla)", "value": "ed7e975452bbf5d154b2ea35697843e5c2a1dc9ba44b195882cc2b6a24062cb6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783360987, "uuid": "95095f1f-0383-4e4f-b3a0-9cb093bf50c2", "comment": "Malware payload (AgentTesla)", "value": "237520055ed734c5bf0c3ee44aaed99a29fd0a56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783360987, "uuid": "76a83309-b677-4e63-90c5-4b967c530cd8", "comment": "Malware payload (AgentTesla)", "value": "6ab82e974b3cce72d3a9b56f57faa9346a3fc75dc84ba2ee9f3b3d2bab2845f5c5fd600f53e4ff2f3afe09f5adac79ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783360987, "uuid": "e2d2da40-bab4-433b-b86c-28e3cfbf199b", "value": "T1C6E53B109B289572A53DD72CE03AAFB8455E200715ADDF0D357847287AA6F07A78CEF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783360987, "uuid": "505dd62f-404f-476b-b006-d286e2acf349", "value": "49152:CzAcHfH3F8ZP11XTC7QA+U6CcQ4C1hxyQXzatBi1nwpjWTlA78qIKQ/9N0FyywFX:gAcHfH3F8ZP1dC0A+U6CcQ4C1hxyQXz9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783360987, "uuid": "8ccee9c3-cdb3-4e10-ba9f-259200250e8e", "value": 3137596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783360987, "uuid": "efd5a779-0518-4fc6-b051-df0d11c5a28d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783360987, "uuid": "51122e7e-9ea6-4c72-af64-722807e492bf", "value": "IMG_SOA APRIL_JUNE_DB-Note Reconcillation CA15- Statment.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad24bb8c-7965-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783361302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783361302, "uuid": "919a2abd-521d-4daa-8669-8329405634ac", "comment": "Malware payload", "value": "a5c26f8c2ca62e5426639e6da427c76d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783361302, "uuid": "e32c89f2-5173-47a0-a9b4-c74b2e9bfd14", "comment": "Malware payload", "value": "ed991a5d37ba2f2a4f0ba93704a527b9341c6ac8d7e5d201d449192e9b337bc2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783361302, "uuid": "44fa44f6-ae46-4244-b43f-7d301980a739", "comment": "Malware payload", "value": "de31c4e47618cc9dbe706c808c560820e2796ce9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783361302, "uuid": "5b9188ee-fa84-44c7-9901-8cfad75f9b7e", "comment": "Malware payload", "value": "062885c3c67fe25dd586a94bce0c8c2960c5936a0b663c8121c815f2e5df39772837544adbf4a911bbab67880922674f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783361302, "uuid": "118789c4-148b-499b-b903-a611347d3c20", "value": "T1BAB01282080124B3ED080803707C5444D3C0E2C0B41667E4FDA4A2B180F0A07FD0CF44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783361302, "uuid": "5b685dc0-4e8e-46a0-98a2-2b9aae79d74b", "value": "3:TKH4FGnXmhYV4Uu0aOOdeaWkjMLcvn:hon2hqb7bdYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783361302, "uuid": "325d8c01-fba3-4863-925c-e95e795174a7", "value": 111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783361302, "uuid": "097b57b0-b2fb-4929-b812-c42dee18ba42", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783361302, "uuid": "4e2155ee-1791-4a40-8016-6c2b008e449e", "value": "ed991a5d37ba2f2a4f0ba93704a527b9341c6ac8d7e5d201d449192e9b337bc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17bfe36-7943-11f1-ac1e-42010a9c0009", "comment": "Malware payload (KongTuke)", "timestamp": 1783346787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783346787, "uuid": "755229c3-812d-4cac-9630-2cd3e38d06e6", "comment": "Malware payload (KongTuke)", "value": "73aad992b0678e89bd2b90e9b515c8f0", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783346787, "uuid": "6e1fe555-7ac4-49bc-bec9-2208f9f5a51f", "comment": "Malware payload (KongTuke)", "value": "eea8f4e9c91a6902fca57874a0b96ba3c6927f2854a225f57c705ab45ee6fc34", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783346787, "uuid": "c0a13665-0b32-4e37-a8d8-569a24bdd0b9", "comment": "Malware payload (KongTuke)", "value": "4b6096ec8fde3b32467266b8fcce61fa6c2dc030", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783346787, "uuid": "dcb2b576-9ccc-4f26-99b4-a4031d1dccd4", "comment": "Malware payload (KongTuke)", "value": "56b02ad62d0f92803690dc24056107842bf6cf885c277a53990d4a0ba58937adadfae6fb8202604c7aa02e3aed7a4fec", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783346787, "uuid": "4b0c4e64-32f4-4e0f-8fd4-d0cb11f640d3", "value": "T141C15B91B7FD236651CB514415644BB26730D29BB21AD4E6748CE8C20FC471FD2122AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783346787, "uuid": "b6910667-9608-4fc8-9c1f-a1edd4bf078a", "value": "96:lY9XMc8WMjW5Wed9vhsE5FGSlGVqqmf5P/+/AE/UNpCe2Z8u/0iLEb4Ly8xouSt:lGMCBDvhr5FGVqqCd/yAyUnMp/0iLEbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783346787, "uuid": "fb5b9e25-5497-403a-b2b0-7556f2c25e48", "value": 5695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783346787, "uuid": "3a0d519b-adda-4f71-95a7-e214bdbd14f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783346787, "uuid": "6a8cb4cb-ac15-4a21-98ff-4cea52765fb1", "value": "o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b637ef35-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783365183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365183, "uuid": "d3ab2780-8cf9-42c8-9a7e-9728ef20fc25", "comment": "Malware payload (Mirai)", "value": "af7855a7e1d272624fb7194b9c91d1a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365183, "uuid": "b7dcd888-8841-43e9-bd1d-719134fd6a86", "comment": "Malware payload (Mirai)", "value": "ef9686c22bbbfd18eb7402292bf730396675b00fd35e575bfdecca683d06007f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365183, "uuid": "e23e8b7d-77f4-4b16-b018-69c80c5fea99", "comment": "Malware payload (Mirai)", "value": "98c9c2df880d4d4d5a1901baa09c0b0b5cf2d236", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365183, "uuid": "3ba7dcc9-129e-4087-b52b-32575ed5b1dc", "comment": "Malware payload (Mirai)", "value": "8948b558206a082b27686c62227307627a13ef26a8b9572de45516c6fd65c8f2e9a80f1058129083648ca64787f0c374", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365183, "uuid": "d1c25843-0e64-4448-9d27-f4d7109bc73c", "value": "T15753840E7E22CFBCF665C63447B78E25A65833D627E1D542E26CD6101EA024E205FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365183, "uuid": "febb973d-f826-4ada-9de0-56ec6ecb62de", "value": "768:WNK4cvvwVlm/2TyOTTm0tnWaLi1ehhNfTX8EsRVKKIef+e+2ww1:l7OTbX538EQTL7+2x1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783365183, "uuid": "0dd8cfc5-b985-4040-863e-1a0902e33957", "value": 64252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783365183, "uuid": "1756bbf6-e797-413d-a885-16af286aadf9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365183, "uuid": "7c817817-4958-4d29-9106-3e06311f0159", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a00de5c3-7914-11f1-ac1e-42010a9c0009", "comment": "Malware payload (DonutLoader)", "timestamp": 1783326491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326491, "uuid": "5a42c6e5-2942-4f29-bfe5-2276b89a4d5a", "comment": "Malware payload (DonutLoader)", "value": "1e2550e348ce2b2662c30d06970bca1b", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326491, "uuid": "312fd972-3a73-41e7-8d91-c61078cff731", "comment": "Malware payload (DonutLoader)", "value": "f07d854d04a406a3506346f9e39c924865f8a9cd1b074629e1461f53bc247ea6", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326491, "uuid": "698b00fa-2fa0-40bf-89c0-bc71b2b1b40d", "comment": "Malware payload (DonutLoader)", "value": "387cdee0e3e0a9c5a5737d77eb19b2ad4c975ca7", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326491, "uuid": "37ab873a-24cd-43a5-af8f-968e03cd0a09", "comment": "Malware payload (DonutLoader)", "value": "a95fee4911facd8f73996a434def683994f0b3cd456ba85fc95e99089cbce89010789ff91f9fb89c530e59ee5c242369", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326491, "uuid": "31950f48-aab3-44a8-896f-2e4af5523154", "value": "T13B548E5AF7A508FAEE77817CC9524601EA727C564760D6CF03A04AA72F237E09E3E711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326491, "uuid": "0745988a-1333-4080-bc37-d0e95dae4564", "value": "67f6728bb9c2c56c262f6da70935d9d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326491, "uuid": "4d04c821-ce6a-46da-b08f-6fb4dedd1da3", "value": "3072:fsZHwWBXV+WISOMphc7/25Y4jcZSmh0WFS05e5HVmFYt1zDye0KGnX5/j25HEX9/:kZdmQY4oYmh5sJ/KGrK9z1zE8RLM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783326491, "uuid": "e2131061-7f96-4677-9c74-fddd54e53653", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783326491, "uuid": "2de6bf29-7316-4857-8c6b-c8c8931a7e54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326491, "uuid": "7095b7f8-5b09-440a-81e2-4326db8af8e2", "value": "1e2550e348ce2b2662c30d06970bca1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ffae591-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783364985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364985, "uuid": "f234af06-65f9-4146-aaf7-e5aef812043d", "comment": "Malware payload (Mirai)", "value": "d3a21b0dcdea62456191fc6087d081df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364985, "uuid": "0e245a80-3259-475b-b8bb-31c81ba3d15a", "comment": "Malware payload (Mirai)", "value": "f09b2a34fe99172cea1bde32a741d88e35a7929004e408ea25690467fcb17171", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364985, "uuid": "83282049-1ff2-45f4-8aa5-16352b0b0a17", "comment": "Malware payload (Mirai)", "value": "365e86791616b545dde87e6841cf6e021143772f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783364985, "uuid": "bcf1abe1-db94-41df-ba9e-eabff9e304b6", "comment": "Malware payload (Mirai)", "value": "7c1d0ca535fc8ed8dd584ba382fae55ecaff112ea15f5f32e0b8e3f43701d55f28fed0f8c6a0e255310899a882a9a6ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364985, "uuid": "419f8554-80bb-42ef-ba13-3365bd25cb30", "value": "T1E2136C7AE86E5E94C4464130B9698E3C1F13F1C493531EFB1AA982B16447EACF905FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364985, "uuid": "9e6efe83-5857-440f-92a6-e1b386b738d7", "value": "768:ZazOCe8YypLq0WsDLr+mMdx0mVCCFodehttruMBCsnwR4:Za6Ct/RqwXPSxPVCNw3BCswa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783364985, "uuid": "ef44ea7a-1ff0-4fa6-a764-4ad10717e6e2", "value": 42368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783364985, "uuid": "b014cd70-9d94-434c-b6d4-040a2112a363", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783364985, "uuid": "77b4609f-b08f-48a9-9c02-8295c9856d7f", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498d01c4-795b-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783356840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356840, "uuid": "78b8a38a-f8af-4868-9d22-b817ec829f16", "comment": "Malware payload", "value": "9ce3660bd8e4d8401ba3e297ac87eaf2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356840, "uuid": "f4d264f2-9c28-4d99-8b0a-086b2e597519", "comment": "Malware payload", "value": "f0a26746becf17483c824a3da1f19fe92a966b5f377f881acb285c4eabd92178", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356840, "uuid": "878437a0-5ca5-4cc6-b1da-7e98a52c6065", "comment": "Malware payload", "value": "eae9a852416983e24d292f1c6a7ad411aaf004f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783356840, "uuid": "d9b09965-71a8-4698-8b03-0e8dcb381e2a", "comment": "Malware payload", "value": "7e601b7f72f1832ffc7d42746885a292b867c18fb8c4d0b3232cae57fa050154f17149344445986cb7263dd7ad6bdab8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356840, "uuid": "60f43640-3c5f-4acb-9ee9-332ffd3dd68f", "value": "T1EC08D043A6F1092DC562D232459B8232FB73B449133556EB734D43A23F77AA18FB6B60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356840, "uuid": "708602aa-a9dd-44b3-b078-0ac606bc5245", "value": "256f62cebbdf487a51266276ef16169b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356840, "uuid": "89bf7c64-1578-42fd-9a06-7374cd8fa14b", "value": "1572864:0UDz/W1tGRZi1QJFl3jYyGFPZ+BqZkPgdYWChrj5w:tv8GRwSFl3j7w+BqZ7irj5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783356840, "uuid": "7978cfdb-ebfa-49d1-b4ee-fd64725205ed", "value": 80132106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783356840, "uuid": "27130a63-5d42-4512-a952-dfc0807a3d1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783356840, "uuid": "b8694382-7117-4d29-93e8-123db1e2a580", "value": "RixosGame.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7373f897-78f6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783313531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783313531, "uuid": "eabe7036-c937-4410-920a-65df7c85e157", "comment": "Malware payload (Efimer)", "value": "dacb890d679186f3c1aa428c74e90269", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783313531, "uuid": "fb8dd40e-5ccf-4a91-a7c7-2e9ee9dcc7af", "comment": "Malware payload (Efimer)", "value": "f24f54d0cc171c7a0a5a95238e2b18388e1f6be2be28f4f36cf934d11fa12687", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783313531, "uuid": "a18d6d7a-a777-4a42-bbad-24b7e4761ac3", "comment": "Malware payload (Efimer)", "value": "076a0ce856521ac396b4ccc8fc1cbf02cd3ca2de", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783313531, "uuid": "260e085e-5912-4fdd-aed4-c5ba1332eaa3", "comment": "Malware payload (Efimer)", "value": "433102100a6ae79b320543bce0d1494e523f38a99ec089d5aace99579a980ac4256974a001e14ca580992e77ee177097", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783313531, "uuid": "b3ab6b93-f909-4ede-a892-09ad54b4f7bc", "value": "T14DE6332CAAD521FFE933803CCDA14651F668B47F1779C1CB469892B1AF530D0AA3E257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783313531, "uuid": "115a87d3-73f7-4af1-9416-79d5d4bd6bbd", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783313531, "uuid": "6d0f3a82-5a30-4fee-8797-1626248fc66c", "value": "393216:H7XXNPsEDh6Z7HdXW+s1YZ2oD5GwbK1XMCHWUjXwcuI3/PGTAI:HHsrFBGUmXMb8XlH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783313531, "uuid": "cbd6a140-344b-4b29-9bb6-9b526afd1de4", "value": 14319745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783313531, "uuid": "d711cd3b-1096-4969-a30f-8e77a0b577ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783313531, "uuid": "4b58197a-66e4-4e93-9fc8-77760b122a49", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babd4036-7938-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783341998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783341998, "uuid": "a8abad24-8aba-4c83-b6f0-bb89ddfc2228", "comment": "Malware payload", "value": "95aee7077b5b53fbe3ec9cb7025065f1", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783341998, "uuid": "ab0077e1-4f0f-41e2-9b28-ad7f27b40a7a", "comment": "Malware payload", "value": "f263db0d36dca341a8a77b2a081b29e537f8df6258f92b895df5d6f9f7791ecc", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783341998, "uuid": "ccd8809c-451c-4fee-96cc-d8ca3d2d38dc", "comment": "Malware payload", "value": "8075ab3aeb31c219e248dbf0b1cb638381fbf812", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783341998, "uuid": "2827179a-c6e5-4cdb-8417-5448bffc1186", "comment": "Malware payload", "value": "0dc0f86b4b4b154b10d474902f094098e0fd804807c0f3c76ed49346b17dba4ae6a1a3a6a481ab70c79d74fb9f74eafa", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783341998, "uuid": "0f3bbc2c-1809-4525-8c75-db9697a8208f", "value": "T125E58D47ACE109FAD4AA933289B652927B70BC1A0B3223D72F60B3782F767D15D75740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783341998, "uuid": "f6a6cdc5-0ee3-461c-af22-d68477c42211", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783341998, "uuid": "8c02c0d4-5541-41c8-aca3-85651b7d2085", "value": "49152:OYSBmTzdLapKRaFZ99BnmtldOsnU0ROFBEbG4W748RDDWqK89hCIdgm:OY/w0PldR0hJdH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783341998, "uuid": "ba12d8d8-b2e7-43f8-8583-62aec4a9b01f", "value": 3028328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783341998, "uuid": "31c725d5-fea4-4df0-b157-79d1ac62f818", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783341998, "uuid": "1e624281-8c15-4918-9930-69742a3c533b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dc25d0b-7955-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783354217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783354217, "uuid": "d411d9af-7309-49e3-a80c-aa79b8317ad8", "comment": "Malware payload", "value": "d6dde7103e057acdabfef9cba08e22d4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783354217, "uuid": "d92f9968-2178-424b-972a-1649af92da63", "comment": "Malware payload", "value": "f3121b85cca17df3fe49fe45f70a3afbdf7861bcb5057a46bc8f79e6475795e2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783354217, "uuid": "a33cd9b7-c5cc-4c5f-b1df-fcc629b7c97d", "comment": "Malware payload", "value": "9d31664c3483489b5a4880e4d144cb6242c3d522", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783354217, "uuid": "cc1f5f62-28e3-4c4b-ab09-db04cec6736e", "comment": "Malware payload", "value": "57379703ddf2f9314862a66326dbb6885a9ecb6bedba6c04f61978fda5d03e36ae0e2542119866b35687dddeb142c900", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783354217, "uuid": "94160092-ff03-4ff7-a9ad-9b3c9640db88", "value": "T1ED623C0BB4818035EBE14474827F526645BDACB623D4F9CBF7E0A48A5EB46E1F43116F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783354217, "uuid": "aa3d1eab-5005-4ef4-8b35-699ddf3d744d", "value": "3537f9c463b968f2d94efe8dfe27133f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783354217, "uuid": "17d884e7-b1f8-47e8-9d67-3fe9ba1a7b01", "value": "192:AWesGnjXgjk8LMRAW4NJTMpJFeIFFBKUSf/zwsd1gJxTmv8U9cthB9ik:AfSMqYUl/Zyav8U9c7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783354217, "uuid": "f2e5e649-a27e-4908-b401-792b93fce493", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783354217, "uuid": "ae1061b1-5ef5-4a3e-9647-4007e25c5076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783354217, "uuid": "6aca88f5-5b25-44b3-bd90-27523a93a171", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982221ea-7939-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783342369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783342369, "uuid": "5e22a00b-57fb-492f-8792-f5048e42cf14", "comment": "Malware payload", "value": "187d81abc281debafa56018c09ade064", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783342369, "uuid": "b3d4a3a2-52b8-436a-8134-3707d4c31295", "comment": "Malware payload", "value": "f357a66e7573b5b30ebe1ef593cb30598199ee309688554e845c0918eb828144", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783342369, "uuid": "acafd502-7171-449b-a8e4-bd5ca4314091", "comment": "Malware payload", "value": "05accc0f8cea629303fa675bdf0b30d960b2c237", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783342369, "uuid": "70fb584a-48df-42e0-9d1d-e4a761dfd652", "comment": "Malware payload", "value": "f7a17ecf9b63b780e72b2c2e0cb70b2548be6ebf9dc611cc1c57e92ee979ce5db7cc050cbfb0dd414a4b67c149c556e3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783342369, "uuid": "536e62d6-60f9-48c0-9f31-f513b2546f7e", "value": "T181D02E62A8230270A0A646AAF182A9107110AB3E4EC2C729FA5310B02A80249F0C03E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783342369, "uuid": "8fb28833-853c-4f77-a813-853f15abb534", "value": "6:hTi8Tpm62N3e2oRW7TsfHAulNXYq9DG+NjVsNXYrkJ:Vzpm62VePR+gfHPiq9DGmKi2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783342369, "uuid": "fbdf34d9-d519-43a4-89f0-2c85f6b47a04", "value": 266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783342369, "uuid": "8cdc7bf0-263f-497c-953b-03962fd943d4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783342369, "uuid": "e6b3532b-18a6-4b47-b39c-5eff4e63fea4", "value": "WSW0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f50ea34b-7929-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783335653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335653, "uuid": "ee598259-082f-4ab0-828f-271f91733dd1", "comment": "Malware payload (Mirai)", "value": "5e7724dd84b1b16e5ef033330e97b3ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335653, "uuid": "733e5605-8036-4c35-9dd3-33587bd0396b", "comment": "Malware payload (Mirai)", "value": "f38d748d9ea29424c28744c52bcd1d14328d49fcb604ca08fab3547ec500d6f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335653, "uuid": "133b7547-491a-4809-8fbe-33627994fd1c", "comment": "Malware payload (Mirai)", "value": "f373c8e851a14ca743c8db45c320ae4538cc768c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335653, "uuid": "e41e8516-d3f9-4e46-bea4-7c3613210231", "comment": "Malware payload (Mirai)", "value": "c54e55bca5e79d6d7e7e457412a3121781354f496e14f622c3e95db699172dc17fb8669ecb7c84513074f8bbcc8f621f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335653, "uuid": "da1e1e99-927d-4330-835c-2a36bfad23c7", "value": "T1B3134D328679491BC2C0E77B11A79372E0F62B845190974F7E5A0D8EFE5A340677B3E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335653, "uuid": "1862e2a9-7874-41fd-8f79-c7c7689c3df9", "value": "768:t6jQLYeiLEKRBTMjONrElzbFjUDK1JvaVIoX4M+DoIwS3ZhP3XRcFPbj+svy:BEbMjOU1hiIoDI9JhPnmF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783335653, "uuid": "70838787-bfdb-44f8-bd32-de65a3faad4d", "value": 43832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783335653, "uuid": "5875ca24-e26d-42ff-8ce1-b530496af1d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335653, "uuid": "e026aa32-5812-4e34-a78c-c4450e6994fa", "value": "iran.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f87b77-78f3-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783312462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783312462, "uuid": "668fc998-50d0-4b12-8818-75ee0e3b2853", "comment": "Malware payload", "value": "16fc1a6191e7b34c5a47c54600af5784", "object_relation": "md5", "Tag": [ { "name": "5-101-81-210", "colour": "#426F21", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pizzariatrattoria-com", "colour": "#D874AB", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783312462, "uuid": "8e8b335f-c92e-49cc-8289-7bfdccdacb58", "comment": "Malware payload", "value": "f4904db608641e47160c10b390b640bd227fec54cd7db19e121c35e4215e2e33", "object_relation": "sha256", "Tag": [ { "name": "5-101-81-210", "colour": "#426F21", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pizzariatrattoria-com", "colour": "#D874AB", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783312462, "uuid": "c0f6f12c-8c9d-411a-9e78-c63713e33640", "comment": "Malware payload", "value": "dbb6308aa18067e64af6125db1f5bc5b226e1380", "object_relation": "sha1", "Tag": [ { "name": "5-101-81-210", "colour": "#426F21", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pizzariatrattoria-com", "colour": "#D874AB", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783312462, "uuid": "1dd421d6-5462-4471-b0a8-7948ca8bb386", "comment": "Malware payload", "value": "3c002ad2980ba22a8f7ac9892db62dc4a5aa6f0e4339eb54d6ca0b7ff29cfc6f1b934fe842f735a34f5c269b7cd3ae42", "object_relation": "sha3-384", "Tag": [ { "name": "5-101-81-210", "colour": "#426F21", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pizzariatrattoria-com", "colour": "#D874AB", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783312462, "uuid": "e7798024-15aa-403f-b2e3-2b7707ab4e66", "value": "T18405BF6A36928F21C24A1377C1C7490087D69A4776EBEB0F728523D60D473FEDE0A697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783312462, "uuid": "5bed2f35-fa2d-49c4-a783-6ac5b1165e3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783312462, "uuid": "f41d8ce4-8e3f-444a-aa78-8cb0bf62e390", "value": "12288:niPM3a8W73Ei1kwMyyIH+8yp3+jujUtOhv5AOj6So1oC4nHJ4R8xXTQID:ORrP6wx1yl+CQZSXgoCSHwyXTQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783312462, "uuid": "25f460d5-7d07-4d23-ad10-9122c57eb05f", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783312462, "uuid": "5e851f71-031d-45f3-a213-4a51b6752665", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783312462, "uuid": "06818cb7-1d20-40c5-99bd-fa957dbc9422", "value": "00982.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcc58e3-7909-11f1-ac1e-42010a9c0009", "comment": "Malware payload (XWorm)", "timestamp": 1783321652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321652, "uuid": "0c2af51b-ff98-4cec-bde2-19da4643df8a", "comment": "Malware payload (XWorm)", "value": "76ac836269daaed3c36bca740cbdb2aa", "object_relation": "md5", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321652, "uuid": "82d0ddd3-c8b5-4094-873b-b90e0c8151ee", "comment": "Malware payload (XWorm)", "value": "f53a05116a513ba36797aa61b6479bb1aeedc56b6f86b45595120e0933c8a573", "object_relation": "sha256", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321652, "uuid": "4dee2ae8-21d1-4c48-9d10-6df56d720660", "comment": "Malware payload (XWorm)", "value": "9acfa3bbb4502f23b9bbd673c0912e99028b898e", "object_relation": "sha1", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783321652, "uuid": "6249bec0-5a22-44cc-9b7a-72c0f388dd15", "comment": "Malware payload (XWorm)", "value": "b8691a23311e5b496e00163c8b8cec1ed917ae67eaa84c4fdb4a3b398512c6c652bdff4af26e71490dbc590191150c21", "object_relation": "sha3-384", "Tag": [ { "name": "account-bookings-vercel-app", "colour": "#4601B8", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321652, "uuid": "6c265ea8-8109-44eb-bb90-32e4115049aa", "value": "T124426B0B3C43ECF912A57F82DDDB25B2EC025922986A89458C5FF33287187862D03BD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321652, "uuid": "0ea901d7-8863-482c-8596-a80723b8e2eb", "value": "384:xdMwcojFQAybwka0UoV86wWBuArHlQUYey:xdM4RQAybXKoOKuADCUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783321652, "uuid": "1f321925-a074-4a5a-a725-c29f8084c151", "value": 12465, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783321652, "uuid": "9c2a97de-32a6-4dae-92e5-c6bb577299f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783321652, "uuid": "b927db33-db24-4b5f-8754-7f49ebc457b8", "value": "f53a05116a513ba36797aa61b6479bb1aeedc56b6f86b45595120e0933c8a573.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb1233bf-7929-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783335663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335663, "uuid": "6f35f31e-9dd5-44df-aaf4-1f54b2351330", "comment": "Malware payload (Mirai)", "value": "978c7814d34448a62e5e5138b8da8f96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335663, "uuid": "fe562b7e-7140-4cea-9d30-078cabfcd6db", "comment": "Malware payload (Mirai)", "value": "f5cb6dadaee4399a1f014ef5946d0a4c1af578d15ff078e725e0757f28dc8493", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335663, "uuid": "9530df76-d383-442c-8075-b480ea7d7d05", "comment": "Malware payload (Mirai)", "value": "eda82476f3f13f328e593228f69004d48062a8fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783335663, "uuid": "ae9a644b-2f38-4347-a9e6-9441aaba3bc1", "comment": "Malware payload (Mirai)", "value": "37654cc1f91a507369f4a630aae03afab2b0a3d2e4f68729fc7e36b4004f5741d1d01a4609947942d9d4ee4afbafb098", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335663, "uuid": "796ea7fd-f459-4626-8944-ec4f4911a354", "value": "T1680429C7FD00DEBAF809E33748130809B130BBA254925A777257356FED3A2951977E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335663, "uuid": "ef5fdf43-9e3e-49f3-8ada-09e84af78df3", "value": "3072:T5zb+mVmSyJtrlNcilf0KUylCKHB4TakGDP2RVBv4mBVpjbiLLsepqlSKb:cSkTQylFHB4TzGDy14m+LvGSKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783335663, "uuid": "675d8f94-6b24-4f9a-a47b-178ff8676ee5", "value": 182244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783335663, "uuid": "10bdbf98-10b5-4a6b-a10b-896c1fadfff0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783335663, "uuid": "f9c12609-1b4b-4030-880d-244a690ef62f", "value": "iran.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73cc56a7-78e6-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Phorpiex)", "timestamp": 1783306660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783306660, "uuid": "575a3a71-d5bb-4ed6-8a1b-3c03b623ac86", "comment": "Malware payload (Phorpiex)", "value": "d01264955ef941463bc61e1b6693dfc1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783306660, "uuid": "1f70cd9d-23f0-496c-9ff7-24801251893f", "comment": "Malware payload (Phorpiex)", "value": "f70b6a0341300dbb1fcad771e03a62544a9bb00abc14161cdcfb68b4022abdf7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783306660, "uuid": "acf7b41a-7f01-4f6f-bd16-ed9121bfbaf2", "comment": "Malware payload (Phorpiex)", "value": "0799c3a229f0541b337da359c9e363a4124afcbf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783306660, "uuid": "9d4a6109-f49a-4ac5-89c2-d45bfdcf32e2", "comment": "Malware payload (Phorpiex)", "value": "48678e55fd46395f78ccc4b88536ba1baadbf2f39e1a3d0e1b73461b7f94184a1d50a96c804a4cd957de093da6cfb20b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783306660, "uuid": "3effdefc-f088-4157-9e33-459e0aa977c1", "value": "T1BE825C0FB9424726C0E110B49676873BDA786872338854DBFB944AED0B686D6FC3365F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783306660, "uuid": "f568cd2b-4410-40af-b331-e6020f176390", "value": "edd9caae8565fbe43a73e0ad530f325e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783306660, "uuid": "da05072d-645a-4253-8f92-c97a8d4205ee", "value": "192:daISCngTBvqQ1jV6lXwIXZ5qh4le6qo/fKUSiu9zw+gj5tBOgbOBqmEdEFWEo/GU:VIqQlV6lOh40uu9JgFtfUhav8U9ckF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783306660, "uuid": "1e265970-1d27-4088-b723-66dc70b14fdc", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783306660, "uuid": "3506adf4-f366-4bd4-99cd-27cba2800e09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783306660, "uuid": "951b8e95-7a03-4e00-b57a-218c6bd2cfe4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78ce945-7914-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783326531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326531, "uuid": "637241dc-3142-4be5-aef4-53625c832b4d", "comment": "Malware payload", "value": "d08be316e8bce6e5f7340983fb121027", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326531, "uuid": "2ca3d895-20f2-4c7c-b943-cd03b599a40f", "comment": "Malware payload", "value": "f865e02a86b9efaad3009961df792e66b554b7c56f7487f2bcf0873d8a7f2e82", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326531, "uuid": "cd0ceb3b-7abd-4e8c-a24a-fd16d12b32ef", "comment": "Malware payload", "value": "568fbdc70143023e25f330450176814d905d7d14", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783326531, "uuid": "7c1bc46e-d896-4fc7-adc8-e239e9845520", "comment": "Malware payload", "value": "122ef53f5af701dc8f0197c3aef95a7217305aaaf73dc322d96a2d979296e12cba2c38e4032dc691dd0655dbb3b416a0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326531, "uuid": "873d37e9-b25f-4ed9-bcc3-3cacba1cf9c2", "value": "T1128312BA664A303CD21C7E7983C17045C31CF5A207EB15067952B8FE2EBE79A334D996", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326531, "uuid": "d667a477-08a8-4bc6-b2e7-e135b734a252", "value": "1536:K3rokisHpNB6rSNJI4PMkivo0LqqnGAXjN2l1Jd55+U0F:O6UV6GfEkivoZ6fXjol1X55EF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783326531, "uuid": "fe578e8a-44ad-4c34-b229-7c4726e020d6", "value": 80789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783326531, "uuid": "135e1d00-274b-4573-aa03-603df4dbcc41", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783326531, "uuid": "0389efac-7bc3-45cd-9886-be10785647f8", "value": "SOA July 26.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138f7231-78ed-11f1-ac1e-42010a9c0009", "comment": "Malware payload (QuasarRAT)", "timestamp": 1783309505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783309505, "uuid": "fd8c1923-38ab-4529-982a-dd63ad14e453", "comment": "Malware payload (QuasarRAT)", "value": "47ce03660b623b380388db8e288de06e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783309505, "uuid": "d8ff5229-6364-46a1-8de0-539a088c3abc", "comment": "Malware payload (QuasarRAT)", "value": "fa1ea0e7a74ce98bb4fc8d2a1a968a334b2bcffe7ad26b09e76ebf6559f54aee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783309505, "uuid": "a81ffbbc-34cc-4136-a113-56530a84bb79", "comment": "Malware payload (QuasarRAT)", "value": "560c38a0aa04c276ef1a8edf5b3a79bf10b3869e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783309505, "uuid": "0b1cdfcb-f29f-49ae-950c-6a7e41a04d10", "comment": "Malware payload (QuasarRAT)", "value": "9e65ad2b6284cc267a3a41197645c1208a0673a278c13b5110ec8eda996183379af8262bc4e28bb2b41a98027182c989", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783309505, "uuid": "dbbf87d8-a324-4a88-9325-3efbbdc05bf1", "value": "T1D1B46B4023F8862BE5BE5779E83105205BF9E40BB26BFB5F4541B1E92C667069E40BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783309505, "uuid": "09948dd2-2b49-4494-9a5f-abf6d9947c59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783309505, "uuid": "bf5f758b-b5b7-4c78-ae27-34c779f8119a", "value": "6144:xTEgdc0YtX7IxUpGREWnty6WRH6gRspb5scESOb8F92b+RFe66cTR3y:xTEgdfY2xUqE63sCpXRFe1cdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783309505, "uuid": "f372859d-b73e-43be-adf2-6384b0936a7e", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783309505, "uuid": "43fe294c-adc9-41c1-9a13-7e42a553b7c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783309505, "uuid": "b360ec1d-fa88-4f4c-87f5-765e42c3d216", "value": "47ce03660b623b380388db8e288de06e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ca4d188-791a-11f1-ac1e-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1783328848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328848, "uuid": "f4443659-d1eb-4c2f-a6d8-aa8da85e0898", "comment": "Malware payload (AgentTesla)", "value": "683852647171ca0de9a0b1f32833f4ec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328848, "uuid": "65bc6921-54ee-4567-8c9c-b88ef102d77b", "comment": "Malware payload (AgentTesla)", "value": "fa23920dce139f976c8fe2cc7ce5001296429c259cc70f7f79777f69eff021be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328848, "uuid": "741ecf08-8dad-4c6a-814c-3a13f4315a26", "comment": "Malware payload (AgentTesla)", "value": "57cdc5b17c4bf3636d7be3aad05e3a22bbd50f6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783328848, "uuid": "0efdebfe-23f5-43a1-b535-d51efa0871ca", "comment": "Malware payload (AgentTesla)", "value": "e8ae1eac685f43a6952df0764e8eb8c9b1d660656a97a9cf8875fcf3903dbb08c18ef345524e36d07896ebca077ae4c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328848, "uuid": "7ccece48-281c-4286-8be2-4e98406ffeb8", "value": "T1EE95AE16B3CC6AB9C427D634D7419233D1B2B9524BB6A1CB5A9AC3061BB7E905F3F301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328848, "uuid": "33dd6d79-6914-4f25-899c-d2a9d3906607", "value": "4ed1ff5809e5c89370751f55b343c680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328848, "uuid": "797e4ee5-4216-45ce-9e5b-dd2461fdf4c0", "value": "49152:u4ASknjK9TkhfUapp4YMGX9BKH8dx1HzgidamRr0G0Pf:uRtscDBKH8dx1HzgidamRr0G0Pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783328848, "uuid": "8d80a2b4-a687-4cf5-9eeb-edcf2b7bb365", "value": 1900032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783328848, "uuid": "56967f63-e7f1-4d44-906d-4f108ea3dbe7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783328848, "uuid": "e3db4bee-3bc5-4755-aba4-d5fc72f4d27d", "value": "Secur32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c14160-7917-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1783327930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783327930, "uuid": "6d49fe31-c8bf-4c27-88a2-709f42cba2f3", "comment": "Malware payload (Efimer)", "value": "58dfae64c2b767b66f28f354ac5f6f30", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783327930, "uuid": "0825d594-bff3-449c-a82e-81e2d7110311", "comment": "Malware payload (Efimer)", "value": "fbe91378e51f0a29b07d937c11162c918a2adeef722f22c18236cc53436c6541", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783327930, "uuid": "9ac68780-80f4-45c5-8eb6-29042c9ab30a", "comment": "Malware payload (Efimer)", "value": "4cd9da6b590f8ccced1593799148f53a94f74d87", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783327930, "uuid": "2b4d01cd-0f74-41ad-8a0e-93fbc51cc715", "comment": "Malware payload (Efimer)", "value": "c403caed714752facc1f7b36b1c43c17d293a4bf00d24cb6541284eea8e40f2786008dd96f800b01242be6f1a21babf0", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783327930, "uuid": "9efc62b2-4af3-4dda-9874-0b127dab18f7", "value": "T158E633482AD121EEE5B3523DBEE246E6F45538770B33C6FB539841619E1B2E01C3D62B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783327930, "uuid": "1904dbdb-b153-49a5-b789-a0e70ab5d6e3", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783327930, "uuid": "ca3dcf00-3737-489d-92cc-ae059d4529f5", "value": "393216:yrE09MfPTlEZH/U7vXrjpdJJ4aXMCHWUjXgcuI3/PGTAI:yrE/f7lVJdbhXMb8X1H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783327930, "uuid": "a6305937-0731-4105-b00b-92981e5db55d", "value": 14285090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783327930, "uuid": "fe647c57-c6d5-4666-bf2a-deaae7b49883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783327930, "uuid": "22edb69b-9801-458b-9256-34c94a0de74a", "value": "default.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e721767-7901-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1783318140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783318140, "uuid": "caad4863-446f-4dc7-a2e5-dd45b15e4343", "comment": "Malware payload (Vidar)", "value": "df036c3b680683b54dfa7cbb1144b60d", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783318140, "uuid": "e38089d9-7672-480d-b7a8-4a285648f961", "comment": "Malware payload (Vidar)", "value": "fbf26aec78c95f02957c81338bc054cec2a2da75d80247cd7edf442b65c83a79", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783318140, "uuid": "27994d9e-f2d9-4426-839a-05fb1ce8f835", "comment": "Malware payload (Vidar)", "value": "a52d065316e78bdea57ad029ec95841a309537ba", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783318140, "uuid": "24b81747-9cc8-4753-8207-74f4fd205513", "comment": "Malware payload (Vidar)", "value": "be8cb817bff7b83acb76d737cd17f10fea2232a054a83ab3ca760a717ffca05f167e1f4e0302dccedcdfe67441ebfb03", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783318140, "uuid": "194d7190-2733-4e87-97d2-1e426770aac6", "value": "T1F2A5336050D489E5E6F74B742AF74561BA3178B24EB4267F25CCC5AD3F325C0AA32F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1783318140, "uuid": "aae1a107-feff-4adf-bd58-a68482b95fcf", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783318140, "uuid": "3cca7952-d08a-4222-a352-f8472309ab21", "value": "49152:uuc44qAjS++OhxdQKCCnc1LYnfqWd3LpR3LaAZugE6QcZZhn4i3/:jeZ+uLMLYnF9XEiHn/3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783318140, "uuid": "01a867a1-520a-4d88-946a-448249bda142", "value": 2187264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783318140, "uuid": "adbca150-8f8b-4857-92db-76bbff5a4f2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783318140, "uuid": "96ae3202-5164-4a6a-94d6-8771100c36cc", "value": "2JokesBallon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "149f182c-791d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783330123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330123, "uuid": "73dc65a5-2434-459c-b6c5-b4f30ab19382", "comment": "Malware payload (Mirai)", "value": "0b3a9c592b079a5de42840bbe2a134f6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330123, "uuid": "f73705a0-badd-4221-8b9c-8ffd81ef10c8", "comment": "Malware payload (Mirai)", "value": "fc2badb08d1cbeb42ad5c3efebdd8919c7d4a1750603186d4395dbd26b160046", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330123, "uuid": "e5060bfc-359a-4bf5-9d5c-d8fb286ac339", "comment": "Malware payload (Mirai)", "value": "c1ab3551abe2371da874c91d625f7cc1befb0fe0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330123, "uuid": "4b54bb12-36b4-4887-9e0a-025642f149f4", "comment": "Malware payload (Mirai)", "value": "67eb232549f3fc2ef4a90953bd16af64e8397423103802edaa86173f7934b45c698727d9856fd8bf729512839ae3471c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330123, "uuid": "d3cf34c0-6455-4137-b86c-b72a27ba5887", "value": "T1A004881D6E228F7EF668873147B74E25976C23DA27E1D640D2ACC1106E6029E641FFEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330123, "uuid": "80bf2a4a-dd89-4870-8223-0a452fe739a8", "value": "3072:jg57RT7LHZwbq1YSBan1yvbysxr1uGSuI:jglRT7LHZ0Bqyy1BSuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783330123, "uuid": "ec178db9-9b7a-4427-91be-36044b757a58", "value": 173888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783330123, "uuid": "6b3bf904-7128-408b-a225-e6945177bc5a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330123, "uuid": "52ca7f45-d783-4c1f-ba0a-c705b8ed21fa", "value": "main_mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14afa9a9-791d-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783330123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330123, "uuid": "d2c493be-caff-4ab9-a239-b773386894fa", "comment": "Malware payload (Mirai)", "value": "a2b423befaf7d9e2bb6782930da8fc59", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330123, "uuid": "6f22f3f8-ed25-43c6-be68-5b4f1e6c6db9", "comment": "Malware payload (Mirai)", "value": "fd378a5935ea35f7302d0b786b1668d660196a8790bcbbfa12b1242d64dfcb93", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330123, "uuid": "f034912d-29fa-4ac9-a7fe-7fc1be1f8212", "comment": "Malware payload (Mirai)", "value": "18b17ded5252adcbfd2503bc2072594e6a690005", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783330123, "uuid": "0dd25b6f-40fc-4160-8657-cd4902b1f206", "comment": "Malware payload (Mirai)", "value": "ff9f3472e27d23f521ab4d093c362d6bb743833158078e501d22949cc19f778773df2a070f8e39224a97fc4e3cdab38b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330123, "uuid": "d7f37971-ef14-4046-8066-88e17ec94a2c", "value": "T1B904B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330123, "uuid": "995dd320-a639-4e02-adc6-42f600d0f596", "value": "3072:nKpzGueNkSfcQqmav8SqaRVlnYz65UVt:nKYueNYQqmeqavlg65U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783330123, "uuid": "691a21ec-fa19-4e56-a867-ed702fa56e2e", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783330123, "uuid": "ffea44b1-bd33-4983-a613-bddf40166a4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783330123, "uuid": "27813dae-bf2e-4e7c-8df4-64061f270062", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5cae99-7933-11f1-ac1e-42010a9c0009", "comment": "Malware payload", "timestamp": 1783339798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339798, "uuid": "ee09db04-f444-447f-b872-996b58b68e4d", "comment": "Malware payload", "value": "501a6cc2c53dc1280c616fc884df9a9a", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339798, "uuid": "fa8dc00f-2e45-4e7d-9d75-31b538373b45", "comment": "Malware payload", "value": "fd7582c133d4adaa543be21e2452c3d3d3936288206be85a251f23ef6f7c3695", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339798, "uuid": "edcfda37-95c2-4b1e-954d-6f55792fb29a", "comment": "Malware payload", "value": "8633d7b312f214b2730eae0342dff9acd450b7b5", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783339798, "uuid": "f436e390-2b68-4454-a2f2-e42446b3486c", "comment": "Malware payload", "value": "9a50414f6a22636db6d02f4cb28c59dddcf219416150885e236d735d946fb233ad798a5d7a98d2a2bfc02cfb2942627d", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339798, "uuid": "475620fc-5ccc-4df5-b396-37bf0b0af57a", "value": "T125212D3019EC1624F3724A33D476C741EDBAB419AD35961C4166464C18A3D11ADA7F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339798, "uuid": "f4fd5409-5054-4daf-b3a7-8dfaca81263f", "value": "12:8Vkdm8Mlb+UE4WlP4l0LzlK0+COriu50+COcbdpYrn1Il+BdaY:8OaEhQlGlDXR/dd+Bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783339798, "uuid": "e82786b7-a3e0-4fc3-a050-987a0905a630", "value": 1419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783339798, "uuid": "d027c2cf-97c9-4f10-809f-3f720fab0f26", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783339798, "uuid": "d007b1e9-1d0d-4be8-86cf-001b0cd3feed", "value": "main_1.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3f8e424-796e-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783365152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365152, "uuid": "56192be3-60d2-4ee3-b088-b020ac7871b3", "comment": "Malware payload (Mirai)", "value": "0a080c5b33576b92bb9be0080d85a6b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365152, "uuid": "d863531b-0e2f-4acf-a9bf-ebf2b627e6de", "comment": "Malware payload (Mirai)", "value": "fe1789defdc5b8ddfe6f89d3b46711b2f469f31a8b7b933d924c4946f1b8bb15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365152, "uuid": "19104f4c-5c22-4662-8e14-055f7c5d74b5", "comment": "Malware payload (Mirai)", "value": "f16d136bf891d47b8425346a2db4469717f28d06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783365152, "uuid": "452955f2-ba04-48dd-a5c9-a3c0131c3885", "comment": "Malware payload (Mirai)", "value": "c39f03a5ce9e4e22695e7d6fd991889576362f4c68ae358588b823a78d68e3df0ac6ff26cdfa569e7c041033614d7db0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365152, "uuid": "e77156e2-1041-45e7-b21a-eb42d775ea7d", "value": "T121230984F44B81F6C00B4D3011A7FA3FCE32D8E951B0956EEFA98F71DE676429112A8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365152, "uuid": "a3f10fa9-0c03-4c3a-9bb7-69fe0fd95f99", "value": "768:QY6gpkHJUMG2nZfi21FHVITAWKTIEUcpqHs+QGR+IkQ9NND9uvqsLssnYu4dsr:KgpkiMGmZfi27ITA1IENQHBJsIkQhD9m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783365152, "uuid": "05dd53f2-2506-47e0-a47b-e31e2956c30e", "value": 46448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783365152, "uuid": "3a0adb59-c615-4cdd-a269-fa8f1635d0ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783365152, "uuid": "59f0f2ae-100e-445a-ab2d-0d2849a76cdc", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f74234-798b-11f1-ac1e-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1783377687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1783377687, "uuid": "8e8f91e5-74c6-4f34-a05d-0fb3ec985413", "comment": "Malware payload (Mirai)", "value": "3d18a43b24e5e74427f3e74e8e0d7d09", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1783377687, "uuid": "79645b86-5482-40ea-9f78-fd537152b07a", "comment": "Malware payload (Mirai)", "value": "ff154b904f5a717d7a14eee46fe8439e3c5b68c80f151ce958a64b24884f1c6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1783377687, "uuid": "67b247dd-dd5f-42f5-a76a-6960aea23b8b", "comment": "Malware payload (Mirai)", "value": "3dbef410627344fcf495142f593f04d9f9617b1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1783377687, "uuid": "69308c33-b18c-44ee-b364-9f5ba1764dbc", "comment": "Malware payload (Mirai)", "value": "e34de9bd96a70ed0b731dbbae1e7ac34867ef8f0e365fc5b3c1b157e8f0b46ae0c942a293c11b2e940a86e00b43f36d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1783377687, "uuid": "0554430c-e760-4469-a2c1-6fb65fc47ca2", "value": "T1EEA3198AB881A721C2C216BBFE1F018E331357E8D3DE73529D145F64778B96B0E36A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1783377687, "uuid": "57664e13-2497-400a-942d-300ee1b83383", "value": "3072:R7otYB7iE8MvswjK+O+2t8rgJSaotqpLlSrVR3nst:R7iWpvswjK7CYSawqpG8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1783377687, "uuid": "6906c621-d2e2-4900-9161-7d4e826d188b", "value": 103884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1783377687, "uuid": "c021b721-e320-43eb-8c08-5233a3d9f80d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1783377687, "uuid": "a4872a1e-834f-402b-a5c2-900a3ca1fb09", "value": "tarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }