{ "Event": { "published": true, "date": "2025-11-14", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-11-14", "timestamp": 1763164981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d9cb16d4-2f89-4e38-816f-f888b009d1cd", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b70cc4d-c164-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763129641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129641, "uuid": "cd801e9a-a9dc-4bb0-b3c9-c2deda3d288e", "comment": "Malware payload", "value": "243bd1222bd474a43676be2005bba9f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129641, "uuid": "33241e96-dce7-4f8c-9eb6-964b46250355", "comment": "Malware payload", "value": "02d3c0ee785cb6d52783e1242ebac2294f3171ea890d83e975dad032584ea378", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129641, "uuid": "1b979c2c-1928-420e-8e8c-b326dd3f8817", "comment": "Malware payload", "value": "45db000dc4969188eabc97bc3fd2e71d2b7adb25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129641, "uuid": "d73991d3-1341-410c-9828-24416be4994e", "comment": "Malware payload", "value": "18f15e22033c0324c4b801318216d0b00571544392d120435186aea2ef883cf4750c2ed342aea8229e5f508bbc6aee4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129641, "uuid": "b08a25b3-862f-4f58-acc9-4e5dc7f98f33", "value": "T1C4247D10B991C432D97718768DF98B7D9E3DBC510B61A9DBA3C40DEECA30AD0BB31616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129641, "uuid": "2fd728f0-1086-4f16-87d5-b9459fee324a", "value": "0f57e12a9ca5eeda51a796687443b720", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129641, "uuid": "37af4915-f8d6-4291-b1b3-bb535592a1b3", "value": "3072:Xmq2+e92etaR98hp7g2CyXuFBal61gN7C0FlW65eV+u4ef4UKyKDoLEK:Xm4SO9kgaeXal6k7DlW6Koep", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763129641, "uuid": "b8779c32-eea4-4b08-ba2e-e405fb8aac8b", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763129641, "uuid": "2c667207-8e28-4310-97fd-d8f1847620d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129641, "uuid": "54e1b327-5e90-4f81-bf9f-c294992400d6", "value": "SecuriteInfo.com.Trojan.GenericKD.77770003.22743.9194", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54234e9b-c197-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1763151614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763151614, "uuid": "6c72a97d-56fc-47a3-8c8e-b82f2f91f685", "comment": "Malware payload (ValleyRAT)", "value": "1128668814814678ca0071d166c3405b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763151614, "uuid": "f3daacca-241a-426d-80e9-315fffea09de", "comment": "Malware payload (ValleyRAT)", "value": "0327251f49efffad7d6c02eeebe4dd6ed840f16700003ed5b39252b2af8821bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763151614, "uuid": "f81e895b-cd29-4ef6-b37b-88edb868782f", "comment": "Malware payload (ValleyRAT)", "value": "90870aa8981437966524588e814625e99a252f63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763151614, "uuid": "c79acb8c-a9ef-4784-96f4-48f72d99c84d", "comment": "Malware payload (ValleyRAT)", "value": "4532a909ba6e48d4ebd9904419a1dbece7a447d07606e94d8500a69e0f57e62fa9a797b02edcfdac378e060ee2cd0586", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763151614, "uuid": "e8390a34-ef21-4091-b2f1-17cd28170ad8", "value": "T1A6A4BE123BE4D136D9A346304FE6577492FAFFA11D3ACA0723A09B2D1D705919B36F22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763151614, "uuid": "c5bd4c53-6fe9-4c9a-9641-7a45f57a836a", "value": "48b10f3f7da2d79fe992a91ceeff64ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763151614, "uuid": "bb879bc5-3c89-4558-90d5-363f2b6ba56d", "value": "12288:d7wftDHarzh7FLBVnLRIaVdpkNV0gDxDcMy:dHrzh7FlVTdarzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763151614, "uuid": "d29239f4-69d8-4a9d-b814-5799196fddb9", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763151614, "uuid": "e9cb70d2-0f26-4e5c-9340-5de2c06dee61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763151614, "uuid": "c88730fb-fbdb-4ede-b3e7-d87a4231b552", "value": "1128668814814678ca0071d166c3405b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7acecc2-c19c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763153955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763153955, "uuid": "78c1b358-7cfa-49dc-a78e-4afe5f9da7aa", "comment": "Malware payload", "value": "fe65fcf9c990d86ae6d509427faed729", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763153955, "uuid": "b9e7e64b-568d-47ec-8cce-6eaf8d88cfec", "comment": "Malware payload", "value": "0455ebce0a62e2413a730a8e172cde5e6171d2a3569c4620c7e10a6ff04a3710", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763153955, "uuid": "bc386412-04ff-4367-9641-c7b6135d3afb", "comment": "Malware payload", "value": "cd941d3783ddd7c270b0c8d0074f25bdc5953a47", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763153955, "uuid": "811aca61-01e1-40fd-bcae-0194fcc91a38", "comment": "Malware payload", "value": "3928bdb21308c6b96df5b3ec6e24385c4542c932661182b3e2d09ffdd4295ea30d3ee4d4aacec05ea62f65cd02f54f29", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763153955, "uuid": "6bf68350-25d9-4b29-8681-ca1914134c03", "value": "T13936EFE634A5B894DDEFD25F84AE8B79B35E0682D707218A131F1D58866340F3E849CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763153955, "uuid": "425fbc81-23c8-4f73-9ac1-4a5310e1bd03", "value": "24576:KA0XTVl4dgr6EvDuGkOuu2B0xQwzQgPx3oPSJOJSSQGWn0cPnTQcDQvF4ymfiKGU:W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763153955, "uuid": "ef6bef46-2ad5-4840-bfab-04f8abb93dcc", "value": 5056419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763153955, "uuid": "fa9760a5-b561-40c4-b7c2-11f57a058fef", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763153955, "uuid": "217f4716-0b08-44d7-9955-8f2655016104", "value": "LAYRE Injector.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593b5048-c1b1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763162789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162789, "uuid": "926b3ca7-9f2a-41ac-af38-33cd81aa9cf6", "comment": "Malware payload", "value": "ebbf199c7813577f72daa241d9fb3398", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162789, "uuid": "1142325f-5fe0-4260-a97b-2b3e313020da", "comment": "Malware payload", "value": "048e374baac36d8cf68dd32e48313ef8eb517d647548b1bf5f26d2d0e2e3cdc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162789, "uuid": "552d2723-1580-4b7a-ab37-0464fe09a536", "comment": "Malware payload", "value": "6526419cf3d9ddb1e7268bec9ea63710e4690e70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162789, "uuid": "180800b3-edf3-4a52-87e0-f6441ef4da60", "comment": "Malware payload", "value": "3c2c8701b9de344cde2f47ffc99c64c4bd3dee19dfa777a62025b364dd9460dda3138b808651a8852cefa32c4ef7ffcd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763162789, "uuid": "0959ff16-25c2-4b5a-a757-cae4ee0187ba", "value": "T1378533346A465C25267B0FF4809531371CEB3AF7210AE5864E8E7CDD821561A92BFCFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763162789, "uuid": "14e8e1e9-2298-4d6c-ace4-773b0cd8e189", "value": "49152:1LtoMxTuZCBqOoEVx8y9y3p3EesY603jBY:foMxTSIqOXVxfqp3Erj0zm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763162789, "uuid": "a801504b-7fbf-4522-b07a-57728821d855", "value": 1748196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763162789, "uuid": "09f1a91a-ed30-42cd-9178-915f22f02327", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763162789, "uuid": "7dcef923-bf41-41e2-93fb-e511c40bc314", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9d3fd4-c136-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763110105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763110105, "uuid": "3dcef2f1-3e03-47da-9017-1848041de435", "comment": "Malware payload (Stealc)", "value": "cc89ac9b1135cf9a3c412e218ffacc89", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763110105, "uuid": "e782f63f-b59b-4eb3-837e-4816d6e1737a", "comment": "Malware payload (Stealc)", "value": "049b378e299ad58a82b8611e89ed1641aeed2ac8eb41f6713ad7a8f20b04b9d1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763110105, "uuid": "40a9d8f8-1190-445c-999b-589756fde36d", "comment": "Malware payload (Stealc)", "value": "6072a704efb9b3fd48c5405ecc9d4098ee7fae4f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763110105, "uuid": "a7dcbefd-e2f6-44c4-8480-53efb1d8c3c2", "comment": "Malware payload (Stealc)", "value": "8caea86c28b88d5bd0c709ae6df8adf6033ace552ef6f1780919328bf28e6a2331828ddaa11c11311c2b7ac718bb3342", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763110105, "uuid": "e7150e8a-7a86-40aa-8646-921f1b5dd0ec", "value": "T184E533A93E131857D7A4CB7490DED19807B27DE176B6C1CFA81973880B3A7D08B7294E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763110105, "uuid": "cd2beab5-2018-4ee6-ad0c-d4a22529876a", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763110105, "uuid": "fa57d354-f674-477b-be17-8f872112062d", "value": "49152:M8AZt1qn25EfdVNEH2QUXotmiWWY6XjHKIecEmIDHcSqSz88lxphM576nN1vXKNm:wA25EfnuH23oKMWuYcS5flx7C+bvXKNm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763110105, "uuid": "b4e0367e-0fa9-48dc-8481-e709b4f59673", "value": 3126880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763110105, "uuid": "6ae2df7c-6321-449f-ab51-f30e3e44e743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763110105, "uuid": "eec8bf39-d057-4559-887e-96783a8f49d4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a487e8c-c17a-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1763139115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139115, "uuid": "6c701482-a7f2-468d-b362-22c19cf80fa1", "comment": "Malware payload (RedLineStealer)", "value": "b44d079aaa2085182f26cf961d5b57be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139115, "uuid": "225dcb9a-ab6e-4699-9582-e93d1183e2a8", "comment": "Malware payload (RedLineStealer)", "value": "0571d6e01dadf196d8ee4f5969a6c7849543176071e49c59808db83883a4bf37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139115, "uuid": "062c546a-2341-4184-b725-1dd7003bf4e4", "comment": "Malware payload (RedLineStealer)", "value": "22ef1e69ed43ba825f5bbc702f511a7ee7eef596", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139115, "uuid": "cc769a6b-4cf5-42ce-a7ed-867bd0ea7a28", "comment": "Malware payload (RedLineStealer)", "value": "88a9754dcfb9d702b14e646c35de76cfe42e9e34d36293539402fbeeaf5ce3fe8b09a6891215807261b2ee87fa79cf75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139115, "uuid": "37913980-5fd9-4b47-ba97-f85a7432ce44", "value": "T15BE4231EFDA3E21AE51EDEBBC503012102B95816E066F35715CABDA50F2BF8DC48ED94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139115, "uuid": "d2d1b84e-104a-4500-8882-2dc98f750131", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139115, "uuid": "ad873a35-0fe3-4fcc-84c0-9466eb176c4d", "value": "12288:6ePv/lzCJyTMB1JT1KQTTh59o1zDw8KVX6IYer9KLrjarDOSv8GQ2zhvHh:Bv+B12dDw8aXoowXjarDOk8GdzJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763139115, "uuid": "cf27f72f-3d05-459d-a326-4b7de8e12c9f", "value": 691712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763139115, "uuid": "6f2da3cb-421e-4bf7-94e4-08c58ab7c794", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139115, "uuid": "150de19a-32cb-4e10-bd84-0e2646901452", "value": "Purchase Inquiry_KPCPU-2830.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeed12dc-c12d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763106240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763106240, "uuid": "ac72ad55-383c-4f01-aab3-a20d40d8840e", "comment": "Malware payload", "value": "eec97d4cc5b5b9b812b633cc650b44fe", "object_relation": "md5", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763106240, "uuid": "68963a40-1c3e-440e-a234-7c5006db174a", "comment": "Malware payload", "value": "08dfa0aa53cbb9a8849fe8ad920e492cc2549fd005b23a1523546b5f8cb831e5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763106240, "uuid": "d28bdc2f-d73c-47ab-82df-ef1d4e8ee1e0", "comment": "Malware payload", "value": "07de24fbc39e3577b381661e89d4e42d4c0502a4", "object_relation": "sha1", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763106240, "uuid": "ce64bf3c-8bef-4c65-93a8-496949c9c198", "comment": "Malware payload", "value": "95b33339ac11a30a9873ddb6c816a377b30c68c517d93d64b33ff62fd6d05c6eae771475df9898b9209add39d90ba411", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2025-6218", "colour": "#EECA24", "exportable": true, "hide_tag": false }, { "name": "CVE-2025-8088", "colour": "#53BCD6", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763106240, "uuid": "c16e4fd7-1a0d-4200-8630-a771e4b2b822", "value": "T10535336BAF07731AE4561D9320ED3877AE4529ED2986FFCB129AD043C1C809135DEA1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763106240, "uuid": "ba0bc044-55e3-4418-b6dd-dcf4da402444", "value": "24576:hFhsstQcMEHsBHdsQaxkSRjpbokCZdmeVvnDQ/kTi:jO0caBzCZ4eVv8/km", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763106240, "uuid": "05c18d29-c53b-4581-afb0-c6dbf7cc7e65", "value": 1082975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763106240, "uuid": "c2fa69bf-d663-4ef2-9347-cd02a07f1ad2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763106240, "uuid": "478b9ccc-1886-4449-8a7c-09f8bccfb9ab", "value": "GmailPrompter.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6f807b1-c133-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1763108830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763108830, "uuid": "74cbfeb8-07a5-4380-a10e-11d6f5ecfa09", "comment": "Malware payload (AgentTesla)", "value": "c4ce018ef2e19386e65b6889c1a76dbf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763108830, "uuid": "7b7f1eb9-0411-4506-a1d1-a912e4df7fdf", "comment": "Malware payload (AgentTesla)", "value": "08f7864a5211d2bdbe0660a5d7290ac384b3161fcd9b4a3213b3bb5f92013e99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763108830, "uuid": "ccf6d9c4-e641-416b-9b6a-e73a52cdd13d", "comment": "Malware payload (AgentTesla)", "value": "d09cbce6d4e5b54c5db90ad0d46ab12b38b0c7c5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763108830, "uuid": "9008e14e-617c-4448-baa8-8988c3f70d9e", "comment": "Malware payload (AgentTesla)", "value": "50b0b2f2a3b1f9a36847c96fa1f3f2218b38a57a80f73cb6c0f5824c3ac4f03a01b578ca8c0e69e134539277653ff126", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763108830, "uuid": "9f649a3a-7547-4330-8010-14fe30c0de32", "value": "T135E4128EB782B657CA1D0F7BC107601646F48C5AEA75F37569D46CEB2A3DE84C20B603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763108830, "uuid": "a4c9d063-e9a8-4d15-952e-ca9e388d3d16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763108830, "uuid": "d4a852b8-eaba-4823-a08d-775f423b566d", "value": "12288:BDdMlYoOAXdkNddO7gTMBpPtLnYUs+fNbGfd6RVU5zWRk95aO+23z+U0lz931vX3:13k0+9BhWUN1a6RVU5B3z+H5956yv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763108830, "uuid": "264d2a50-166f-4328-ba23-099c9eda77de", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763108830, "uuid": "b5db4669-4fc4-4aa7-bda3-19c9d06d7952", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763108830, "uuid": "3fb4f6b2-4659-4a51-88ce-4f3ebdc9d260", "value": "RFQ#20251114.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "077e329f-c159-11f0-a129-42010a9c0007", "comment": "Malware payload (GenesisStealer)", "timestamp": 1763124857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763124857, "uuid": "e1965ce4-9e42-4ba7-958b-d586fc813d2d", "comment": "Malware payload (GenesisStealer)", "value": "80dc4cf19c6cd92feb4a06f41fc3efb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763124857, "uuid": "a1b80015-f74c-47cb-8986-7b23687f1c38", "comment": "Malware payload (GenesisStealer)", "value": "0a05c686d8661d0abbfde1b9619848b9041a63b7dcaf2ec36623fb5f5b811856", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763124857, "uuid": "36156251-7d60-473a-917a-4d3df3756fac", "comment": "Malware payload (GenesisStealer)", "value": "d86d917410b5840c4d61952340519faab444c7eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763124857, "uuid": "4475dd0d-0fa9-46b2-b48a-1d3217abb7cb", "comment": "Malware payload (GenesisStealer)", "value": "09497236228afcf2d3a60885b9b686744a057bf219bb0e2f74831947a06911cb8ee644f49a1d50c378c56163c55c74d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GenesisStealer", "colour": "#185B78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763124857, "uuid": "3963d25d-59ab-4b5d-9ea3-324ad5e197ca", "value": "T1F31833093F75CD05E0EAC5BE27B233D21455B3872A99623BC57BD8AB42DCF11383A196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763124857, "uuid": "cd864626-6e8c-4efb-8cbc-d69d64822418", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763124857, "uuid": "67695d84-6883-4670-87f6-247f73588aae", "value": "1572864:2P+BWMFDe45ksCqFtw6hDRVOfdANnH7MZJ9HJLJ6fzoXzcA2fy7BlwhPyxQai6qL:22BFle45EUhDRVyA8HJLwfzoXzc7y7B+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763124857, "uuid": "cdfb9fff-f3e9-4b50-bb0d-0fa2ca99559e", "value": 88316943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763124857, "uuid": "41f67270-91c1-4e59-8214-1ee3f5124e71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763124857, "uuid": "b186ce88-0e5d-4610-b115-09dd95fcca02", "value": "RPReplaySextapeleak13-2025-onlyfansleakfullvids.mp4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edafc4f0-c0fb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763084870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763084870, "uuid": "6282b6e8-8a7d-4db6-932b-c9756dcfc40c", "comment": "Malware payload (Mirai)", "value": "ab126d5ada5795dfd77bb268ee1664cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763084870, "uuid": "6530a4e7-5ff2-4df2-a3ab-402a34db8128", "comment": "Malware payload (Mirai)", "value": "0a70377ca8e39606c7f65ae81cb21808d4927ab5bfdac4685b2224e971e5f708", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763084870, "uuid": "20fbcbf1-350f-4416-b0e7-f129f8c42d2a", "comment": "Malware payload (Mirai)", "value": "d083d1a01353a008dd9658256a2dd0197b7f31eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763084870, "uuid": "5394ff7d-80e2-484c-8543-c87cc1de8dd5", "comment": "Malware payload (Mirai)", "value": "9bbaffe609aaaa00c7474ad2fb6716c8dd7fa745c0d6e04dd041ab7a21659de07d331f2d1967fb19a5eb93ec91fc9317", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763084870, "uuid": "c8dc52a2-df7e-4e83-9891-ff7f4eb2f2f1", "value": "T19A534A21A9B96A17C4C4683B62F34334B2E2574E71ACC72E7D720D8EFF10654261BAF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763084870, "uuid": "3f36a713-823c-4c14-9465-0305bebebe8d", "value": "1536:LuDSUT4hMGCDnE8yZeV4wsEHR1ymqk5LT0ei7uhf:i2s/RykfS030eiQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763084870, "uuid": "db708e2c-b92e-43fc-9847-f2cb1c27b9c8", "value": 66424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763084870, "uuid": "694c7c22-cf22-4198-83a4-51dd63e0b52a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763084870, "uuid": "5fb119f4-cb9b-41fb-a110-56978f22b04e", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746374d5-c0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763081231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081231, "uuid": "9d077d47-cda7-4fe1-a7f9-c7c9dd4c73a5", "comment": "Malware payload (Mirai)", "value": "1b14220a676a484683a144657900c271", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081231, "uuid": "0800dfab-b5d2-4c91-8af8-c2c6ef2fdb5e", "comment": "Malware payload (Mirai)", "value": "0ad40a86d65d9d19ee2f7054ed5a58ac419417b31f5007b208c19f274001f530", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081231, "uuid": "c66ad9a1-bf9d-43c4-8cc4-a263a9fee046", "comment": "Malware payload (Mirai)", "value": "0f5af7ec9704d99a57b9c155e455b6414d3b1b7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081231, "uuid": "3bbeed30-ae81-4b7e-91ef-a904fbdd898d", "comment": "Malware payload (Mirai)", "value": "8fb4c888ceb76186937955637ae791df2d112782cb75a57a35da5a52b0906e5620287430aa6891da0e2e728563ebc244", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081231, "uuid": "7ac6346c-9921-4b2a-aad3-772b13d8ca01", "value": "T1EBB2C0CC61543084CA8D7C7C1B8D4A674F6CA1D0BAED9B26E354CD98B3BEA4B345D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081231, "uuid": "0f874eaa-896b-46d4-8831-5b28f365c130", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpHZqEWvO:/QlS07FUXqIYSXQKqu5qQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763081231, "uuid": "b644b5be-1145-4274-9d87-17cb36bda743", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763081231, "uuid": "d8ae719a-9913-4c45-9145-7f2f6f5edb42", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081231, "uuid": "04362918-3015-4922-8844-49ca39a8c38f", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98fa7b48-c125-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763102767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763102767, "uuid": "1810b2a9-457a-451b-974f-b692e3d5234b", "comment": "Malware payload (Mirai)", "value": "061b53123b6d7a820dc401f30d8810ed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763102767, "uuid": "3130587f-e7a7-40eb-969c-5f3195bb0847", "comment": "Malware payload (Mirai)", "value": "0ca5825210d3cd99415e0618586d9181270c880c39842060af6ad5f45739ade7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763102767, "uuid": "db3b62da-675e-4233-8650-14a20f44a484", "comment": "Malware payload (Mirai)", "value": "748005152105b96111dc6c1f3e92e4ab55be3d70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763102767, "uuid": "d4c7bae7-dd2c-4f4e-90c4-c71b3bc1b6d2", "comment": "Malware payload (Mirai)", "value": "36a8a4dfdc4fb10251b745a17a9ad232f9d44152329f58232fd65ea200462fd1345f848428bdb44127c2b8df1f72170a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763102767, "uuid": "2026a2fe-c7da-454d-a727-05e5501554fb", "value": "T10BA2E1E31195EA06DD1203B5B2D3CFB591D25C949ED30AC62FC80DD6ED823BC2E4C999", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763102767, "uuid": "98e7b3a2-729a-4f80-8d82-9e44810f1281", "value": "384:M2Dzi7lv91hhRkHk/GenRnhjSsV+DhVxlPltK+FOqtLv1R3/:w75rL/GenRnhetDxYYtdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763102767, "uuid": "b8b778e2-e0d8-486f-a096-46301f19c334", "value": 22876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763102767, "uuid": "5ebe585e-2ef6-4db6-8cf3-ae57b8782cc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763102767, "uuid": "36f2a341-c969-4c40-9462-03cfc011e667", "value": "wewe1.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eecdf81-c182-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763142505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142505, "uuid": "b84a648f-e633-455d-b570-06863fdc8fcf", "comment": "Malware payload", "value": "22810b9ac3427f4aea729a6018c77664", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-AURAStealer", "colour": "#FDC78F", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142505, "uuid": "73e101e8-11f8-47eb-a0d7-799799057e24", "comment": "Malware payload", "value": "0cfa0bdd1f21ae4d71ab3b0978339be3bd578b9c0c6bf3eeeffed4a0ca3dd697", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-AURAStealer", "colour": "#FDC78F", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142505, "uuid": "7c887f4a-f21d-46e3-90b8-14da866f5eef", "comment": "Malware payload", "value": "ab48b27e719bb52dd0b0094e6de01af749b55e31", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-AURAStealer", "colour": "#FDC78F", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142505, "uuid": "2507859f-a5f3-4682-b286-e91c681d7872", "comment": "Malware payload", "value": "e84526b8727d88193536ba59032c68a524a29865acc9997b58c09fb7ca9bdf8a075718baaa0590364c47b20b5cefc3c7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "dropped-by-AURAStealer", "colour": "#FDC78F", "exportable": true, "hide_tag": false }, { "name": "Latrodectus", "colour": "#156C04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142505, "uuid": "8671a04b-c978-4c0f-ba6c-157dbd9723a7", "value": "T1F5855B2AEAA80169C52790B9DD3F754BE275740E0BB097DF19D4231D5F2B7E8CA3A700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142505, "uuid": "f62118cd-826c-48c9-b87e-c37a11b40343", "value": "6ffd81f6cfc60f711232b82878be1874", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142505, "uuid": "fcfe92d6-e724-4de6-b945-b9012182034f", "value": "49152:NEegQu4HpoJfTQklrJFuuUN0Sp5y+VqhATlBfRzO7oFxDdGBzWztR5D86QVxMHMc:qKBR5D8LxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763142505, "uuid": "561919e8-44c8-40b0-aafe-95cc139454e2", "value": 1752064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763142505, "uuid": "05b47973-6eda-45ed-a201-c57cea73d0c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142505, "uuid": "37150260-6c82-43d5-8152-69a758266467", "value": "1i0cPmAF.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13725278-c163-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1763129172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129172, "uuid": "1a1ad402-e530-4a49-8c67-d74dc55e6659", "comment": "Malware payload (PhantomStealer)", "value": "49ae39a217205f56a561a15d7cf4b0a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129172, "uuid": "96f36540-7d78-4461-a974-31a52cda749d", "comment": "Malware payload (PhantomStealer)", "value": "0dd12063f78569c5d0af372419000eeba8ac648be0ef8db395a1df5671e646b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129172, "uuid": "04118824-306e-462f-87b0-ba5baa3b1928", "comment": "Malware payload (PhantomStealer)", "value": "32c0896e0fbe294b12bdf26c6018d7dda90fe37a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129172, "uuid": "ba2ffbaf-1864-4e58-ba15-5bd362254fcb", "comment": "Malware payload (PhantomStealer)", "value": "575d7dd42d282bd02dbc594f6f8255e90b19c7d015c1a276c8f29f4ac91b0b2b105bf526808856e3300a8844a693bbab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129172, "uuid": "8c9f3313-dcaa-4974-94ee-37c1558743f1", "value": "T1C675E11273DE8360C3B25273BA257741BEBF782506B5F96B2FD8093DE820162525E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129172, "uuid": "d23b9dcc-6e5e-4763-a6b8-0bc25a388c95", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129172, "uuid": "1bffbe9d-5535-45e8-8583-792afff53b7c", "value": "24576:itb20pkaCqT5TBWgNQ7aQnwIEgYM4Hw1P/2aC0dvEW4zncqHSSkUCVx6A:vVg5tQ7aQnwhgnV2aCEv4znc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763129172, "uuid": "61c09612-e62f-43c8-9c90-a44d28dfa16b", "value": 1584640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763129172, "uuid": "c76aad0d-2f50-437f-89c0-440443e9ccac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129172, "uuid": "53420436-2646-48bb-8f06-285dc1ff3e22", "value": "REQUEST FOR QUOTATION REF1RFQ007113.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1c16eb9-c11a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763098084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763098084, "uuid": "9c454b78-eeb7-4ed7-8acc-2abb75e80e0c", "comment": "Malware payload (Mirai)", "value": "4f2fa696704c9df48e3b75e5942f1fa7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763098084, "uuid": "dd250780-6981-4b6f-8794-ce5f51bdeab4", "comment": "Malware payload (Mirai)", "value": "0e274f5975dba3318774e068eb963833515d00f3cc224f3fe8c370e99ef495be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763098084, "uuid": "19663db2-c117-4b81-8208-64dc0aea6343", "comment": "Malware payload (Mirai)", "value": "099ea083390bea12b2cea9e37fdbaed6976be638", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763098084, "uuid": "b86b2e3b-b690-492c-ae78-1b95d54e4cce", "comment": "Malware payload (Mirai)", "value": "14c1d276d1e823fc42a1b61d81a64c1b749d2fd6bae49d50d50c5ef4006a62b73ec72f177ccc7904bf5d8660e245973c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763098084, "uuid": "ed065f25-58a5-4429-b8c4-8af1ef5016b6", "value": "T153333B31BA721C2BC8C5697962F34725F2F5478A20FC8A1B3D710E8DBF65A4036976B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763098084, "uuid": "ac22dbde-7a0f-4b4f-8591-ac87073c257e", "value": "768:89mGnYgEkJ+5F0KE6qoO+YHG5WleBTyv1t+aIQba+:8HK6+5FYaYm5WHt+a1bL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763098084, "uuid": "01e481cc-c77f-4f8e-a393-9ec914a16768", "value": 52800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763098084, "uuid": "da40d852-1535-4cd2-a4d5-de996a7f4eaf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763098084, "uuid": "dc5df784-8da8-4f9c-a8e8-8d35b6835876", "value": "wewe9.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89edc62d-c15b-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763125934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763125934, "uuid": "ae81690d-798c-46c1-858c-378ec929d70d", "comment": "Malware payload (Stealc)", "value": "aa2afa08bf3294b4f2f8ea7b3562c6b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763125934, "uuid": "09497764-8482-441f-a437-3ddfc36b9209", "comment": "Malware payload (Stealc)", "value": "0f5d52e0b104dc37a4b8832bb9a691f1f42bc90589faf62a58281a8f59a881f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763125934, "uuid": "85dc1de2-cb21-4b88-8c4d-5b7f361f852f", "comment": "Malware payload (Stealc)", "value": "9e35c4e81b23ac1c7110ff52955576763967ba16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763125934, "uuid": "12113797-4a27-478b-9752-b586ad835b36", "comment": "Malware payload (Stealc)", "value": "06ae9d300c3e67369f624f6221956eb9fe64b7c6bb5793744e5cd01d382f393bc330b3316778665c761b8eead410718b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763125934, "uuid": "619ba5e7-a05a-40ba-ad82-bef4554f0a0f", "value": "T10E0523E5927EE419DD248A3D639D6F13A037BD0CAFA0C14E3559B270C385638BC4CB9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763125934, "uuid": "b31327f3-acc8-44ad-bcec-fde7fcedb29a", "value": "0b8fc27747798374128089e16d9229e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763125934, "uuid": "fa492500-6c82-4b66-afc0-90f07b9ea395", "value": "12288:GX4BtwMXcqa3VSWwEOrkhh8Xh7gUBacyUeuJFyhD/M06oLuxmO6d/7e9eY8bOex5:a6DuVAlQh6JUtuJ0xU0bt/7AeYOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763125934, "uuid": "3d2c618d-b797-4694-afa9-2b290b680456", "value": 817152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763125934, "uuid": "376b553c-21ad-4a79-ab68-04e13696aa3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763125934, "uuid": "5fe94a66-72d3-4b2b-bbe3-ff6c62aa1dd5", "value": "mscorsvc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9a96440-c153-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1763122578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122578, "uuid": "f9d8700b-831c-422e-ab95-8bbf5737e5f8", "comment": "Malware payload (XWorm)", "value": "47cfb1cc3ced88660684ec89452231b1", "object_relation": "md5", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122578, "uuid": "7a21643a-c3fe-4878-a1a0-09895068d8fd", "comment": "Malware payload (XWorm)", "value": "1089d67ce129560fbf95684cdff2841d30d4550f7ddf1c8e19f6d2ec006f6b96", "object_relation": "sha256", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122578, "uuid": "698d971e-30f5-490c-b34d-5cc4c38320a9", "comment": "Malware payload (XWorm)", "value": "4e0b98020cd7c70ef27da16e7e475845163d3c92", "object_relation": "sha1", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122578, "uuid": "89c780cd-173e-4e89-860e-db97f15a824a", "comment": "Malware payload (XWorm)", "value": "8a21053fdbf3ba2cf4fc01087186fe619a58e5d6d921977394b517578c5201dbcdea82768e38a36d697e0c907239449e", "object_relation": "sha3-384", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122578, "uuid": "05daade4-2a37-4071-bb2c-bd12dbd71b1e", "value": "T18EC2BF052B9F8329D2F5037D8AFAA7219535CAC60803DB5F7A88442D6DF73D44A03EA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122578, "uuid": "159251cf-e1b9-44ab-ba7c-276fa2be389c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122578, "uuid": "e4001d1a-a179-4d99-9fe8-f9ee4c194a11", "value": "384:mRy6AZL2YrKTvcK1NPawqKamI19d/r1rPkf38bRyNPfO+8ajOoXjIr98E+:mOV2JUK11awxchrtM/8b8N373vyu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763122578, "uuid": "d53e7c2b-c391-413f-b8fe-c2afbf672b66", "value": 26624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763122578, "uuid": "d9e40d01-be62-44fe-8daf-3cad1297665c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122578, "uuid": "5c176fe0-1e66-40e3-bde5-a5b804a69983", "value": "1089d67ce129560fbf95684cdff2841d30d4550f7ddf1c8e19f6d2ec006f6b96(2)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f757461b-c135-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763109797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109797, "uuid": "1a2b014d-dbf8-4716-9591-89c36f55442b", "comment": "Malware payload", "value": "3972b14507a764276c7eef9f8d3ed022", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109797, "uuid": "28006c9d-860d-4a22-afd6-b02a226ae227", "comment": "Malware payload", "value": "114453b780b4dec692467697e920cc055785566dcf40967ee0cc759336d7d791", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109797, "uuid": "10d22250-ddbc-4c26-b41d-21ed9369708a", "comment": "Malware payload", "value": "c41c51fe5c536d0f7bd307ee5010ebf7396c9aee", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109797, "uuid": "44ed883b-f0c0-40df-9791-040f0c9c6fec", "comment": "Malware payload", "value": "1a3aac1e6764c2381cf2cdccc3835f4abf2e2a838b74c7dc33a61ff78bad17864afdf2818e4e078ac36a98ead5b1341b", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109797, "uuid": "adb33a8e-9880-419c-900e-42ef419945c7", "value": "T104510A6E3A20161AEBF2AA3971C35345D6B14B5C7AF4F930480BAAE49851CE2478919A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109797, "uuid": "bebd6631-fd82-4591-889b-45b420998895", "value": "48:96Tv+e8YhXkxV2GIyubj3shuhGrLp2/uIOKjEZQNGOD1oQ+P3sU0bRsb/WT/4Rly:QTvb8YWx8GIXbj3shuhHWP+N4f+sjc/P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763109797, "uuid": "1ebf18cb-3e87-454d-82cd-d3ef5470b2ca", "value": 2447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763109797, "uuid": "16b49076-ec43-49b7-8c1a-3a46ba10466d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109797, "uuid": "c7fa6507-76d3-4564-b2a0-024053f5db19", "value": "Quotation B90SMD80_Ref183.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e25ab68-c0ee-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763078992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763078992, "uuid": "9c1b5c26-1ba4-44c5-a13b-f493e5f554ca", "comment": "Malware payload (Vidar)", "value": "af793f113305a25e0e9261c2d1ce5f0e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763078992, "uuid": "f5d350d4-0bb3-4784-a321-60618740e914", "comment": "Malware payload (Vidar)", "value": "12b3f864d664bae8d95231d11b3f16f2f9b19cc73bf22adfbb7983f2f67eecc1", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763078992, "uuid": "fb121dce-fb89-4953-93b5-a84f273979bd", "comment": "Malware payload (Vidar)", "value": "192e8614d22eebcdba9e0384ab45a7cb32510e1c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763078992, "uuid": "3cfe2f29-1dde-4dba-b4ec-9d9c2dbe37c6", "comment": "Malware payload (Vidar)", "value": "3405088fb1eec6ef469cb8be631cd45a04527733b5aafb4d57a2d7b64e7390fbb0a0384cd447d500f062eb8f44bcf944", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763078992, "uuid": "fc3ae1d9-7d39-4441-acf1-807adb62e7cf", "value": "T1414423F5A95D65E6F65432330E7DA0291730351E7AB0AE3282BA1312F0FF6E489D4637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763078992, "uuid": "f55559d4-2ca7-4f13-a04f-2c1e4bc9673d", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763078992, "uuid": "7c4e5527-22c1-4153-beaa-e005a171cf42", "value": "6144:3JdauzO9hsFO5qRWw411JnMp+ZGZ1HzQLmpiPPcBI+LciIKt/J5:ZE0s5qhexUpjHM/yQst/J5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763078992, "uuid": "5013b4d8-2be1-4ddd-9c6f-7fe256e3688d", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763078992, "uuid": "a1b80fc6-c59e-441a-9023-908b6a7a754c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763078992, "uuid": "cc7f5565-a12b-42b0-bd69-4714fbc8e922", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1471184-c175-11f0-a129-42010a9c0007", "comment": "Malware payload (AURAStealer)", "timestamp": 1763137140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763137140, "uuid": "3097a95b-d8cc-421c-b5f2-19f1a01a42e9", "comment": "Malware payload (AURAStealer)", "value": "122fc6d8cbde935c0f419fc881b64e0d", "object_relation": "md5", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763137140, "uuid": "09b71d2d-7ae8-4238-b76f-fa1cc7a86c0a", "comment": "Malware payload (AURAStealer)", "value": "1322b99e88023bc20d99ba1186518055872ab3322667d2befdae4a3b5379cc9d", "object_relation": "sha256", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763137140, "uuid": "43c3f475-0e2e-4c28-a30e-37e7f38704e1", "comment": "Malware payload (AURAStealer)", "value": "a38e2cbc0ff409baa30a3ea14186631033ddba6b", "object_relation": "sha1", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763137140, "uuid": "3fd1c348-9cbe-4baa-bb09-e8520fdf0b48", "comment": "Malware payload (AURAStealer)", "value": "d355e1fe1c98bde6c8f278358f7b38950fd54c42ba0e8d806b306404931753c57408fd5dd02fcb5687e2d366887655be", "object_relation": "sha3-384", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763137140, "uuid": "5a043209-2f2e-416b-9413-2e98b961e447", "value": "T17A6744EE32F9A641BBFB1513A2E3418123361DF01D11DA1D38A9CA5D63753B0A3737A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763137140, "uuid": "bcee21f2-a360-46c3-849d-7d49b10ccbfc", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763137140, "uuid": "550ccee0-64e7-4791-84b7-b027ef5acfed", "value": "49152:FjhT/6W/GYaRsBg2yub4uqWX6dBudsTohmsRNaI0fO:yVLsBg2d4uxXJhqfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763137140, "uuid": "fef10fe0-70d0-470e-85be-b245796e9f23", "value": 31457282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763137140, "uuid": "ed3293c0-56db-408c-9168-ca9d8a947df2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763137140, "uuid": "5a6e6a86-1792-4de2-bbdd-781c71f242c0", "value": "UnlockGame.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5febd4f8-c185-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763143903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143903, "uuid": "010ed602-e68c-43bd-9546-e8e37d4748a9", "comment": "Malware payload (Vidar)", "value": "25c0be4357f0fe8fa4c7e527fcc1e867", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143903, "uuid": "dca183d6-9a1f-4f18-8ba2-b4f13b2d3003", "comment": "Malware payload (Vidar)", "value": "13d2b769d5296310c2c0edbb6474a981d022eed4bfa78dcc2527b62935827ae5", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143903, "uuid": "39b42a14-3b1b-41c9-9253-78cf9fb74bb7", "comment": "Malware payload (Vidar)", "value": "55db7cd28a53424cde6fdc41b458cdd481e45758", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143903, "uuid": "c9a889df-4c13-4e21-9a64-4dc9421bdb0c", "comment": "Malware payload (Vidar)", "value": "8d33fea5413bfa3a95f3e6bb1a8e1fdde27b806896bef1c31aee819ec352a3304ae1f42b931931e5998d3e0be69c7037", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143903, "uuid": "f442e11c-cffa-4e45-8200-c4459a7d7fb3", "value": "T1D895235227D40192E4B61BB1C9F342030232FC5467B9D2FF3AD1D579AEB32D996B2B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143903, "uuid": "ee6281d7-c93e-4a02-85fd-fa798a60de7c", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143903, "uuid": "b7d67b8b-e87e-4ace-b9ee-22c9ea91c04d", "value": "49152:vjtSj+0lTkbyXAbeUunl1OTIMdVPoj+QQ4zyWxMZC4kH30cn:pOnl1sI44+QQ4zNuZWH3nn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763143903, "uuid": "93b349d3-c362-45c2-b161-2d9e28152410", "value": 2015664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763143903, "uuid": "835bdb5a-efaf-4544-a742-4e71d38082fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143903, "uuid": "9acdb2a6-44a7-4904-9764-a0ab87279bfc", "value": "13d2b769d5296310c2c0edbb6474a981d022eed4bfa78dcc2527b62935827ae5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84b1076-c169-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763131998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131998, "uuid": "12325e16-9cb0-426b-be49-e2beebdc816d", "comment": "Malware payload (Mirai)", "value": "544e064ac97a7edd4351ccd99e816b71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131998, "uuid": "452fd7c1-cc2e-4b41-9baa-e2e0c5de37fb", "comment": "Malware payload (Mirai)", "value": "14658caa1212b1012c67587a0cd5834dac54cffbb732351405dc1e294456fa7f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131998, "uuid": "c90be196-eba2-4b8e-850a-6f4d04da525c", "comment": "Malware payload (Mirai)", "value": "9058856cf7f12d109788726de8029e05b0994983", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131998, "uuid": "a43718d2-50ed-4bac-bab2-3829e9a117d3", "comment": "Malware payload (Mirai)", "value": "d848c6ffef65729228ff1cdbb7d0ec28cdbf8b642b47bfe0a6ecc99f19829b5c0862881afb4e79b0f5e7386dd8cb3909", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131998, "uuid": "ac4dd580-89c5-4a06-846c-a94a11450f8e", "value": "T19423F1A4AC11EDFAD2E0103D8D55D99779136BECC07EB052129C4C609ED2A8A13FAFD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131998, "uuid": "06ba7fa4-007b-4af6-8189-bf8d88b39853", "value": "768:S89GDkewxwPib91wUqk61hw5gKVVat5mZbnXcjycXHBpuWdfZcG6a6Ql4COi+9qu:Syjx0k61hw5gKOtQZCyMHvuyZ4je9hjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763131998, "uuid": "4732fbdb-6b17-450b-823e-289556c07f44", "value": 45932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763131998, "uuid": "23d28769-6c0e-4968-bca6-6e7b035357c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131998, "uuid": "444fa5bf-fde1-4886-bb00-7e52f135d47e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd4ca8b6-c163-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1763129564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129564, "uuid": "6f9e73f7-d1e7-4cc7-91f1-8ebfd0eb31d7", "comment": "Malware payload (AgentTesla)", "value": "da614485e6e3a182a9a727e0a11581d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129564, "uuid": "19ae9429-56f5-41be-854c-3d9c6e1e6d61", "comment": "Malware payload (AgentTesla)", "value": "15ab29030bad8b82da85fa1af7e0e988f679e49b1c0292588a6a86a7ab0b6efc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129564, "uuid": "5f1115cc-a069-42d6-9699-c2a83369974f", "comment": "Malware payload (AgentTesla)", "value": "1cd2ce014eb3734b4f20742fcb65230a7a614f44", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129564, "uuid": "4558c53e-fc82-4cae-bcab-2e2196af3f30", "comment": "Malware payload (AgentTesla)", "value": "5a0bbec92057e519e847610dd62bb70344c9d0eb15123b4f325e080aa5cce75f449c41861e6590e226d38279f186d791", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129564, "uuid": "82f6580a-b377-487d-bad9-469a333a14b1", "value": "T1014502158DC82FB9CFBC991880FE161DD3E04A9A5026758AFB3BBC46AFF7644410B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129564, "uuid": "66136156-1c25-47c2-8933-ccc92c7f9b73", "value": "24576:ZFNAddFRJjYzSi7GYIpwVHwmU/rsGjq7NUff:ZA5OqF83C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763129564, "uuid": "47edca6c-f979-4577-b11d-6d093d8b9f6c", "value": 1241788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763129564, "uuid": "8f27880e-6ce2-42d5-9de7-4840a818b91d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129564, "uuid": "0110e55a-eee6-4ac0-8699-1a400bd9ce12", "value": "800973827827827.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176665d5-c152-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763121877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763121877, "uuid": "07d6db91-80f2-471a-8f94-965793cf75be", "comment": "Malware payload", "value": "522de11d7704a4b75092104f8bc8835d", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763121877, "uuid": "57a04088-e6dc-42e4-abad-7b4fd72abd41", "comment": "Malware payload", "value": "169f1204aed49ec40813b0df5f39232971c74cde1f89f045ad033451710b5c9d", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763121877, "uuid": "3a9eb530-e1ed-4290-a7cc-aefe688e83eb", "comment": "Malware payload", "value": "b4afa712eae41bb74e8aac0384ff43fdbaef4660", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763121877, "uuid": "d050c0fe-83d3-49d0-aa74-6b421c58de0a", "comment": "Malware payload", "value": "cf82bde27854975aa3a1d302ce4e812eb7c49f1e1b21b34901f9e7e3b168e5370a8c7e87168e9b8192d6f4ac707d1270", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763121877, "uuid": "5f7e5da8-f536-4f2c-aa3f-8df6a22ae213", "value": "T1A9B7336136EE543BF24E3D7180AE432BE3269C4D4309A0E75B5A3F70D6B1AC15A3672D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763121877, "uuid": "4e1bbce8-6d8c-4d77-baea-3c9edf12a512", "value": "1572864:yg5IPqrAARDJ40f/eWULLAX0AVlOB6reJb:vIPqr3xFf/NU+h7a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763121877, "uuid": "bd0e73ba-f132-4c71-a773-e9bdb69a7efc", "value": 51036160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763121877, "uuid": "b90a840b-f34a-41ce-93e6-82c3f2075b6d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763121877, "uuid": "b548ec38-f0e5-4a41-8e52-74651411aa6c", "value": "169f1204aed49ec40813b0df5f39232971c74cde1f89f045ad033451710b5c9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8b7e261-c0f8-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763083546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763083546, "uuid": "d627bea4-c7ce-4025-9bb1-ab416a06e266", "comment": "Malware payload (Mirai)", "value": "c8f492070057bef91f1236f5fd4c236c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763083546, "uuid": "f9e7ee57-14f3-470b-9265-0f3744b81f1c", "comment": "Malware payload (Mirai)", "value": "173a0545106b03d2fc0e5a61fce54363b1926b66d4e8d3aba4d09de9a2c2e071", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763083546, "uuid": "abdc2952-038a-4018-a489-7723092baaff", "comment": "Malware payload (Mirai)", "value": "3e7cc20110dcc1da5cdfba41fe16b71a85bee5aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763083546, "uuid": "0b79acf4-15fb-4d09-9648-94d5d21529a3", "comment": "Malware payload (Mirai)", "value": "662192b817044c9cb556f1e090b7e4e5601b7583673d3038991ec9e52005c93287ab70a805ff5c7cd053e573b4f602d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763083546, "uuid": "0383e1df-6309-428b-98b3-7cccc48e91b1", "value": "T169530986B8919A17C5D4A2BBFA5F41CC332263F8D2DF3203DD116F557A8A82F0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763083546, "uuid": "d6718b04-79fd-4b9d-a1f7-197ad3037660", "value": "1536:Ojbf55p74RENLCSUTIIDAlzjHZjjvle06uybVR:wbf5tGrcHZfv/6uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763083546, "uuid": "680ebe35-f6cf-404f-ba66-a340cb41db54", "value": 62316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763083546, "uuid": "47af8999-d5cb-4636-95b7-83941c8aafba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763083546, "uuid": "296b9ec0-9add-4f7c-bb1f-d713f2238bd0", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89eb7596-c127-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763103601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103601, "uuid": "f3a35fb2-4d82-4732-a05d-fc53f13efc2c", "comment": "Malware payload", "value": "0c95e7e0a0362fc626fed58367a162e9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103601, "uuid": "cfa3bd2c-7bb3-4faa-97ec-445ea4219dc6", "comment": "Malware payload", "value": "17fabae3433c096512170c43493ad30870fe1c2ff507176d07e4ad088471582e", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103601, "uuid": "344ebb47-bcd2-447c-9c64-e1fe96aa7294", "comment": "Malware payload", "value": "431667959f07f60021c24fad2aac69ce63ca1edf", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103601, "uuid": "090832a5-82ed-4d9a-b854-8407d5b77a62", "comment": "Malware payload", "value": "6a9a52ec6c726731e842612b735b6529210f527c18e728941a3b825060f9e622af895cc6b8b6a7084dc164c83ddbcf43", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103601, "uuid": "26c698c2-5732-4414-bab9-2a1e34a15aba", "value": "T182761203F78F492ECDD2B9780D9313716619ACAC1910928B4A12F718BEB36D96F25FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103601, "uuid": "010026a1-3e00-4333-b4b4-5045689d4955", "value": "98304:8yi7cbqLnAzXKp8C1Fijyj3Ww73iXISklqD/eXAJ6a7DhGLpMzkTDe+dM2zWrKWV:8r75nAzMTLRbieIYoDhEnDeB2zl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763103601, "uuid": "d09eb39e-8b6b-4dcc-86c6-3908738e2040", "value": 7128260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763103601, "uuid": "cea2502c-0ec0-4abd-9fdd-e583fed431c9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103601, "uuid": "04b38b6f-255a-4143-9e61-14e740265e18", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750b13f4-c0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763081232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081232, "uuid": "db8bd273-6d10-4838-a5dd-752eab5fbf92", "comment": "Malware payload (Mirai)", "value": "ccd405c9b41c7b7d66484ee94254c301", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081232, "uuid": "de6aaed1-7e12-4001-af9c-907b6e4dcc61", "comment": "Malware payload (Mirai)", "value": "18726a426e6f3b1377d3007eaf0977d7b9c55a14278df257835c8aee7bd1903b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081232, "uuid": "b0a311f8-0398-4738-8994-7b73bf0de1aa", "comment": "Malware payload (Mirai)", "value": "945ca41892c22e2d4ded66e426d52b11255fa4a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081232, "uuid": "cd6de595-1c17-4fb5-b52b-743b33bcbcd6", "comment": "Malware payload (Mirai)", "value": "b0bfbb307d54599f52647a9af44a7dee69285e0329965981d54ff1ec50cafe7dc8bd01ad593383089e73399ba3f50680", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081232, "uuid": "2bc651d2-c924-4f30-94b9-02b34c9820fa", "value": "T18EC2D1E07726FE31C4206C7EE52B4D8A3A51063C90FF353654259D359EC165B63E88F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081232, "uuid": "cb05be23-c732-4899-b6d5-ea4d9c4b16e1", "value": "768:eMKyhegCCMqfizjoNpd2vJdX6vwrGt9q3UELuE:NKy4qfqoeJdXWgGALd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763081232, "uuid": "cbbb21fe-c5d5-4f1a-a9b3-b71689b59944", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763081232, "uuid": "5bbace88-d3bf-4af1-b503-c0c419e1a8d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081232, "uuid": "08791905-ece8-4ee5-9ad5-06d3917f1e27", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee8b1e3f-c186-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763144572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144572, "uuid": "5cf8e80e-7515-42d4-be37-797891303ed4", "comment": "Malware payload", "value": "c9ef818e41a08c49ed9237f5d762bb52", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144572, "uuid": "ba816e96-e149-4c45-b55d-314ae1e99d36", "comment": "Malware payload", "value": "19d222b1c260f674fdc55d92b04565ecf770ac2053d336208954910b1fd63bfb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144572, "uuid": "6afb4de4-058b-4ed5-a109-361b3c23bfaf", "comment": "Malware payload", "value": "7ef780404f3394bbae5444c311d18054c6f9d52d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144572, "uuid": "93da8235-03bd-44b9-8edc-856b94b1db2a", "comment": "Malware payload", "value": "c8585bfe70d9868f7adaf135c1fb1a7d5f8a288527234d809a490e6f8fb2e13b33c2188d878f56ff67644ee0c824b405", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144572, "uuid": "9398495e-9eca-4323-b37a-d10c9ae2861d", "value": "T1D3659B2868BB506D9573FFA17EDCB9EADDDD2E522509645B1081370B8932F80EE4383D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144572, "uuid": "0169de3e-25f2-4568-bcb8-ce477bf07292", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144572, "uuid": "66d2d7a9-52e9-4a1b-967e-5d37fba4ce48", "value": "12288:GHtfMOQ4eADCa7xnxSfkLIA+LKxYESrx7utc4CrEhGKqGEsDO0MCXi1F0UoIXlrA:od84NhQCCH/zGP/RJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763144572, "uuid": "2133d74b-20c3-4150-801f-4e888fa8a973", "value": 1415680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763144572, "uuid": "2dc21ad5-0a36-429a-aa0f-6f3472ecf708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144572, "uuid": "49bf1847-0eec-44c9-8761-d09df281d82d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c852c88-c18e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763147628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763147628, "uuid": "a932a36b-dc69-43ae-bcc7-661ddd48f80d", "comment": "Malware payload", "value": "f49f47e9ee42a3dbcadd25822811ed54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763147628, "uuid": "eccd5186-d7f6-48db-a88a-74eb31df94a3", "comment": "Malware payload", "value": "19eafe6c2f779dd6f53eb028d4c70ec7ab2646e99906fea5a2a90bcb11f9503e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763147628, "uuid": "76b54d6e-f580-4c85-9d29-17485e3f73f7", "comment": "Malware payload", "value": "bc67af39cef2c613ebb92abfc75328bcce59ad20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763147628, "uuid": "186d2df2-bc92-4a57-8161-b95314cd0a99", "comment": "Malware payload", "value": "cc9a9a3aa2dcd72cd964c6f4ff763c0b9c146c918da25cd1dcf66e812683f4566bd682f9933093c624fbe3fa76e8816c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763147628, "uuid": "e8bd6677-cddb-4288-a48e-e4df35d8cf8c", "value": "T17D269D577DD84C65E06DA231CDF255A67A36BC482B3237E32D207B3A6E727C00939B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763147628, "uuid": "d16d0c22-0c95-4bca-bb62-93352a1b97e6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763147628, "uuid": "f3e9470d-03e2-4df7-887f-b83a64cca16c", "value": "49152:mRzPtUVOdzD2r4vTA04OiZrq1DfP+rsNADtV6v+L0uSwiPSCmDS+5uSlgQoj:mxBVs04OiZrq1DfPHNADtV6v+mj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763147628, "uuid": "a0d089c5-ad30-4d35-bab5-f1121871447f", "value": 4433472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763147628, "uuid": "6674d84e-9d20-43cd-8e3e-bbe2918d021a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763147628, "uuid": "04d5aa90-d88a-46c4-86a8-b8b6bd2da2f0", "value": "Battlefield6Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33d8c0c1-c1a2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763156284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763156284, "uuid": "3920a6a7-e98f-4d10-9235-a2e90edd2ab7", "comment": "Malware payload", "value": "6e020886f88001f48a0b6b25256aab1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763156284, "uuid": "e095a2ba-71bf-428c-a98a-d6a7a8424751", "comment": "Malware payload", "value": "19f6b92a842e6bf50f9b91c5028862259ed98aa7a09759711adbc58fd97d1e17", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763156284, "uuid": "14603ff7-d3cb-4731-8591-ec856ab5f06d", "comment": "Malware payload", "value": "b0047fce41fdf08e523e515706221fdd4e69475a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763156284, "uuid": "eb05cbbc-90b8-4697-a90d-ea4aefcd952d", "comment": "Malware payload", "value": "25b766600c240baef6b6da3ad835d994509250e7c6059090a654f447d5349cce65bb6877c54f8e59f193ec7590f1adc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763156284, "uuid": "ed64618d-def9-44cf-9018-fa8628334955", "value": "T10DE5B81AF6B650D5E1BAC038D543522AFC7134A5833C97FB92818E895B60BF8EE3D741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763156284, "uuid": "2a9cb44a-68c5-413a-9d1b-74313aa16c44", "value": "9f71757441e73210351359a9f7ea7d18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763156284, "uuid": "dfb96acf-7ee8-4e1d-8c43-d655f256f0f6", "value": "24576:8XdAQbiRAjV2adCKkpzu5LJ7zuf33WRiFXlr9Vx0f3R:8/btJOS5LFzuvWWhZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763156284, "uuid": "5799f58e-9483-4129-9e99-7df874407be1", "value": 3259392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763156284, "uuid": "ff80f97d-d8d5-4a70-b491-04a8e45aea2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763156284, "uuid": "242a0bb9-c9c1-4b41-a120-d673f4fdb35c", "value": "SecuriteInfo.com.Variant.Barys.334082.7517.17267", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "222842e1-c0f9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763083670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763083670, "uuid": "8f3f52d4-0c10-4990-9f72-8d239cbb353c", "comment": "Malware payload (Mirai)", "value": "876f4aa977817acd0b4ca8091f0f4e24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763083670, "uuid": "553d9ad2-9751-45cb-8878-6f94653e83e9", "comment": "Malware payload (Mirai)", "value": "1a36edf2298f83ff239086b7e89cecce96f29cf785fdfc7539445cbf8780d93f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763083670, "uuid": "c1714781-2daf-4219-a613-16b30a47f3fd", "comment": "Malware payload (Mirai)", "value": "b53a5c013f25d607a024e2147b652b40fe962f04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763083670, "uuid": "045db7e6-302c-4bce-affb-00abe6e63eb0", "comment": "Malware payload (Mirai)", "value": "31a7352b2524dd2953c87dc393dd0025a8ffe7670720e2e16e2b44712fe64ee3b5b21423893878acd9f514732666712f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763083670, "uuid": "68160934-52bb-477c-9381-238f7bb58e02", "value": "T17063F786B981CA52C5D552BAFE1E12CD331313B8E2DF7313DD106F647B8A82B0E6B941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763083670, "uuid": "b0ff70de-74c2-4c0e-a2e4-a29e2eac2ecf", "value": "1536:HtnDkKqNpAIy1XQJXUqLdONMT7Ovi9aNRm3iMliXquZd7muybVR:KKKpgXQJXtLdS+OqoquZd7muy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763083670, "uuid": "69ce810d-8e32-4968-873b-4b289305324c", "value": 71516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763083670, "uuid": "e6b45b42-3b8c-45fe-abb0-ef884dd89fd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763083670, "uuid": "ad7973d0-b0d1-41eb-9e99-6eacb5a9a761", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dcf21be-c17a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763139041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139041, "uuid": "5cac6b1c-6cdf-4511-9376-e6e8277aaca0", "comment": "Malware payload", "value": "b9806ff28c737571a4aae07e7be3724a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139041, "uuid": "74745252-83d7-4824-92b2-10ccecbb7ad7", "comment": "Malware payload", "value": "1bf3f5740e7805ec0491328aa76dc7645e28da24fbd77e8bf26efa519d59629a", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139041, "uuid": "c195088c-84f6-4ec6-8acd-0e8b75e20d3e", "comment": "Malware payload", "value": "59ec844c8d080ba6ab110a4f0be9ea9b8e0859a8", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139041, "uuid": "45424c18-aa7f-45a7-b798-c011d59f1203", "comment": "Malware payload", "value": "71c0c089be4ece6b01ebb8ad8684a8b8be725d24824c1895726eb86352adf3583cc257a177739cff0323ca120350fc1b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139041, "uuid": "5ed3f776-6755-43b8-811a-63b4c2e60bae", "value": "T1DF110043340B8845F2A2673315C48F10CB5047673381A7170EA140E35F79AD95AACA3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139041, "uuid": "ee80c014-4693-4b0e-9438-8ad144462eb5", "value": "12:5jCrrLNS7nQBpqd8D7RbdW4IYywa7nQBpqd8D7RbdW4IYcxBHrrLNUWJwot/:9gleQBpqmVbM62QBpqmVbMRlmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763139041, "uuid": "e5ca8020-5d28-4d87-bcee-03a1e15e0a26", "value": 890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763139041, "uuid": "fc6570a3-928a-48ec-97ac-71168e38c6f8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139041, "uuid": "c43c2175-4600-41ed-afd9-942ff5ebec51", "value": "Attachments.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "535817f9-c152-11f0-a129-42010a9c0007", "comment": "Malware payload (GCleaner)", "timestamp": 1763121977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763121977, "uuid": "8c9697e3-465d-4837-9c0d-d1389929e932", "comment": "Malware payload (GCleaner)", "value": "55c320b105e359a5f2aac94711258b53", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763121977, "uuid": "f52427bb-066e-427e-b6a4-641c9fcfe3bc", "comment": "Malware payload (GCleaner)", "value": "1c5c31e97199c52a345e8b19bc9e6b31fa8d4112accdc346c6505094d8be2b2c", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763121977, "uuid": "b266d99f-20fa-448f-a086-1c191c99962b", "comment": "Malware payload (GCleaner)", "value": "8b7233f87886bfe80f1cd439da1e1d7546ce784e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763121977, "uuid": "2be235cf-d1c6-4b4e-b72f-73d0c5e2b08f", "comment": "Malware payload (GCleaner)", "value": "06863a2a4233bfe7068d227fa01dbf62d16a76edcea057efd7ff79ee548a22a9f4fe80335a3a78043fc2f6f9e3644fff", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763121977, "uuid": "f17c85e7-114b-420b-bac6-dc0abe603b4e", "value": "T11A36E1D8EB2127D5E0E0B53C3DE64387DE38F516E4449F2EB6A81C24DFEA55B2018674", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763121977, "uuid": "508016dc-a563-4508-88c5-f95d9c8a2941", "value": "ab7081b679a7441de02c2d264b1daf22", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763121977, "uuid": "820cd588-9570-4cfb-b793-a86f37fe78a4", "value": "49152:78TVIVkJdw81EnPxHKG8uHEtwE3XFcICpOW6OSrywUnRkCYGF5IcdW8NC:7UiIy8U00UrGIg6OSrywMew5Ic5C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763121977, "uuid": "b85c698d-ef5d-49e9-8b58-4ee5ec45d90a", "value": 5010192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763121977, "uuid": "a1039b03-84ed-4954-8802-fc96db61dddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763121977, "uuid": "2f003b3f-b8ed-475d-8894-3e75949312fd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d9852b-c18d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763147369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763147369, "uuid": "0b1afd71-88ce-4f7f-8790-bff230e4d1ff", "comment": "Malware payload", "value": "ff846d002885b3abde8eadd111b97d1f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763147369, "uuid": "f48dd63e-fe39-4dce-811d-c5267146bbc6", "comment": "Malware payload", "value": "1c98dcb9fd0181016e50a12eba10a4c51202b6a9c977c0f70d083d7e9501fcec", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763147369, "uuid": "3e6b2bdb-db03-4904-88b4-423e792257c8", "comment": "Malware payload", "value": "4bc946f0d88ad45f059ea7c067019f0e2ff95a80", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763147369, "uuid": "2a48b5df-fe52-480b-8672-c6060dae6e4a", "comment": "Malware payload", "value": "c2dbab2555d70a8a1ccbaf0042cc764c69c8e33dbf4f1f0bbe9bc9a33f0c1486f7c84248a825ad0077b7f84cbaa4668e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763147369, "uuid": "263b106a-48dd-4067-8102-34c49466d73b", "value": "T170C1835A6EEBD8182143745E497F840C7293E0872084CFE638ACE281AF5576C16FAA7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763147369, "uuid": "bae3ce7c-c195-4c27-bbd9-15fe98d3f3b6", "value": "96:7QSf1Zj/ZFNTNFiYvtQuUOHfKoKRNfd2zYU5oH0HKHJO5/jQjdSaiyejn6kNgsCu:bZzTN4YV/UOHyPTfd2cU5oH0HKHkj/aG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763147369, "uuid": "43531c89-e19c-4ab1-ba26-e111633ef2b8", "value": 5741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763147369, "uuid": "886f3f32-8217-449f-b549-8bf0496cdecd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763147369, "uuid": "4d27cbb6-fed5-4806-9da2-f9cbef855a26", "value": "profile.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd70e1c-c1b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763162849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162849, "uuid": "94e1b2d9-761b-4ed0-bd38-7b3745ceadf4", "comment": "Malware payload (Mirai)", "value": "89621702be080d11492201a625787679", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162849, "uuid": "4942a0bc-6a62-4dc3-9d89-a616d0dfbf87", "comment": "Malware payload (Mirai)", "value": "1f3d38db2725255ec9aab6caa0f3f0b4f477d6f5a142cd836f3e7211f575791c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162849, "uuid": "e6e6193e-2142-4b94-9b6e-2a44f309f8c7", "comment": "Malware payload (Mirai)", "value": "296929ca62fe0d809577507e652d448f88e11d7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162849, "uuid": "c8547fb7-9611-4ca2-8776-7c52874a5c9a", "comment": "Malware payload (Mirai)", "value": "28b6290de75883d22a1148235bf7058f9ad8c352116bc82daba6cc7f09715dfc85696723ef5490401ab2ab3d9c0328a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763162849, "uuid": "c09aca4d-26ee-4f09-8be6-f1bde4af937f", "value": "T1DDA36CD6F643D8F9EC2241303176FB378E72E5BA2128DD83D7A49A72BC52942D406E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763162849, "uuid": "2d05c3b1-7c48-406d-9689-f6505098a184", "value": "1536:KnJyYba2qd7fRRI7GEBOkfmuWwqUwRTG03g4aKBtlgALf5SZ+ZeiNE/:qFbaViGs1fmBwq9RTGyXVtXD58iNE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763162849, "uuid": "bb659c09-63d7-455d-9a53-861462582ea1", "value": 100564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763162849, "uuid": "e55e77ec-ee5e-4789-8d23-890608c253ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763162849, "uuid": "1acc16a6-69a4-4587-bb56-eff69616e388", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1bc3fc1-c13f-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763114083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763114083, "uuid": "920f8a70-1b06-43de-9fca-fd3c9c05650a", "comment": "Malware payload (RemcosRAT)", "value": "9e6439602817cd9311abaa1f58919282", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763114083, "uuid": "5544d59b-8ce0-475f-a6a6-4336b8e76839", "comment": "Malware payload (RemcosRAT)", "value": "1f7fa6e4852518a1821aa5674a9e05105c612bb0b161e67407352f71ad93de65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763114083, "uuid": "11b9fadc-628e-4f21-be88-aa762dbfdb64", "comment": "Malware payload (RemcosRAT)", "value": "ce6e3186dc93dd1962288f074de8898d5d8c222a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763114083, "uuid": "2efdda15-0768-4790-85dd-4cf793c49039", "comment": "Malware payload (RemcosRAT)", "value": "2b98df9d264956987f39cfc600151f1a54c57407730b485e8856309d42f4987b6c1ecba3a34b86b8d565e59abb684863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763114083, "uuid": "66b3a5c1-84b9-482f-8bdf-755be665b9f7", "value": "T1C4B49D01B6D2C1B2D57654300D26E775DEBCBD202836997BB3DA0D57F970180AB3ABB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763114083, "uuid": "4c00d34d-c050-4919-816f-304a2cd25beb", "value": "78a3bdf3c5b9bd3972e77fa90dce8f2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763114083, "uuid": "fdcd3b57-f2ab-4eb8-8110-fdde6d108533", "value": "12288:iN9WLGVGUYcvqvvCNQzvCZQBm+sPZ6iSw:iN9sGV5YYqzvCZQBmtZ1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763114083, "uuid": "cf6f1df2-2185-48c5-9b1c-60b718b5f5d5", "value": 506880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763114083, "uuid": "732bc7eb-868a-43d6-bc05-c8e4d5aa0c90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763114083, "uuid": "1b832eff-f9be-46d0-bf4f-180a2c686311", "value": "mxkcbpejbqdcoccxmelbqigagbj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0eacb43-c12c-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1763105813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763105813, "uuid": "1d3cb897-1429-4033-9c55-93ae4b39442f", "comment": "Malware payload (ACRStealer)", "value": "99f23c38a9f9309c70423360eaeff22d", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763105813, "uuid": "19c2ee36-d608-4b14-8118-75c194f146c6", "comment": "Malware payload (ACRStealer)", "value": "1f932c25c2ab37ea44652ee303d3b3ec2340fd60a2947b896797ef575fe957bf", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763105813, "uuid": "c5074512-48f0-44ae-baf6-bcdfe2d80dba", "comment": "Malware payload (ACRStealer)", "value": "957cef9d30f38ca866525192b5e6be028bda53ab", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763105813, "uuid": "193c047e-8e5d-4233-b402-2f8200c094d8", "comment": "Malware payload (ACRStealer)", "value": "3daeb39937f71027390e9bfe5de5e3f26268b1cc85ea40e9db6357c5cffc917b129eba438db8cb166c825d1eec31066f", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763105813, "uuid": "b7e51220-94d0-4cf2-98a4-fbc85d95828e", "value": "T1B373BCE0F240D8D0DEAF4E65B0FA7F0D8960A357D5C27611217CB0B42EB6B42E69EE54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763105813, "uuid": "ce5f84b0-5f26-41c2-8967-82f5e3769d66", "value": "768:jXaucJkhciGrq/y7BxT8xvum8Vfj+/0+0HXnHtaqY2JVyOpTgeSRCCWIIaU6oSu5:jXah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763105813, "uuid": "19abfb0b-a2d3-43af-a2f6-9535579bfa49", "value": 76650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763105813, "uuid": "da7b99eb-9341-4a62-bc95-f32ed138b857", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763105813, "uuid": "2db525e4-02fe-4a4a-bc93-c946d1583512", "value": "stage2.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f61472d1-c136-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763110224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763110224, "uuid": "ec1326dd-5e49-47c9-bc48-8e5cab8f13bf", "comment": "Malware payload (Formbook)", "value": "5aba4fd043149a95b25c144a6b93659a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763110224, "uuid": "f0579ea1-a1d4-47a8-a600-1edf0378580f", "comment": "Malware payload (Formbook)", "value": "20aaf8d44238dfdc2e22c6560fd89dac4dabdf9345d432590885ede97913dedb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763110224, "uuid": "9f0e03be-b4ca-45a2-bb19-00e1b31b6078", "comment": "Malware payload (Formbook)", "value": "b8312726b59176ea94a6108856967b70af56a715", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763110224, "uuid": "b175d1ab-5c98-47b6-842e-81d921f00dcb", "comment": "Malware payload (Formbook)", "value": "c235d946e023303d1b1142454ebb897bf9e82a76bbab37e496361d23bc6b08b4fce7678f687c6b1b0631d4e033f8f07d", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763110224, "uuid": "60e2a8e6-74ec-4f2b-9bcb-99c900d3448c", "value": "T19BE423C20C8AB975F372F06EC8CD9708B31692C999B5286D3253A8C7F4D5E1C9921CDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763110224, "uuid": "4df47af2-dc44-4a5e-9a63-059e1d9c3686", "value": "12288:RQafDSfRgTqttzaBBEKDPx8Eu0BO+0AXwl48zGJAgDRQlvK52azFm:CafutrKDPuEG+0Agl3GdDRn52az4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763110224, "uuid": "2eb07cbc-af74-44e2-822d-4d98d225fb5b", "value": 684351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763110224, "uuid": "71d609ee-33d3-4001-b59f-73ac224e29ce", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763110224, "uuid": "07fd7a7b-9343-40d2-921f-fa5a74b6c30c", "value": "PO 250574.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549d7762-c196-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763151185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763151185, "uuid": "7d97d752-4039-4bd1-8f28-0deac593f60b", "comment": "Malware payload (Mirai)", "value": "11492366419c8ff643be2c552b982fa5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763151185, "uuid": "ce6e418e-b8c0-4332-96cb-267d59343263", "comment": "Malware payload (Mirai)", "value": "21782793f8c22a44cc00c57d28fc4468469c09be0879bae0921e423ff5a55f17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763151185, "uuid": "05d8b086-2259-4c1f-98c9-e17f7b92184d", "comment": "Malware payload (Mirai)", "value": "194f7e7717f0f39af115fbea91f03d3d4dd3a682", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763151185, "uuid": "2a4893a1-3c1a-4cad-82f9-be3e6a1e4c6f", "comment": "Malware payload (Mirai)", "value": "9f248263a3353925fd6e2093a6dd6ab558c9a065b74fe8422cc3de30b6da91fa90017ac874c6fcb7e36b7ba88dc4b0d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763151185, "uuid": "ab040f6d-c8ed-46d1-a2c8-0996608be776", "value": "T15F23F1B8691381F9EAF360BDBB9C17530A714BB582508D8DDA41EB53AD142B87C47AA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763151185, "uuid": "91029320-083d-4205-b9e9-4998d67e7cad", "value": "768:YeFEEzPeIJh4f4dSYMi14cJr1Lt80kZsyh+Z0brmlMsaNSY6J78Qo7Hxv1IJgGl5:nEEzGI//gZ6k0kZHhUNoSYwIQodv1IVx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763151185, "uuid": "e1213210-b1b0-4ed7-98cc-1c0ff09da9ff", "value": 48488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763151185, "uuid": "c429dd47-efab-45dd-8a27-8c51a46ef8ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763151185, "uuid": "c7b65291-1833-4b09-a656-b8ef431c0536", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91e363df-c106-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763089441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763089441, "uuid": "f62c60f5-d0f8-458b-be80-1b9ba6574d90", "comment": "Malware payload (Mirai)", "value": "6e0a0561ec885dd17fd20989a9ee6ebb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763089441, "uuid": "7374467c-0928-4d2a-b4dd-1384f5c9e1e2", "comment": "Malware payload (Mirai)", "value": "219bc8d1db282a8e855e6ecfc0490e69b5cbb81a186c900425ace96d4878a13c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763089441, "uuid": "8ed16c3a-3026-4d0f-aca0-3e511f43ea90", "comment": "Malware payload (Mirai)", "value": "5c702d322a03be529a4ffd8952a71403ab03b78c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763089441, "uuid": "8899b62a-63ab-4dcf-88a7-adedc04f4f2c", "comment": "Malware payload (Mirai)", "value": "e4e352363410793b325da5bd2ecb425fa3f9ed71ad05d690f54c46124d362989c64e05446edc6c99ebcfb776fef46797", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763089441, "uuid": "af622c12-ebf9-4c6d-b305-efd3f69b7b6f", "value": "T1B8432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763089441, "uuid": "677f9ae0-a6aa-4191-8104-06f986ddc8f7", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwD:RqtmZPuutfbltZFBSJsBcfDSTFI+BED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763089441, "uuid": "f9152196-2256-4bef-9094-54ef252e144e", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763089441, "uuid": "913cfef6-6ea2-4c28-b13c-3d232d228b2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763089441, "uuid": "dad549fe-1716-4690-bd8d-adfd600dbb95", "value": "boatnet.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950e9106-c15a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763125524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763125524, "uuid": "43219aa0-f51f-446a-b92b-b3573f30df48", "comment": "Malware payload", "value": "5c38d12158bfeeb9b9002e41463306b3", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "theoremaoliveoil-com", "colour": "#EF97C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763125524, "uuid": "a8944f73-f828-48c2-bf2e-22f150277bdd", "comment": "Malware payload", "value": "24a5f8a5d6e8068b3fd39e237fa58085b773df193fc5ef71529de0eb248c480e", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "theoremaoliveoil-com", "colour": "#EF97C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763125524, "uuid": "a88937a8-4b8b-45b3-b504-3e4885c79ee4", "comment": "Malware payload", "value": "f2a09873e3b59b2e4f24480d0fdac35f67c27536", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "theoremaoliveoil-com", "colour": "#EF97C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763125524, "uuid": "98ee9fc5-01b8-4799-bc43-2d13c5cba209", "comment": "Malware payload", "value": "21d58914b9284f014f4b1c34b767366f56b4864a2cd3c747e24787a8ba4655638d3da747beb2fad766afe7c0cffac588", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "theoremaoliveoil-com", "colour": "#EF97C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763125524, "uuid": "f3b9b25b-b0c2-4979-9aad-76a8d1f66f54", "value": "T107E179E5BE1C45E41ABB125CDF928C82A95DA57415F84502F6BE8C0BF79FE2481F0B0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763125524, "uuid": "e87278c5-1c11-4775-a243-ca6c685c09ad", "value": "192:J8vOuLf6+qUClbRZqwiJY5AH+W4BJeGZjf6H1vTqTZTL:yvQ+yo+y2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763125524, "uuid": "52b130bc-dd7e-4363-b8df-483bbbd681c0", "value": 7371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763125524, "uuid": "fe6874e9-52ed-4750-a9a0-796fece53a47", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763125524, "uuid": "7e28b3cc-9cc4-4304-8a96-54844a96a3d3", "value": "resizedif.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9812dfd-c122-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763101506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763101506, "uuid": "6a330fda-f23f-42f4-bb6f-9f98286e870f", "comment": "Malware payload", "value": "de42be2a8bde0e1e4ac8b07e0e127304", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763101506, "uuid": "3ec28a2c-6d64-43df-b5c2-980a316c3290", "comment": "Malware payload", "value": "271357208522378b9e4c64c888122a59431fb12317d8fab113448211d435e2fe", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763101506, "uuid": "d3770daa-fa46-4979-9a48-3e5eeedbc1dc", "comment": "Malware payload", "value": "c2ef229b82fb68476ec101cb0563a1ca441c0ff8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763101506, "uuid": "ea17c7ef-8232-440c-9770-4d14f05e478d", "comment": "Malware payload", "value": "73b664fc117d57c9e826abf7024e0eb42af994ea015467e17f7edf5603edfa409edca342d897159930f4c77f72a56bea", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763101506, "uuid": "42e7e9f0-33e8-4c46-bc9c-b167f29fa812", "value": "T107183322E75CB917E5B3B1368ABF462B51060C9C9D45E717394AB24C29F39C09F8BF84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763101506, "uuid": "a6cfc05a-26ca-4611-b169-6d87305c1eee", "value": "1572864:TYjitHbkq6oLliyheWZNS5KFFOXt1WlHffODbOpfQ1tPRLU2PI+LsSrq5a7jHi0I:Tw07x6Eliyv05+F0tgn2bOpfQ1xRrfG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763101506, "uuid": "994b1252-1393-437d-a4fc-172ab70074be", "value": 85772988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763101506, "uuid": "adaea063-c659-40dc-ba87-a479f7ece7f4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763101506, "uuid": "5c086c55-66f4-4e55-a07a-b68f681412bd", "value": "Proton-VPN-v5.14.29.0-MOD-OTR-(Getmodsapk.com).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0514403f-c16b-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763132583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132583, "uuid": "f4ee33b6-c757-47bc-9f35-c93582eb9cff", "comment": "Malware payload (RemcosRAT)", "value": "156d81dfa5a01cc905945ff4ee088d18", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132583, "uuid": "b9dd8d20-8fb4-4570-972a-8c4b54ed9130", "comment": "Malware payload (RemcosRAT)", "value": "27e389714555426921ad01269c2885acbbfbf936d5bf0194947e775937d75a8f", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132583, "uuid": "06a54626-40cf-4554-89f5-0187a9f40519", "comment": "Malware payload (RemcosRAT)", "value": "cbb672800e157bf40cc28083e7f7d5c08c3ba286", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132583, "uuid": "7f2ca804-0cc8-4d3d-8455-557ffc9e0ccc", "comment": "Malware payload (RemcosRAT)", "value": "03416078dbd5f9d3909cb4f76e18105cf8a3eb4b6176e544cb1319eeab843923440c68e4afa0674834963c266d5a84e9", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132583, "uuid": "0cbf944b-2009-4fea-bdc5-3b5a826c6714", "value": "T18CD502158AC42FB5CFAC5A1880FE161E93F05A8E5066758EFB337D46AFFB944020B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132583, "uuid": "adca0c21-05e6-4f40-98b4-6a4d3395dd79", "value": "24576:n/EMFJzZe7Q8u6pdO2j5YYiixiBmM839vO49HowdbHiDzJV1h+6MZX+ve9UFPBpR:nXB6pU2j5pJrZrHeD65X2eKBp8UH+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763132583, "uuid": "090ea43f-9339-4cdb-be73-cb6e6ce5bd1f", "value": 2865084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763132583, "uuid": "6f7b6deb-ba8b-4488-ab43-26f611f4a898", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132583, "uuid": "e12b2956-f090-44b7-9667-1e7f2e9803ca", "value": "BASE.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f4ba2e-c0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763081262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081262, "uuid": "c1ed98e1-2efa-4159-8854-65b51fdb342f", "comment": "Malware payload (Mirai)", "value": "a848aed5ac7d0b9412c836ab2f56c502", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081262, "uuid": "f2cc47bd-0730-4500-9397-af8e0e655d24", "comment": "Malware payload (Mirai)", "value": "27e9736683e9692c202a812948808f4c65a42f699ff7914563e5e5dde0ebf8b7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081262, "uuid": "b3b94ca4-e0d7-4a81-b4e8-073cc6e0c125", "comment": "Malware payload (Mirai)", "value": "ffb2946f549af37b61edb6e6cdd5d70e1a4fdf78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081262, "uuid": "10c213be-462d-411a-b2dc-9bd972a5cca1", "comment": "Malware payload (Mirai)", "value": "6db421ba0f8ab4aecd9051c1f1d0e845f91c7f6943af73c0790d8a24666947b54a71e6510d3c8520bed84f7ba9ad14d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081262, "uuid": "512603a3-1a15-45d6-8519-82addb185e5f", "value": "T195630A96B8818F25C5D5037EF92D118E372227E9E2DFB2229E205F203BC652B0D7BD55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081262, "uuid": "cae5553c-a9bf-4ef4-8c68-bc0503fb661a", "value": "1536:itnPsVkFxV8xk6b5VKLNXduAlCjFlIr57uscvIGiojd70k7h:VqVMkWV8PPX9Cjd70k7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763081262, "uuid": "82f83990-98ac-41a0-962d-1a5c23cb447e", "value": 66864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763081262, "uuid": "d593bfcc-d000-4f2b-916d-6dee6893ec69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081262, "uuid": "29df2768-b6c5-4d2c-8a9c-1d5afe34ebb5", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ddec529-c124-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763102292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763102292, "uuid": "5294b725-f8b2-4c5b-ac72-465c14124dae", "comment": "Malware payload (Mirai)", "value": "fd4822258fcbcb8f168dfb0f1cdd1125", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763102292, "uuid": "a307f116-a055-4c01-8031-db7a70ed9241", "comment": "Malware payload (Mirai)", "value": "2b5cddb7a9d600d3d53ffe71255e13bb0c966152af28df5d4bedbbbce6011bd2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763102292, "uuid": "8bc87b19-2220-4681-bbd1-efd9922f8281", "comment": "Malware payload (Mirai)", "value": "055447236b470dd5d5c837a0ee55b359969bf246", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763102292, "uuid": "c4da0cc9-efaa-4419-ac32-53183feb7d26", "comment": "Malware payload (Mirai)", "value": "687dc7a6110785a989a0e691f9f373ced0d966a291242f8460b53f3c589adc5983594d7c2dd9740e43be28337dc96775", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763102292, "uuid": "624a5ab3-ac82-4146-a65b-d1f8ab2dd84f", "value": "T1DA62AFE475522C62FD711C74FA6DC4453A5647B8D1EA75B32284836C36F2E002BBEA8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763102292, "uuid": "90503dc0-dc05-43f4-ad45-67df8834cc25", "value": "192:KCp6MmJSlQ/a6ciKpR2chR2H38kCMTVhG3+mTiyhahcLwO/mdGUFR9Op2oDrOI/S:xUJS41yRqMkHGOSiych7qmdGUEpiayVv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763102292, "uuid": "9122c7c1-20c8-4e9c-9a26-1a0c515538e8", "value": 15572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763102292, "uuid": "081ed82b-89da-466c-8743-4218533f4b24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763102292, "uuid": "ba550280-5fd0-43c4-9c89-8e916cf29618", "value": "wewe7.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f28c4c8-c127-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763103582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103582, "uuid": "cc3f1fad-70ae-4a31-997e-b4228887e9e2", "comment": "Malware payload (QuasarRAT)", "value": "bae54ad92e6d464ce948c48e25961b5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103582, "uuid": "c3d95d33-7e03-4332-9dda-9f3651a34d56", "comment": "Malware payload (QuasarRAT)", "value": "2b782927fc933eae5dcc58fe16cd941d2c29bf9dd3f89f0d69af73404abaef70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103582, "uuid": "eb4477e3-4625-418a-963a-2fbd0c6fbd76", "comment": "Malware payload (QuasarRAT)", "value": "334de57ceca333979057407a5292e7682cac399c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103582, "uuid": "c022a0ad-9947-4cf8-b97c-554db2db81a0", "comment": "Malware payload (QuasarRAT)", "value": "024f93cd7c17cbda2908b4a9a2d913986aa267d125c0fb3c3bd2ae85734b27ddc6cc98493cb1f4510bfa67f58fb7273b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103582, "uuid": "f9d5c0b3-e1d4-4f00-847e-6cd584902f54", "value": "T1AE25D09177F44606E1FF1BB4E47209554B73FA06DA36DB9F0988A0AD0EA33858F513A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103582, "uuid": "4abfc52b-ef1c-477c-9726-e927626a760a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103582, "uuid": "525bcea9-1477-44d3-9d88-347745173a3b", "value": "24576:5TncyAxJzck+uGW/yFoBkkA8D+izrxJq:5TnfATYjqqanD5vP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763103582, "uuid": "cd830388-9a7f-420f-abc2-bf0890816024", "value": 972800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763103582, "uuid": "9a5c85c2-d025-4e6f-bee0-82694aa3fa37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103582, "uuid": "1667157b-419a-484b-8965-efcd632cf971", "value": "PClient.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd82258-c169-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763131873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131873, "uuid": "e6a96738-924a-4013-8363-affd5164643f", "comment": "Malware payload (Mirai)", "value": "5385b66493340fc95bbf613612eead52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131873, "uuid": "13a9270f-5ba6-4db5-b044-8c67c63ba848", "comment": "Malware payload (Mirai)", "value": "2ba5f3712d9a38f87f48fa9eb46afa20f706021bdb15b417756a4752389d74b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131873, "uuid": "1cc71441-366c-480e-9008-17f4b6c0a378", "comment": "Malware payload (Mirai)", "value": "666082f413dee63737cd9581e703cf157e8a6503", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131873, "uuid": "c33a625f-7bac-4d0a-850c-e0b4999327e5", "comment": "Malware payload (Mirai)", "value": "daefe45f5c0056fa8a0c2172366f2eab50f6008238d1575995795ed857982e8a0af8c90eff41fccfcf7d4305d4424c3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131873, "uuid": "8fc9b0fe-7519-47db-9845-df2e57684b07", "value": "T17303F166D992AE47FAEFCDBC8FD683E277070A0D5B4201D1518ADD611B0A439F940ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131873, "uuid": "bab8a3ec-163d-41e3-a28b-9d60c42190eb", "value": "768:QzU77DBbKPTHeUJrxnTdiSwja4muSJ8x9igRijf+T6dRMNJIoBd/PaBUkz4uVcqm:Z3D9KPTHegVTIO4muRHiIQTdRhoXAP4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763131873, "uuid": "43c12790-a125-495b-b81f-51ad0bf248f0", "value": 40540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763131873, "uuid": "8e8f29cd-01f2-47cd-af12-fe19a54a9d13", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131873, "uuid": "94f7929c-a067-4b28-85d3-94824de166cc", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb3615b-c190-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763148541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148541, "uuid": "07847f43-25a8-40d7-bbf5-325247106946", "comment": "Malware payload (Vidar)", "value": "39328f3b8abff9c919d545771cd789b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148541, "uuid": "1e454df0-9451-42f5-85b1-a5aa8917dfe8", "comment": "Malware payload (Vidar)", "value": "2bfb90df16bf55c7d75cf846274d333b225d74a5fff312011081e193aca87e58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148541, "uuid": "1be461d1-0c22-4749-b078-d65244fa8d36", "comment": "Malware payload (Vidar)", "value": "1e7b19d206235dd30e20b83cc5765febb688482d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148541, "uuid": "709bfe8e-73c5-4317-9b8c-686c17cde3df", "comment": "Malware payload (Vidar)", "value": "0d5f4d9e8734e366a6ff30e445d1ab435bb1314292f7df6a8649a2a63d46c29c038fa2ac2b4ddc2337cbee5449d184e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763148541, "uuid": "9e20ea3a-6f2c-434e-ba35-96afb8fb5168", "value": "T164F54B576CD24EA5D019E234E9A251623E787C280B3277D33D107EF52EF6BC61A32B58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763148541, "uuid": "14b260de-70ef-475c-b429-cbdcf2c40e28", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763148541, "uuid": "5f1ac4a1-b915-44b4-9890-abf2f1493917", "value": "24576:FA74rUC5bA1nvKhK5So++qACFPvOtzGbnHSYWjhTGTz/MUcsyNqGJu9FoY4wyiD:FAcrUDvKhw9CFPmt6Yd4bLY9EoqD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763148541, "uuid": "743f3407-9ee9-42bb-baf6-f07abb7f3bd1", "value": 3576696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763148541, "uuid": "c6f820e9-66bb-4a78-8e66-43995d0a730f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763148541, "uuid": "fa7d0073-a896-4998-a0f8-31e4e00be566", "value": "CrimsonLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272ec2e0-c19d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763154115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763154115, "uuid": "bde1fbcd-1adc-4e23-b3d0-17db65619fb0", "comment": "Malware payload", "value": "9ce357f62aee0ab42bce37e7e775678b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763154115, "uuid": "028c634a-cf89-4ca1-bb6d-f87e6c6448cf", "comment": "Malware payload", "value": "2c50e590184d785950d9a2c1a93bbbf5e70b32c34230bb7bd93625c977e84559", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763154115, "uuid": "db62bd7d-bd6f-41b1-a977-1a364da83e22", "comment": "Malware payload", "value": "2f35ac607667cfecb9c74dd935dcf161db5454a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763154115, "uuid": "f9fc401c-33ad-4b9e-9254-d0c5201f974b", "comment": "Malware payload", "value": "b6adf5a9c2cf8a25b63a2264dc2b3fa8c975787a2ea6c02566fb1901c0a77e229b1b7bc689faf0b0336bbe387ca3e405", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763154115, "uuid": "e4b09179-b9b5-4b29-9990-5ab4fd180aa4", "value": "T1CB087B42A3EA04D5E9FB9A3489E65213D673BC063F3086DF324C176A1F736E09976721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763154115, "uuid": "60fa2668-6e26-4f4d-8ae5-d2f199187da5", "value": "a462fc6eff0b9f551757bbe7a5c2131a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763154115, "uuid": "49831b59-a226-46f0-a4b7-7b8d278f0b3a", "value": "393216:qEh183u6i+BptZK6a+HnV7yaG0D46lcigGZroQRqDrVtZBJSIzf67yjgIP6CpzQP:qEwTZ6+rqH5KCTuuZZfgDvxOtxxyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763154115, "uuid": "843b5772-835c-474d-b5a9-9398fda40a59", "value": 83856691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763154115, "uuid": "d2af485c-fdda-4387-92e9-653b55878f10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763154115, "uuid": "f1da49de-520a-4ed1-9c9e-6423f6b0bda3", "value": "loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd01b081-c157-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763124356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763124356, "uuid": "c8958ecf-c669-477e-b8ae-41561efb4912", "comment": "Malware payload (Vidar)", "value": "79bab06743a458752e632d0ab240cec3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763124356, "uuid": "f663ffd9-78a3-4143-a4bd-c8b905a362ce", "comment": "Malware payload (Vidar)", "value": "2cb8a860c094f7019841bd82da1ac0029f568ec84a2f7e536edc037ee8f2a0aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763124356, "uuid": "88895f5b-ab67-4d4f-86fc-4ca1584464d0", "comment": "Malware payload (Vidar)", "value": "2c29eea4c858fcad8f3cbf84f33e6a2295388906", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763124356, "uuid": "1be060ba-20d5-4bc8-8c03-21e2a30a6297", "comment": "Malware payload (Vidar)", "value": "0d1c9f0d72f540e473b2c6f13f665513a3b91b711043a0468158770615fbca1b720557cb5dd2c0add48f7ab3cd82a0ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763124356, "uuid": "4641edfb-56b7-45a2-b883-1e6015ffdbcc", "value": "T1D2C6C08BBBB400BCC1A7D17489175917E6B2740613B456CF16D0C66AAF27FE21BBE324", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763124356, "uuid": "77f27884-59e7-4f0d-aaef-9cef14a71c87", "value": "51962544b5893d66d2723f4ec657f80c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763124356, "uuid": "bd256364-100d-4894-8404-1ffeba8b954f", "value": "24576:4ZDiexoxJMC3bVzjJ40beW002TYFgKAv/PmqqAQdhAvg998q1MLjkiC4Yw4dvHK5:4ZdOJhbX25Peq1+jiywey9+a5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763124356, "uuid": "3b8e1817-f3c4-43b5-8f29-e20642835a5a", "value": 12572952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763124356, "uuid": "2f972587-9a97-44ea-ad5e-2135e9ee3d9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763124356, "uuid": "d63e1e25-373c-40b5-86a5-0fa567a08ddc", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4169f2b-c169-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763132018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132018, "uuid": "e8c797ea-2e05-4bf0-b9a7-786a30e0f494", "comment": "Malware payload (Mirai)", "value": "0623f93a1ec83546ee361747cdef6591", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132018, "uuid": "7b726384-65f2-4630-b412-a1b159d7fbad", "comment": "Malware payload (Mirai)", "value": "2d41e0fd467e7f5218c04345fe1df7511c4af11852703a659cd9113dc0e1bae6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132018, "uuid": "c965d87c-dd44-4d2e-a19b-e19af008ac28", "comment": "Malware payload (Mirai)", "value": "ac950db808969750d14a2ca0b2e0cf8f975ea23d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132018, "uuid": "79e2fd73-e099-4154-b47c-33f1d882166b", "comment": "Malware payload (Mirai)", "value": "d1a8fa71617a4e75419a281a75dc3f7c5f4f3e3102d3e387405dcdd442eb0519680eddca4541041b80027e30bc3ffeca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132018, "uuid": "a5c277d4-202f-4966-b265-3676060f5eba", "value": "T184044C46E6408A13C5D21B76FB9F424533239B69D3D733069928AFF43F8379A0E67A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132018, "uuid": "b8f5a79c-523f-43bd-9499-1baf7261d044", "value": "3072:OH0T4fWX9UjXBjhVZXWGM3vg4AMcoHa6VuY25hgdPwuiM/9GSRYKbmiwjVn1qxq:OH0T4fWX9UjXBjNWGM3vNA1oHaPb5hgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763132018, "uuid": "da48f0d7-461d-42e2-980d-14f200d420ec", "value": 176659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763132018, "uuid": "d2ded1ec-8228-4677-9549-a8e9a83bac76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132018, "uuid": "b27fdf00-ac57-464a-b134-3689b253aad6", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa0109f-c169-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763131742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131742, "uuid": "d8fa2bca-d207-4b01-ba5a-c60bc4c06d8b", "comment": "Malware payload (Mirai)", "value": "00a0058baa4bf1990ce55f355a0c4487", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131742, "uuid": "5fc2493e-7bce-465a-9fcb-7a11bd583633", "comment": "Malware payload (Mirai)", "value": "2de7dc39be566db616c777599909d75acd0d72101d770d4bb7204902e560e1e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131742, "uuid": "d67bd1a0-2545-4561-948b-94017ff7686e", "comment": "Malware payload (Mirai)", "value": "c58f063a1edfc4470ca3a76f58a2174c53144151", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131742, "uuid": "fb6946c6-5673-4844-ab1d-37bec17d9ae2", "comment": "Malware payload (Mirai)", "value": "d6f51641aff63c61efe7f4b54c4a9c92f63439e0b3dd752f2ce3802c25ea10c52f458a3485ccc31b89fda2c0a2d77a97", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131742, "uuid": "1383d825-7e82-4514-81fe-4049f01a169a", "value": "T16613F15CC9BE2CB3C5AC2ABF805C1B72AF5416E5341ECB9C43218D88D62BBC998F4850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131742, "uuid": "3b56930d-d639-4c21-ae5f-92e0862ba0ca", "value": "768:2+aNvRTTxIPdwYttUGusKp6pYT3iOp9no5zehM/s5hr3VVuWw:2b1RXxIFfGEK82TywoFehmszDVV0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763131742, "uuid": "93b826da-7cc8-4ede-837d-4b8c46fa0ba0", "value": 44288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763131742, "uuid": "55d55b7e-541b-4042-aaaa-1d1371b6fa46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131742, "uuid": "114b4e12-3b8b-492f-8f1c-ddd127a6bbd4", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3143c72-c135-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763109683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109683, "uuid": "3fa55e87-1bfd-4235-b743-01fe2aa36bdb", "comment": "Malware payload", "value": "6bfad4bb49255d9ae519e0a9d1cc3457", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109683, "uuid": "f5064b04-0bf8-4012-98d4-f55d717ff184", "comment": "Malware payload", "value": "2e1ef807b6abd1650911055717f242c1fd2d69d1292cb9a6e6982e80d5910e4a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109683, "uuid": "b80a1b14-8984-4005-a1e4-bcdcf0d2b607", "comment": "Malware payload", "value": "61c6779aea9966b23b6c06fedc2d006df1f59c80", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109683, "uuid": "04e853d5-77e7-475a-8a08-1e115b6a4cb8", "comment": "Malware payload", "value": "13453090aa68e3e9a2606001b91191d0b1684f857b49d3ab64530707a730c713045a85528ed520f24e9ffd875a0063d4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109683, "uuid": "5ed7a00f-2f94-4621-a7f0-a18f03f779df", "value": "T109D123957DC0B8AD13934EBA7D1FF0DAED5A0856148C424EE215FC6039A0E57F8E297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109683, "uuid": "7e871e55-9655-4e53-97a2-5b1c22ba8c95", "value": "192:Ncmzu9HAeLcUAOOpPuYLPvKUv0BhBjGl/lzf7c+cq2mRfP:awYLcUAOEpLPCUv0BhBal/lzfA+cq2mB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763109683, "uuid": "1318f4be-f71c-4d07-9647-59925327a3cd", "value": 6487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763109683, "uuid": "b4514253-fdbf-4556-9b16-05152ae2cd7b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109683, "uuid": "06e4a28f-0b81-40bb-82e3-e9393f544daa", "value": "SWIFT_Transaction_11-14-25.pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58468e2-c168-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763131591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131591, "uuid": "9afac767-187b-422b-8974-47de70856a03", "comment": "Malware payload", "value": "8f55a6f73f713a0d72c286e0abeda9c4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131591, "uuid": "21c3809e-301f-4056-b660-7be55baf3c8c", "comment": "Malware payload", "value": "2ee5d8dd2763926a8cc85b9eef2548ddb233ca9019b87c4d52c2a92736478ae5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131591, "uuid": "0934c7df-de8f-4274-a04f-4ce12895cd0a", "comment": "Malware payload", "value": "9a05949e061afe1c522dc7ae9a9ac86dd96b248d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131591, "uuid": "0f6e35d1-a945-4465-b7e5-6b3ef911fe73", "comment": "Malware payload", "value": "f899499c889555b854fd3d58ed8ce29fccfc0215375798c6a2e778a9001bc6a61d101679349b0b88a6df523a7c1cfae2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131591, "uuid": "4207d757-4c93-48a0-9c0f-25c3a9954e07", "value": "T149630E046AC1A484638B9B7FB31BF5DAF9AF89D834884406D155FCA5B2E8B07F9F1530", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131591, "uuid": "76b5e572-7d76-425a-a788-a36d51d85a47", "value": "1536:ssinjYd2+AJc2FepUqef82DyEjexnNkjWPtyuepgD0BG/VrwJrZGyDPKXWCCyr30:riMofwp0f82DyEjexnNkjWPtyuepgD0d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763131591, "uuid": "b3b4b898-3503-4510-bfee-a6250b50e6b8", "value": 71918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763131591, "uuid": "d576a9d7-dc19-472e-80f4-21ccb4278c76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131591, "uuid": "e6ec3707-e64a-478a-b8dd-fcd151498ee7", "value": "PO# 45821 and 45822.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78509a2c-c0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763081237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081237, "uuid": "ae6bab47-1b5d-48c8-b6a2-6f010b77d8dc", "comment": "Malware payload (Mirai)", "value": "19fb411168a3c1d69588bf85645f7304", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081237, "uuid": "aaf1bc66-fe78-447f-8b85-f058d9b86974", "comment": "Malware payload (Mirai)", "value": "315086f7b825f260d4cf4cd0cd3635186a97b43a4863ac1ea6cd3c09531fa98e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081237, "uuid": "b85abd72-63b3-4fba-ae1e-e1b1f8e737bb", "comment": "Malware payload (Mirai)", "value": "43f07c3b5f9db47c722961e67fe2dd5fd8cedce9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081237, "uuid": "1919f219-85e0-447e-a3a1-7769aba67bb5", "comment": "Malware payload (Mirai)", "value": "cbccae7537a5d01dd21e3054bb6b49b161f572eecac5a37d576de2f390dcc48424df99b9ed5bdfce3fcb6a35763776e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081237, "uuid": "c6cf5720-7949-4aae-9c30-78a6cf4dca0c", "value": "T100A2E155BF1886CBCC32693455E6EAD21252FC71F2EDCD492640C16FB4A33996470F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081237, "uuid": "5123048e-827f-4ed7-a8fe-16be73105317", "value": "384:M0sLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAKa:k98o08kxofBE+ZkXaqGbp2F2TWul0c5X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763081237, "uuid": "5e5421d3-250a-4ad9-ab5b-e4229802443a", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763081237, "uuid": "232cd15e-6061-4a27-b347-21f789f2c0ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081237, "uuid": "690c2846-ec34-4cff-aefc-5a3f1db42769", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c39dda9-c17e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763140783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763140783, "uuid": "b2912419-7cd5-4014-ad35-b2d7be24d4cc", "comment": "Malware payload", "value": "b10c7a280ba01c0ad2d22f25820696d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763140783, "uuid": "6963dd7d-2452-4c09-a6a0-c34630408be3", "comment": "Malware payload", "value": "327309aeab1fc0a269e491365a7e3d3cc8da8c4148be3b9e12d5190034528b74", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763140783, "uuid": "20d27f98-96a6-4301-a58a-1e245d755e9e", "comment": "Malware payload", "value": "0d7de0200a569b4ef9ed7e4bb41aee9a17fc50e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763140783, "uuid": "b2550aac-6bc3-4739-85a4-2da184bf7b4c", "comment": "Malware payload", "value": "c58db6da885227f0b38f282b1d8fddf43d1b42c1f791be95f7ac07bbb8a43c5801961a98cb2b3fde171022f301e4698d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763140783, "uuid": "1e1298fa-85f4-4cbe-b7b5-05c60c496fdf", "value": "T188E5C65AF6B650D1D1BAC038D553622EFC7134A6833C97EB92818E465B60BF8EE3D740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763140783, "uuid": "7b80dc14-8493-4427-beea-4c221c6b5c1d", "value": "4b364ab2b89db95b41cb42ef2528b2c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763140783, "uuid": "48f4b8f8-e68c-4c3d-854f-c7c6c85bec82", "value": "24576:7oUMuhQZvDVDmeDTO0nrXreii/II1a1Pb1tACO/Am8r2:7oUMuG7DtNnr72/SBt9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763140783, "uuid": "f8df708d-658d-4398-b8cd-1bdbc131bd86", "value": 3034624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763140783, "uuid": "a53c5259-6fc3-44b9-84e6-6b754c4cab54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763140783, "uuid": "1ad088f1-006a-4771-a05f-1f6d125cf98d", "value": "SecuriteInfo.com.Win64.MalwareX-gen.33579633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba74375c-c0fa-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763084355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763084355, "uuid": "4b57d560-8686-4fe8-9c17-b334a7d1fbd7", "comment": "Malware payload", "value": "20f18354087eec196ca0cd55e126c11f", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "carladias-homeunix-org", "colour": "#71161A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fiscal-gov-org", "colour": "#42AEFE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763084355, "uuid": "55438701-1262-48dd-a4fe-b6f8cd25321f", "comment": "Malware payload", "value": "33804836d35b3c12bf6e9e421783cfb94553e9cace673e216b650744a49676d0", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "carladias-homeunix-org", "colour": "#71161A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fiscal-gov-org", "colour": "#42AEFE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763084355, "uuid": "cd4997d6-3936-4697-8ed2-84eba5591f94", "comment": "Malware payload", "value": "39c7f7d78af9be4fbec051fe1ccf5713f23b1a16", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "carladias-homeunix-org", "colour": "#71161A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fiscal-gov-org", "colour": "#42AEFE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763084355, "uuid": "7a50a55b-a218-452e-8d41-afb5bea644b7", "comment": "Malware payload", "value": "eb006fd665e2b291ce9c7f4d91373920a8b73aca157c53a87bf6e4938c0d17a5a397c0ed8d5ae015d80f6601b9b57567", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "carladias-homeunix-org", "colour": "#71161A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fiscal-gov-org", "colour": "#42AEFE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763084355, "uuid": "e1836789-8718-4e0f-aa2e-fea31abe5324", "value": "T122E6BE7B72A0816DC15EC63AD0938F41E93371B91B37D6E7829403A92F16AD49E3F760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763084355, "uuid": "afd0417a-1b9a-4aec-bdf1-0b864f4cc354", "value": "dc5f31179bca14c7381deba77a4688f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763084355, "uuid": "118cd8b1-c16d-41c7-83ea-4e451711801e", "value": "196608:KGA09XMzz9J+64sZdZwU2xYySgZKNsYCikonQHM0TI:KG9UeDsrsbhZKco70T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763084355, "uuid": "3cc006a2-4e90-4eac-b1cd-b92e553dd637", "value": 13939712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763084355, "uuid": "14f9c79f-473d-4818-9aba-3c72bd7d7137", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763084355, "uuid": "edbf9e2d-0ae7-440a-a2ec-717e325a9aff", "value": "33804836d35b3c12bf6e9e421783cfb94553e9cace673e216b650744a49676d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85bc98a0-c0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763081260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081260, "uuid": "a7bff02e-192f-48d5-b6bc-560663afa9f2", "comment": "Malware payload (Mirai)", "value": "60387f14978f2eca093076caf3f3bd25", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081260, "uuid": "a133e290-a1fc-4ec3-94c3-6e11690dae75", "comment": "Malware payload (Mirai)", "value": "350d60096f52dd1a8c2cf31a7af783bef69c36f580e5b4c115da58ffbf3ca040", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081260, "uuid": "a8902b51-6db2-4b56-9043-906b2958f022", "comment": "Malware payload (Mirai)", "value": "4c3e3073305f2bdabfb0bdc7cd56936360c76432", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081260, "uuid": "0417744e-4a6d-4d6e-9610-31a78c654a2b", "comment": "Malware payload (Mirai)", "value": "ee151b2a1edc51a84b19c8e8c7d489b7190530f7dddd9fb21f77f294b242711dabe7963ffc4e1c2e016a0c5814fa3cd4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081260, "uuid": "8304fc52-7cb2-4dcb-8642-436e889ff534", "value": "T19F73A409BB600FB3DCABCC3705AA2B0139DD665721B97B36B934D918B90B25F15D3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081260, "uuid": "9e5c194f-8bfb-45c5-9f5a-e7b0e7855b90", "value": "1536:zJPEBmW5iNWqcGTkwnXHZ84OqdZerEStN:zJPEB8NWq9hqqd0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763081260, "uuid": "835d567e-17ff-4ef2-a0e0-55a25253c5e4", "value": 76120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763081260, "uuid": "dfbc21c2-6e5f-4007-8e2e-fabab37f2473", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081260, "uuid": "025ae05c-8260-4eb5-a5ed-6656f699d2d5", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3550262-c108-11f0-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1763090436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763090436, "uuid": "cdf5d1da-2d76-4bc9-9e85-240adf878890", "comment": "Malware payload (SheetRAT)", "value": "27cbb8c94f4e8cdb5ede856abb021882", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763090436, "uuid": "fb97c136-f626-40f8-b445-bac142a288ff", "comment": "Malware payload (SheetRAT)", "value": "3623c58bb4c00c7f73874e826199708a71eba343eec4820bd159bb12424bd69b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763090436, "uuid": "179bd09f-d287-473e-a557-03889e946675", "comment": "Malware payload (SheetRAT)", "value": "9880c1d038ca92df95acbac5592c795049855459", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763090436, "uuid": "c4c38ac0-5737-4fe8-9d9c-3d0ce8e908f1", "comment": "Malware payload (SheetRAT)", "value": "5f4259747b4d84f8df3d311ef2a4567fad4b7733410ef9cc8172f2025c69cd65589557a0dd93c38ae75155119e8bc088", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763090436, "uuid": "38838788-7f78-44d1-afe9-9705562d55b0", "value": "T19705FA077A468E70D2065B72C4A724408BBC97867327E74F3D8B23752A733BBB54A587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763090436, "uuid": "61ed0727-c6f3-484f-acf5-4744ef115e2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763090436, "uuid": "8599128d-893a-4bf1-951c-7ab51539a280", "value": "12288:wwRcDThHEPHmHI6Ss4vAgDGsB4QshQId7Oy4M8HFG376Gg9gfzMxf:wwqDThHGHGIK4PDGsB4QIHih3Fb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763090436, "uuid": "24c01237-ea6d-4d6b-907f-bef6da4ad79f", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763090436, "uuid": "15e07e03-6bcb-4d08-8755-cad23fd70c16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763090436, "uuid": "5da32be8-4c67-4c4d-8b48-c20a381dd072", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c342789b-c195-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763150941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150941, "uuid": "31ad588f-8e6f-4610-80a4-811a02d3576e", "comment": "Malware payload (Mirai)", "value": "93306a2b7b6edc9b99c6f346279d7b47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150941, "uuid": "6c8158da-b350-44a0-aad0-601b4b73bee2", "comment": "Malware payload (Mirai)", "value": "3789076d4c74180c9ea1f824f606fb32b2ef97c635cc8f567cd8b0bd598ca2e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150941, "uuid": "67feb11e-2c80-4764-954a-b85ea671be35", "comment": "Malware payload (Mirai)", "value": "807ad679b0c37098184b2144a4698a725666a46c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150941, "uuid": "8381ac0d-5e87-4642-8be4-28e6f74297de", "comment": "Malware payload (Mirai)", "value": "8fe21ef5e469d5228845459b3cb3f3543b2ba48167fc349bc2fe4084f4dc338677d54f25f53ce05d5f91643591607f88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763150941, "uuid": "1ae998fb-7802-4cbc-92f4-4e5f0db45d1d", "value": "T13DB36C21B8391E27C4E0947B22F74766F1F617D914A8CA0E7E720E8EFF256503647AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763150941, "uuid": "c75cf7a9-bb64-454a-a84a-62449c01b353", "value": "1536:Pc1EZR9LVRmL3w6ONcaaToLTMIe5ifm6p79jwYJPtGs+XXhd/tDPYm5MeYMFJitq:k1aXhVPfFp7jCs+nhJ9PYOMvJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763150941, "uuid": "bdeb1ed3-01f9-45c2-840d-3ba643648b1f", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763150941, "uuid": "8628a672-8451-4bc1-a667-d4c573922202", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763150941, "uuid": "5fb68a49-e79b-4dc9-9f57-45b62b1c42e3", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6451d4a-c190-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763148879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148879, "uuid": "a6346569-a08f-4cab-867c-43a400c3433b", "comment": "Malware payload (Mirai)", "value": "206772c940598967f1f89fcc664395d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148879, "uuid": "55437fff-3431-46da-b761-124bf6b13882", "comment": "Malware payload (Mirai)", "value": "39d1aacc320c4834c30f819ae2af34d104a89b8fd4f189c77d4ea07687dda5a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148879, "uuid": "4b6feb27-8e8b-434f-9967-f8800a5857ac", "comment": "Malware payload (Mirai)", "value": "05a60b03600900c366c00326ab4da67076a94a24", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148879, "uuid": "58f43222-ed40-45fa-afb1-3c1d8ce88744", "comment": "Malware payload (Mirai)", "value": "231ff40192fe4dcf476802bbee12c642679441f19dca929999e85d1714249e33a0c5562f4e2a54d750df36b0ed5cd402", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763148879, "uuid": "04e5cf4a-33cf-4c15-9881-b5cac94575d2", "value": "T1CEF2E106D1159EC2DEFB38A1C0CC97807BE1836264AACD61B18B1FF46E27918798D9F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763148879, "uuid": "74677329-8aa1-4795-b5d1-9da0664b779f", "value": "768:IKj05WTwZJT93VTk+tuEde6n9BcrJ3BL3fVv6cD4uVcqgw0E0tLyfz:Hj05WTQVTk63deGAVRNvbD4u+qgw0Vub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763148879, "uuid": "1de29a54-f1ec-40a6-bb86-b852ccf9bd81", "value": 35944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763148879, "uuid": "ea4fb300-740a-4638-948a-e32eb459cad6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763148879, "uuid": "332dc5dd-c53c-4584-b910-57f141bc7f5b", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "353febc6-c164-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763129658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129658, "uuid": "f329d9b5-3a9f-48ec-811f-9a19f31b007a", "comment": "Malware payload", "value": "69434932b0575ed42fb9db9a8ac08766", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129658, "uuid": "9dabd896-7d94-4c21-83be-849c36910fc9", "comment": "Malware payload", "value": "3a5959cc3e885531bb1a1f411656fbef4f1fe35a5dc65f4d5b5b06d012936f3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129658, "uuid": "de5b7c4d-dcfb-4d62-a4f9-581baa1cc180", "comment": "Malware payload", "value": "5904c23566ef6685bb3529c6bdbeea93a3591047", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129658, "uuid": "25a5c82f-d0f7-4b9d-a888-1f67708d4825", "comment": "Malware payload", "value": "423bb1f2c9651bf24988b5e811c8334af372a95c2b6bbd1a232a4d809cb063c3934de509e1f67ebcd2ad047bd0760b13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129658, "uuid": "56ec5dd5-11cf-4a5b-a1ab-3501dc58c1d4", "value": "T125E3191398655EA7C186AFB526F34A750B53EC110B4B1F89B23AEAF40647DCDF809374", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129658, "uuid": "a2505df0-7093-43e0-9904-bcac216422de", "value": "3072:93XqXnAt4mCAUgLWbLLvXifvCBv7Kx/ZSsaD65LwR:9HqXnAt4tYab3vXMvCBv7Kx/ZSsaD65k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763129658, "uuid": "e34d67ea-2d0a-4154-8806-89b816168de6", "value": 150239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763129658, "uuid": "c17002d5-f002-4d36-8995-ad0d201e74c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129658, "uuid": "5a634077-250a-4a31-8f72-288cf90d27a9", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4b416b-c127-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1763103578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103578, "uuid": "6a1b6588-8483-4fff-ac9f-a77b763fbe95", "comment": "Malware payload (GoToResolve)", "value": "714ce4d02950d909bf6b70a414038323", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103578, "uuid": "06e65596-3007-45f3-9beb-2f44916d89b2", "comment": "Malware payload (GoToResolve)", "value": "3adff239f3833dbd838939ca6e39ca163a2b8dd418f29cacd0f85c3c4adf4d9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103578, "uuid": "4da9be41-89ca-4a45-afa9-37f3c47d7ba3", "comment": "Malware payload (GoToResolve)", "value": "47913a9082657dee1481100877f8af362a462a55", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103578, "uuid": "4cc8cb62-132a-4778-9ba4-b90155389466", "comment": "Malware payload (GoToResolve)", "value": "c2845663b5690cde1c623486a6e0dc78704c9b27dbfebcc28dace045e1fa2eb156a43c3dcaeeded1a46a50823110218b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103578, "uuid": "390b8e44-498b-4034-aecd-ba4fce48d3c8", "value": "T1E137333132568471DC5211F1E929AFBBD66D6D248BB208D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103578, "uuid": "5531d048-f144-49bb-aaba-ed573284a28e", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103578, "uuid": "7c0d44b9-b33d-4af1-9118-039b4811f031", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpW:q9WtLzgOTbjZvk/ekS/mcpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763103578, "uuid": "36824c2b-62dd-4913-a1b5-59f2e3723c96", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763103578, "uuid": "5c90a594-7da6-4287-a31b-7e92e42a6580", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103578, "uuid": "cdbdd639-5c54-46c2-96e3-217da085b14b", "value": "MsTeamsSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd0a007-c144-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1763116143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763116143, "uuid": "65ce5e3b-6de5-4b09-be56-8f365cfa6e8f", "comment": "Malware payload (AgentTesla)", "value": "94438fa702c7568cc80c3299f46fc4a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763116143, "uuid": "6a753c81-c762-42cc-8c74-1294dfcec7cb", "comment": "Malware payload (AgentTesla)", "value": "3b0b9c83b1cc423fdd27627cd6dc1143b275c109746163296674ec65362b16a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763116143, "uuid": "daf4042c-6203-4205-8734-338ded80d5ea", "comment": "Malware payload (AgentTesla)", "value": "93c6364a0f4a857f8322eef33588400bda5cdfa5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763116143, "uuid": "9251cd4b-a645-482e-9034-1850c90cbd08", "comment": "Malware payload (AgentTesla)", "value": "3b86ab4dd03fcbc64683b388e77da1599917c36bc13e5db0d166efac0f41e73cdb2d597998b7d2704a090af1e470ee47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763116143, "uuid": "433b5198-b4af-48fc-a94e-f3a013b6647b", "value": "T128E2F11315C03037443EE0FAA8673E3F4FC59D332E20B0E25D486DE1AB12885BAF9598", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763116143, "uuid": "a621abc9-9170-4031-9177-117322b35dab", "value": "768:CSlOZcxtDLGgbz++WbyPrY1iKUsTPnC0aUYFi:Wc/Gg/9rYFUk60dci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763116143, "uuid": "1a2405d1-846b-4b18-a790-187ad0f53f98", "value": 32626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763116143, "uuid": "edfc6fe7-6690-4bf4-aacb-e41cfea6b60d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763116143, "uuid": "0523b471-9240-4148-bc10-22747dccac11", "value": "2025-11-14-0822_001_ea8e4a0e-d817-4647-acdb-c061172e53ac.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6336942-c153-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1763122600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122600, "uuid": "9570112a-054c-474c-812c-6fd4482d31ed", "comment": "Malware payload (XWorm)", "value": "b6b82a2cee801686ce658f98d594b23c", "object_relation": "md5", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122600, "uuid": "0d7f4aeb-b54a-4213-895b-36e06483dc76", "comment": "Malware payload (XWorm)", "value": "3d29ced12ab50a4f720c87d684cde29bd8160ee33785688d717a9d260baa0ba7", "object_relation": "sha256", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122600, "uuid": "2db215bd-2c96-4236-bc4b-2bb6cb4615f4", "comment": "Malware payload (XWorm)", "value": "d9d5271731a2e507dba7772a2c041c051fa706f3", "object_relation": "sha1", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122600, "uuid": "b2889fd1-5a6a-4352-87a8-b198560ff6ad", "comment": "Malware payload (XWorm)", "value": "d6dd02920a498afcfc2d8001ad0a5592cb9d3d68059b6b1a8bbc83446d370e4aad03685dafc649ea602949775bbf1e71", "object_relation": "sha3-384", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122600, "uuid": "d198b707-2d64-4a26-bfe8-9a34ac113667", "value": "T1F3C2AF05BBCB4631DAAA877E49FE932C1271DFC62552C76F5D8041AD1CFB3894A02BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122600, "uuid": "22a37f6a-1d08-45d1-8018-d8e9111088a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122600, "uuid": "39d04f76-cad7-4a8c-b1eb-26a09adc0ab1", "value": "384:zy6739eR7vO5KYq32nJaUeYmDIHdW98mbkvV0jdnqOo7+VIrh8EJ:JeNoE6XLmUHdWymbkvCdnqv7viw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763122600, "uuid": "05375c02-01f6-49e9-b343-1b1737ad8738", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763122600, "uuid": "f0b782d9-4329-4d7c-acea-2ec625ff61dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122600, "uuid": "635d270e-7846-464f-8d3f-75b8a420c3ff", "value": "3d29ced12ab50a4f720c87d684cde29bd8160ee33785688d717a9d260baa0ba7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7704989c-c0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763081235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081235, "uuid": "d6da0bc9-1396-49a0-9651-272485fc1cf1", "comment": "Malware payload (Mirai)", "value": "1ea6dc87e79e5443ddab02e4025788df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081235, "uuid": "c0ec84cc-353a-4419-a2ae-ded79564a3bd", "comment": "Malware payload (Mirai)", "value": "3f2902ca309c0b46ec15482288897bbcbe75386f5381eb339ee0f6e7fc3fa31a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081235, "uuid": "649438a7-b3cd-448c-8ae1-0746be217da4", "comment": "Malware payload (Mirai)", "value": "5648f8e3c7d71431d1d310d3f09a2a2d27026672", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081235, "uuid": "1505a360-e3a3-488a-8c96-399bf685a502", "comment": "Malware payload (Mirai)", "value": "2b93b104edbe461f8854820245e0d186128b23e873f6a5c14dee2c611729c4e3bfa5752b4c8e407a50b5abb719f44b43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081235, "uuid": "0fafba43-e137-4ddd-994f-bf4a9cb19ab7", "value": "T11F336C36E029DED0C6560234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081235, "uuid": "65c010c2-7ee4-4456-ab54-82dd349f7bdf", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763081235, "uuid": "8d8c2fa1-6a45-4d0a-abfc-c3a2a648c0ee", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763081235, "uuid": "ba4dd15a-4b57-44d3-94b0-4e128405ed0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081235, "uuid": "89fb8856-7707-49d3-96e6-cae5ade58a51", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9139edc-c169-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763132000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132000, "uuid": "4e0b2b9d-12e8-4233-ada7-57264ee912af", "comment": "Malware payload (Mirai)", "value": "6925750a6cfe5ce288b3f5405dd96373", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132000, "uuid": "5570c8f2-bd33-416e-85ff-502a49625f32", "comment": "Malware payload (Mirai)", "value": "40ffbdd0c5b4097de3b3422e300fa49c49b0e9d1e838c454929f2549192edc9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132000, "uuid": "bb901044-6696-4827-aeac-b61d2d515440", "comment": "Malware payload (Mirai)", "value": "b6b83d341b6c2266da761ff7938ecbd4cd104cf7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132000, "uuid": "7d267b00-afc5-4b35-b186-f3858936b997", "comment": "Malware payload (Mirai)", "value": "1c0ca1f22534004a5abc7acdfa0456c57370980adc732ed6abb6ef16c4ed90ae3d367b5f2c04e1f4eab8c3ecf77b28bb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132000, "uuid": "aa8544c6-4a08-4f3d-bfd7-2108e095fdcb", "value": "T1F66302AC345D2D35E1399F3DDE9C60F696D153B88CA6B42929D31BBB0D8F241A72E013", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132000, "uuid": "3a3f0060-ba0e-46f0-80b6-e4cf67afd035", "value": "1536:O3sVP3yvHXFajZ4DbR4miCaSZfQLjTE06Kr5Cwp0:Ys5yv3F+uXQi4LjT96Ogq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763132000, "uuid": "fd85a6f4-b6b3-4909-9391-67466b0bb82c", "value": 68196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763132000, "uuid": "89ed9847-6443-41ac-95c0-41f8a8dfda88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132000, "uuid": "c95c2e29-1db7-4fda-ae11-91bcad187470", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acd76e9-c17e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763140780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763140780, "uuid": "a952668d-4ebe-4d86-b756-a9349ab07465", "comment": "Malware payload", "value": "3cc15ea595299da5951c5377baa87c5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763140780, "uuid": "bed192c1-2a76-46d1-aecb-3a1c8b2ac404", "comment": "Malware payload", "value": "431ae51dcf68d25d36b89e9499203bdb09432d0e66a778334d6c78beb1199510", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763140780, "uuid": "83afa1de-3e03-4345-865c-c6fd74164a94", "comment": "Malware payload", "value": "89190189c6823d641b1385344a5759b5c5ebb5cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763140780, "uuid": "2faf9ad7-79d9-432a-acf6-114a59b5f9e5", "comment": "Malware payload", "value": "6c09da928b4de5f55353975f504eeb40aa322c3180a6c5d2dba2ac1692dd27ba7ebdb6ba3679dde25d95d910b268ea10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763140780, "uuid": "0f98b350-75bb-4324-94eb-99a66d47462b", "value": "T1DDE5D75AF6B650D5D1BAC038D513622EFC7134A6833C97EB92818E465B60BF8EE3D740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763140780, "uuid": "3af73cb5-d439-4cef-b145-1fffa8641af0", "value": "4b364ab2b89db95b41cb42ef2528b2c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763140780, "uuid": "c295e1e1-f81f-4f38-8790-9ef4ec626016", "value": "24576:A5UYTgckK4mAbG2pDaA0+B7kXeIfwvGDEXr0:gBktaAvBIJSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763140780, "uuid": "1a9d94e2-919e-46ce-a786-a18ade73ba1f", "value": 3046400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763140780, "uuid": "dd59b64a-50c5-48e6-bd95-c263774af0a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763140780, "uuid": "481a3159-4899-4bc5-ba99-1112b89035df", "value": "SecuriteInfo.com.Win64.MalwareX-gen.31856651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e355bb-c18f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763148365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148365, "uuid": "1eb479d5-cc43-44f0-a195-8f47bb116629", "comment": "Malware payload", "value": "db9674dd888585f295891388987ac86f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148365, "uuid": "01067902-88e1-40de-af27-182ce894ff14", "comment": "Malware payload", "value": "43781b463370fc507a1c04b8de4b39b19392e391d808e7542df083710a95d0f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148365, "uuid": "ea2fdd50-ae5f-4fc8-b792-3db9e1243d5a", "comment": "Malware payload", "value": "ab4b4b8f7eb2fa1aaf579cfe0ad5cc085eff06d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148365, "uuid": "d63da154-88c1-4c33-81fe-e40fd3e3f802", "comment": "Malware payload", "value": "d9a9eb30d20dae115e745050f2f0c2c298f27f451f6946013856fc6900b9065f25adab1f9da46680961ee7b21c6bb2dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763148365, "uuid": "ffe84424-ffd2-4706-8882-0359fe3abc80", "value": "T121E5C71BF6B610D5D1BAC038D553522AFC7134A5833C97EB92818E4A5B60BF8EE3E741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763148365, "uuid": "a6c795c6-379f-475a-a807-d047f5ba2bfd", "value": "08e72a96e5f5739a6a2efbc8518d8644", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763148365, "uuid": "089f211d-6bda-4c09-b6fb-eea38446c304", "value": "24576:1qxKPwDa6moRg2mQwwNLsvQiKjVGK8PWNfQb3XOZ1iRtO:TfoeqwwGvQHbJoOcLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763148365, "uuid": "8bc94756-6e1d-4c28-a679-58dfc4735fac", "value": 3140608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763148365, "uuid": "364fb319-41e5-4e89-8a87-6b69b1a5189c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763148365, "uuid": "cdf6fcea-6a5e-4fa8-a8cd-2af466e36bdf", "value": "SecuriteInfo.com.Variant.Barys.334082.19269.2607", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72571117-c185-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763143934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143934, "uuid": "b99747f4-0091-4e16-839a-0cc0d12439b4", "comment": "Malware payload", "value": "df752bee003d3d9ece03545bf66e7214", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143934, "uuid": "228fdffb-0535-4d01-a9aa-a1d756870a06", "comment": "Malware payload", "value": "43fdd63b38d8cab86b5882de44445d263400fb5254ea1f088aa76f9222ca88af", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143934, "uuid": "404c56fc-77cc-4abf-bfd2-c38be57fd78d", "comment": "Malware payload", "value": "3fa5fe9850582688b0f1b0a00d4bb88d029f48ad", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143934, "uuid": "3bced36f-6bb4-4b21-ac48-6fdf76813af4", "comment": "Malware payload", "value": "287354512fa029657334f5061ff98fca4d19c270abd687bffff371f293c63cd86d9e6d88b0377af01af002f445fdb4f3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143934, "uuid": "5e744c4b-d932-4b54-9f0c-37274b901f29", "value": "T18D0633835F743962EEB3897918019F35548BEE09AC78883D30CE859D4F47FA66E27718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143934, "uuid": "e4ccffdc-e434-4506-8430-c9db1c349a24", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143934, "uuid": "75e36f2a-3666-4d25-a54b-3b5ac480e14f", "value": "49152:C9QeP6oOKCRgImQ86H6Bq1AhNk/Wv2kDftNyysK6lxpWBUILDDiIdsvEAfGaajyw:MQypVZE6Baed3BxN5LPiIdsvEiGOWtwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763143934, "uuid": "dfa52472-587b-4394-a482-e7d42c55f0df", "value": 3796734, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763143934, "uuid": "20ea17fb-ed0d-451e-a646-8dd78803502f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143934, "uuid": "301f6d83-2719-4f76-9c46-a87bdee6de6c", "value": "43fdd63b38d8cab86b5882de44445d263400fb5254ea1f088aa76f9222ca88af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76670fc1-c0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763081234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081234, "uuid": "02da89f9-913c-4e1f-8135-c182d7b02d94", "comment": "Malware payload (Mirai)", "value": "0dee7b48be7628faa765f7274f244863", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081234, "uuid": "81a0e08a-a160-4a75-8f68-8927a88c6590", "comment": "Malware payload (Mirai)", "value": "45b81be64c15e350a0c55dbe93e9e81ae4ee1e84de7062c8264574dcad2e305c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081234, "uuid": "4954f1fe-9fe3-4e9e-a425-f54d65baeeae", "comment": "Malware payload (Mirai)", "value": "99d2648d049ca58cde76d24ea9f4d8851e6613b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081234, "uuid": "1eb7f648-59bf-4d49-aae5-b8bb352fa9b0", "comment": "Malware payload (Mirai)", "value": "287071619224b26c6f784a1f80e73ff58266a77d06455c05c0e11747a8af0bbfa3d262b99fcc830b5d3aed0cd1855636", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081234, "uuid": "fdc1d5ab-631b-4541-ae16-c53f91799668", "value": "T15BB2D03C5B151A98DE1AC0BE439D0B203DB81B3591829D8B7207FDD7AF968747453BE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081234, "uuid": "2258244f-c1f0-4d58-be89-e5d85ea5d00d", "value": "384:neD8ZSH2LLZUYyGZbsOiTrowSN9rnZMINlphQ/HYtuiYMmdzJgGlzDpH7uNj1JA2:neD8ZSWvZHZbs1row697qohQvg9NizJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763081234, "uuid": "b85827fa-8f31-43f2-bc20-dd0c28281ddc", "value": 23784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763081234, "uuid": "da31e1f8-853f-4860-b7cb-c04a70199ea3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081234, "uuid": "9ab06990-5b9a-4686-bcd6-ba07a3121487", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f7f672-c17b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763139833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139833, "uuid": "3f890bd0-0a8d-4ae5-b746-607dcdb72fd7", "comment": "Malware payload", "value": "0851a5b75b52e07568df2db862371ed5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139833, "uuid": "a119008e-79d5-4d9f-8547-b039a3d5074e", "comment": "Malware payload", "value": "469e8951a670f3560dbe587705110d97f0a058d6b207b4541994451786f9ab56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139833, "uuid": "d2a72baa-7d65-4d61-9fcd-ac26f7eff1e1", "comment": "Malware payload", "value": "167f07910c0989c2b6d64e0f25025146262cc07a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139833, "uuid": "22f95912-8c7d-4cad-9728-3389ba7670ed", "comment": "Malware payload", "value": "1caadd3d37d2dc6db0266c6a13070d9bd9fa41aca1ff1c9df1fb8425599d8c761030aa911b99071bbd7581df27a22b9c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139833, "uuid": "ff449635-46b1-4d47-989f-9a7428b68242", "value": "T127F75942A7EA08D5F9F79A3499F65213D673BC066F3085CB324C172A1F736E089B6721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139833, "uuid": "a43295ac-0377-41bb-bb00-92f29d7e9773", "value": "35686f86a183dc6a9ec694033bf670c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139833, "uuid": "9ece2ded-5518-4b2f-b98b-de8fd6b3e6f6", "value": "393216:XfNi8x+zds3HSSf401gqNQK5plBRVz3xWE+xQSI8w5SvDazn1d5VRYv4LWoaM8+4:XMdCJmQlR4Vu0C1SpgPVlcmLtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763139833, "uuid": "98624bdf-4db3-48ee-9afd-5e7a8b1ce096", "value": 72488885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763139833, "uuid": "3baefd0a-9747-4fec-8adf-a412b41d753a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139833, "uuid": "ac86b36d-0e2e-4a2c-a205-53d02517a52e", "value": "External 2.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7c008d-c1b1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763162847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162847, "uuid": "418cd267-2a11-45c4-8801-1a681d1d6a94", "comment": "Malware payload", "value": "40249128c6aa8f4f50b74dbe24b9970d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162847, "uuid": "6826c5a5-8317-4954-9cc5-28030b7587b8", "comment": "Malware payload", "value": "46ab28771053d0ac2607de413a2cb045aaa8a32b036445b928070ec37eeb130a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162847, "uuid": "d907401f-66e4-458f-b635-eb7f96582604", "comment": "Malware payload", "value": "3c549562143c401d31590eba44228f80d331b3b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162847, "uuid": "00bbc622-f008-42ea-96b7-f6a63a84e9d9", "comment": "Malware payload", "value": "756f161fd3f7a1232a1eed65204fe4a0102d6d8d4ce376c5940266e3e550232c8b88e36040d48d6fcee5da80d9b24579", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763162847, "uuid": "7e62606e-b021-4387-8ab3-2477b032febc", "value": "T127366B88E793E4F1F25348F0169B97F765200639A057F5F2EB8A6B61B4323416F093AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763162847, "uuid": "12959e0f-e2d5-40f2-a3d1-c5d82040e6a7", "value": "98304:+x9d+BPBhB3rFAxEsB9pihCzK9oS0YF0m5Wpv7D5JlKODKw2Hp:BPB7FnaK9P0YF0mIltxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763162847, "uuid": "f7d8a8bb-8f13-4077-8328-76685400a802", "value": 5237864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763162847, "uuid": "d257aeb6-7354-474c-896d-9daf273bcae6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763162847, "uuid": "22488d9d-1273-42ed-96dc-adbc35cb8aa4", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b9f2b0-c127-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763103588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103588, "uuid": "274b5523-6849-4465-87d6-720fc93f97fe", "comment": "Malware payload", "value": "ddbdd198491d8e797ef9659a95694d38", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103588, "uuid": "c6d47694-aa0c-42f3-90ee-e4ca13dc6f47", "comment": "Malware payload", "value": "472bf6eacd2976aff240286f9368d903950e62377ddc7b5c0a82edbfc6f9cf19", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103588, "uuid": "2b0ab64e-f71d-4c47-b006-f111fd2dd8ed", "comment": "Malware payload", "value": "61f52e7f98da7551b745e57b6e926b462eb710b8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103588, "uuid": "9dfd20a3-c140-45c1-bbb4-b5c307a78394", "comment": "Malware payload", "value": "a66dbda76b93cbd69d0e51529f6aedd266a9d1d80b64576302800ca876e4b8dcce243a5207e3ee7b428f1a9c2798e1f9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103588, "uuid": "01a85822-3d22-408f-8c17-ac2f8bb393aa", "value": "T1DC360142FB41987EC5F79237053242A64167CC6A4E83E7879A59B23C1C774C89F6AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103588, "uuid": "2ecbfee4-36e0-4e1a-89f4-3ff3213d9276", "value": "98304:9jX7LfDD8F9r3qNlKX9Nv/mwTN1UfU8QAgggkaE8TXXX8tQNUPD4irAMJynJsj:Z8bNNv+wTNiURjEeX8tOUPD4ikMJOmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763103588, "uuid": "49f0e903-cdb6-40a9-9163-ac53dd72d7ba", "value": 5258733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763103588, "uuid": "ddd31abe-06b7-4b74-bf65-ec1d37bdafb2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103588, "uuid": "3fb7f69f-86b5-43f4-b7cc-b63ffb46a014", "value": "SafeVision.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7064d71-c0f7-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763083114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763083114, "uuid": "a50787f7-5cc5-4162-be5f-be5448d74355", "comment": "Malware payload (CoinMiner)", "value": "8ef445fb54bd20c9fef97eb006cbb14f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763083114, "uuid": "909e4c07-5f39-401b-87e8-195d3138be34", "comment": "Malware payload (CoinMiner)", "value": "4743c305a4fd08ac36fe1f52f5c6d2933bbad2d727ab64fe5bffa9b73c3b2f21", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763083114, "uuid": "9b423e4c-a674-48b1-9471-6f478c9e59a9", "comment": "Malware payload (CoinMiner)", "value": "d7bcb348593504f3d3d187d8e9258b52b4f3b0eb", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763083114, "uuid": "47cb8ca8-bba6-49e8-b112-94b99e5e7cca", "comment": "Malware payload (CoinMiner)", "value": "ab0be33a0eddaeb062256667782c311ca1d5f41d85e303944d5acbd4f50d5f24990423e00ff1d13c3d07ad57c6ae1880", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763083114, "uuid": "784466c2-a3b6-4893-86b4-a1d91987799b", "value": "T11D32C9251EEA8A05F290FFB2CEED7522C45BFBB254B72089349647051467C46F923E3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763083114, "uuid": "05bcc5e5-36a0-48ed-aef2-a6e0e05bb7ee", "value": "96:8skKOl5FahebiPEahUdFdPlZmNTKphLZOsBmG55Y77TaLOL7IZXxkYu6:8sWl5FabuPfTphLZ/WaqL7iXeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763083114, "uuid": "3a3e9c16-606e-4789-b804-75228ef5be42", "value": 11621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763083114, "uuid": "219b57cf-b3fc-4a8d-a810-70e98e34899b", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763083114, "uuid": "0a7a9f1d-7463-4e04-b9ad-e1c738670b1e", "value": "billing_statement_kredivo_jatuh_tempo.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f5a925-c196-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763151208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763151208, "uuid": "95d58f51-a2fd-489a-a3f1-be7ad198edc2", "comment": "Malware payload (Mirai)", "value": "6b0518f3e271fdae3246cbcadbb9ff79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763151208, "uuid": "52cc6b1d-a9aa-46dd-ae93-87de6d698f7f", "comment": "Malware payload (Mirai)", "value": "4964e2eb93ee7a4b100979c5e64db5923a498da6a5e6a4ffd21319758987730b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763151208, "uuid": "a422da43-9b2c-4f7d-bfb1-9a3c7841bfa2", "comment": "Malware payload (Mirai)", "value": "3023386fa1167c6baaa001ab5ceaf1af8e36f858", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763151208, "uuid": "76bf85cb-ff7f-4844-b5cb-6d9382b72f10", "comment": "Malware payload (Mirai)", "value": "7585be2c66ef6fce6354a1c7d0d0246b7e9c178a6e665f73f8c6d6aac2054053e90b003d2fc3667763be32a5d8e3f55a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763151208, "uuid": "99f89d56-78b4-43a8-b765-cf0052d53648", "value": "T1D7E3E71E7E618F3DFBA9C23447B78E26965933C637E1C585D1ACDA001E6024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763151208, "uuid": "5f612d81-a5b8-46fb-bd75-26b90928f776", "value": "3072:ZkF+6uk9hckUGXZy9q/uleW0AJsPQDAFwLH6EDq0Rp6+P+po5C5DB1Luv3JjnvfE:uF+6uk9hckUGXZy9q/uleW0AJsPQDJHc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763151208, "uuid": "a9134f83-1d83-45e0-8d40-24a16a456a48", "value": 144696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763151208, "uuid": "de9fb767-4091-41f3-b8e9-6ea7f7d32f1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763151208, "uuid": "e7d275d5-f846-4842-bcdb-39c51e5d6c19", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6a0341-c10b-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763091661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763091661, "uuid": "70945e38-42cc-47bf-a4a8-622ec47f603c", "comment": "Malware payload (Stealc)", "value": "347f7779421d0f0911e062849ff4ef39", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763091661, "uuid": "a1a1654c-a10b-49f6-be98-f18acb22a715", "comment": "Malware payload (Stealc)", "value": "49e4d65ab838f3accdbcdab013011e0f7f98a607f9655b945d635bc47db8d50d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763091661, "uuid": "d655c7c2-6f52-49d2-bf34-ba96bbc06888", "comment": "Malware payload (Stealc)", "value": "80c769e74c39020ca37b6885ac46b87fbb03896c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763091661, "uuid": "ffaa41b6-6951-4c0b-80fa-0ed42ede5ab5", "comment": "Malware payload (Stealc)", "value": "dcacf451634c19d5b5e01bd0bde0610914d68c354edda58ad4d7c09c7bfd4a4c6bdd5d86005e086a7d70267c114fc122", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763091661, "uuid": "6abde4dd-0822-4a82-8d24-fe93f60fa1c8", "value": "T193A612D61188A2B8C0C25238754202FA35C0ADD584FD995DBBC67C13EB72EED215EFE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763091661, "uuid": "dce97205-4ab1-46d4-a8d2-80e2cf6602c5", "value": "577240208564ce97e456e1877f7b193e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763091661, "uuid": "5683023b-738e-4a92-b403-8bf8766467a2", "value": "196608:hb3bptsxqe7yhnraNJ8rewBAg05aM1/7C2Bb4nWIqgM9999EtOXZY:F31Sqe7wOj8vagxM1jkM9999EtOXZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763091661, "uuid": "a2316877-4151-4643-834a-f0f982efde42", "value": 10311248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763091661, "uuid": "f7abbb67-30cd-4270-b0f3-a4123475afc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763091661, "uuid": "a25bf2fa-612b-42c5-a967-b77efa92caab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c13d207e-c16a-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763132470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132470, "uuid": "c2860a8a-bef6-45ef-af4b-31b9f970d013", "comment": "Malware payload (Vidar)", "value": "b589b76c433af9faaf818fdf10a66a54", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132470, "uuid": "11fd3be9-847a-4dfa-8643-9ba036ecf6d4", "comment": "Malware payload (Vidar)", "value": "4a9a3f285ab54f57a64c2b4366838514824e3ed8fad6715e2370a547b28ff89e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132470, "uuid": "ffa6f30a-29e0-48c4-b9ab-a81cc1040135", "comment": "Malware payload (Vidar)", "value": "fafd3298698d4008955d269f9157168aeff50fe7", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132470, "uuid": "2e333d2e-6be4-49a9-a219-f463a0e7e26f", "comment": "Malware payload (Vidar)", "value": "92591d037046714e4f7f1e1c617a10967f705a286dddb51158e0b362d12d3263eba1a0ebdadc424c4cf558eefa249ba7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132470, "uuid": "e61bf599-9ec9-46ed-8a0a-21413dba7211", "value": "T1A3065C533EA249A5D0BDB234D8A346727A28BC34077133EB2E117A753EB67C15531BB8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132470, "uuid": "b0207915-fde8-49ea-9638-fe3cb9b920e0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132470, "uuid": "f5a4fee4-08be-4785-9e40-b7f639ea376a", "value": "24576:lsekQS5cFp4i3R8MKTZHLUrLbPcFhTGTz/MmIon7PPNRLDTJu9FoY4wyip:lse3S5cJjK1UrLjcn4JrhdDlEoqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763132470, "uuid": "99aa05f1-be83-48c7-95fa-a2594e4fb7f3", "value": 3840376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763132470, "uuid": "f97fcc8e-2f74-495c-bc0b-9e8c3167e115", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132470, "uuid": "b6f31f62-6e3a-4630-8328-e09813c01b1e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b0ca5b-c16a-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1763132442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132442, "uuid": "4b934063-3a40-461d-9aad-002ade978012", "comment": "Malware payload (PhantomStealer)", "value": "da137aff1f7feb0f62a88d862a81e97d", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132442, "uuid": "73788d33-bdae-401b-877e-81de3783dae1", "comment": "Malware payload (PhantomStealer)", "value": "4bc299e137211c8c17385adeb6966b5eca2601f7ad6226f97dc0ecfdbf6f6b59", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132442, "uuid": "8106790e-0056-4998-9cd0-605a9bb7400e", "comment": "Malware payload (PhantomStealer)", "value": "af4a6ea369e8002a552a64366cf7adf8f5b6af18", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132442, "uuid": "d25528f5-4193-4035-9681-f2e2709ba1ce", "comment": "Malware payload (PhantomStealer)", "value": "bc423225e673cfdd9a6c6b3d9e93467938e46fac6dec584ec7bfe42846f3600d062db9fee0a434f478114e7fa1d1b72c", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132442, "uuid": "0c789318-2ede-4983-ab4d-030d3094320c", "value": "T1BE453383B1CCC295F6D41C2BF6BEF06C312683C875E9D1E732829562DB5B26C5E1660E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132442, "uuid": "9f15677c-5ba3-450e-9489-547b429e8dbf", "value": "24576:EwZ1KYgR9YqgraQS9u+ct16fWWQII4OLWj2dqp/RtnXiIvkUFy8g:Ew1traZu+cvEvI4UWj24pD9hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763132442, "uuid": "c0955cf3-3900-44b0-b4f5-064d84f3ca4f", "value": 1179530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763132442, "uuid": "08f8e44d-0036-4db1-967d-552d4f9bac69", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132442, "uuid": "55b033dd-3442-4d01-931a-53a090ec9f89", "value": "Revised Proforma Invoice8268001.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbea059-c169-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763131897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131897, "uuid": "34cbee18-f889-4c6d-a1d5-4561f002608d", "comment": "Malware payload (Mirai)", "value": "f7780bad556412604f9b5e0822192a34", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131897, "uuid": "5db87e55-b5b2-4f23-aa6d-20a31e9822da", "comment": "Malware payload (Mirai)", "value": "4be859320d5b8ab6fd196653cdf8fbdb2341144f5b0a4e88eed63e5fbbb0d999", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131897, "uuid": "0ec4151d-3097-4b1d-990a-a67ef8b9d3db", "comment": "Malware payload (Mirai)", "value": "66680317109604f0733a20c05c763df5630e2496", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131897, "uuid": "9dda9779-84ad-4f05-ab8a-c5d572fb2e7b", "comment": "Malware payload (Mirai)", "value": "ea91dd5d1e12de43950ab77504482942f6a9c2db39e9a8139d72e378960acc4c760b56146491c2ac38215c063f931fec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131897, "uuid": "cde65b31-38c4-4707-94f5-dbf866f4fd30", "value": "T1A69329C6B841AA11C7C15573FB1F52CC371A43E8D2EA32039E295F64778796B0E3BA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131897, "uuid": "58c3f8b9-99d2-4c18-9bcf-aa2fefe26a8a", "value": "1536:2gGxeQ6wsP1YtEuH9QxKU+gHUOJhqspzVqsfv/5hj:a69dyQUU+gjqSVB/5hj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763131897, "uuid": "b8bbecbc-a409-4642-92d7-88b1786bf457", "value": 93224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763131897, "uuid": "a87bb577-1b04-4385-b94d-3d0acde6bf1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131897, "uuid": "93622f57-0940-4c46-9f7e-6f487a599b1f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e350454e-c1b2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763163451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763163451, "uuid": "17cfa778-c566-4c0c-bad9-e3d11f03a0ec", "comment": "Malware payload (Mirai)", "value": "185cce6008aec3f7b36180deca241996", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763163451, "uuid": "df3fe5cd-ab1d-48ef-810c-e0a92db88a04", "comment": "Malware payload (Mirai)", "value": "4c5d93d39685d9da39a0cf486d866201606356d5a0aa2c1ad159303132e43c03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763163451, "uuid": "2dcaeac5-39e9-4968-8957-592270862670", "comment": "Malware payload (Mirai)", "value": "fa1984abea279e2329ee9b7185d2993d48926741", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763163451, "uuid": "f96d91dc-5fb7-46d0-aa6d-4be676d5c6db", "comment": "Malware payload (Mirai)", "value": "9af07463a709aaf07ae8b2d3b1998c43e6c83f70cb1eac2922465940c7b66d5f1ad71d95d20d726719c19176f5eea2a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763163451, "uuid": "5a7d4251-68b4-4b14-a9e1-6d43dcabdeed", "value": "T1CE03E1568F19C4639F3909F3D02982A8D45F0BE9E4A7B5123B00CFD85E462FA9E39157", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763163451, "uuid": "62ccfc69-61db-4d91-b158-b09efb2eec71", "value": "768:tMFXq2sfku1S3jq8xSkfenTQioKT6ZTvP5P7FP8eI+aud83CBR0I0F7q3UYu5:dwBSFTQiorbN7FP8T+aue3C4Dj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763163451, "uuid": "3593aa70-6750-4cb9-acf7-543737dd4a46", "value": 40868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763163451, "uuid": "c295642f-cc2a-4d56-aeeb-5dc17a8f68d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763163451, "uuid": "52ae7569-484f-4353-b54a-bd20bd6e3266", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2d6e2b-c18a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763146202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763146202, "uuid": "982c2eef-2fd3-41e6-bc31-84d5cd295a03", "comment": "Malware payload", "value": "13c594e2bd3ac5a1a359d871a8f6574f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763146202, "uuid": "a184aab1-e590-48d6-9303-98408953d138", "comment": "Malware payload", "value": "4c648fd3fda9b2a25947c045f5deade94a4fb521e150ec4a77a688af6ccf82d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763146202, "uuid": "a6afed36-423f-4126-9924-1e1338d8ad09", "comment": "Malware payload", "value": "97732f2d2560c07c4d087a94741bcbbb584adb4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763146202, "uuid": "97f95027-49e0-482c-93f4-bc9afd3cb219", "comment": "Malware payload", "value": "05af9480be149ce76cc6fa14c96a68eddff3c9aa82ad64b686d84ca1fb6cd625564a4209a3add5d07ad42232b18faa2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763146202, "uuid": "429c3c09-5f0b-47f2-9a5a-8cf62ad6a769", "value": "T18824D8077BA19EF7C89BCD3306EA860110CEF45725A46B2B7374DA6CBA0A94F49D3C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763146202, "uuid": "e724a01c-78e8-40c9-afe6-2431e53781c2", "value": "6144:uP9qH0Nz5OV+aj4VkvzvgreG3/i1423RHzfWo:kqHiUzjhzvgreG3/i1423RHzfWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763146202, "uuid": "5603e329-29a5-4a2d-90b3-dc3496a4327c", "value": 224410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763146202, "uuid": "fc9009f2-2328-4b63-8e3a-3fbc11c747c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763146202, "uuid": "3d8e154e-65a9-408a-bd73-4036d3a5dc8b", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8141962d-c127-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1763103586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103586, "uuid": "32c52ec8-807f-4a55-8c3e-c7177f18933f", "comment": "Malware payload (GoToResolve)", "value": "ecfd9cc2f811eb10f8b6ec8e1d350e42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103586, "uuid": "8436ae37-eba3-405e-8dc5-3d5196d85644", "comment": "Malware payload (GoToResolve)", "value": "4cea7ab464e29d66aa5924f75ddb6d6cd8826987569db77569760d991ba74c08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103586, "uuid": "fe4df093-ff6a-4ae6-b581-f4f8c0dd6e4e", "comment": "Malware payload (GoToResolve)", "value": "9eeb45b46b2fefc4de31bc954fe75ed2cc7f967b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103586, "uuid": "d14a7539-3eab-4dc8-b88b-c95d0e96376b", "comment": "Malware payload (GoToResolve)", "value": "6a49f3974b40afcebf9144ba1707d1f83730b158fc31ac37cbafb84934501b8d85e96a40bd32ca63942cf881d5e68679", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103586, "uuid": "375f203e-59e0-4963-904d-e56d7cf38f3f", "value": "T12037333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103586, "uuid": "a1c12e47-2bf2-484e-941c-3a747a7df518", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103586, "uuid": "389818bc-1d07-41c6-8c67-4b4132c4f02e", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpG:q9WtLzgOTbjZvk/ekS/mcpG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763103586, "uuid": "962ff214-de38-44be-882e-6dbb0f8709d6", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763103586, "uuid": "bc97f164-1895-4940-977b-0d5aa5f10585", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103586, "uuid": "d9b80127-084e-41ae-b897-6396afa6fc4a", "value": "Party_Highlights_2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f7fc3fa-c169-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763131769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131769, "uuid": "96adf8fd-7d19-479a-a4e8-b29352b61bdb", "comment": "Malware payload (Mirai)", "value": "20c2ead204a4fe951bbb5ff1a79be350", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131769, "uuid": "d0d8ffad-1802-4f5b-8be4-10bb516a4e5e", "comment": "Malware payload (Mirai)", "value": "4cef2f42c2e651543666352a1b44c34f9326f697d0691b294f76c5b38d218ec0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131769, "uuid": "5c91342e-aa77-4d4a-9f7d-4b63ac48f869", "comment": "Malware payload (Mirai)", "value": "a80ca14399f91e575fe2f25e249593309c8d1167", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131769, "uuid": "d5535a90-9f08-4a00-b77e-694a615ecd01", "comment": "Malware payload (Mirai)", "value": "0e2cc49938576d559cf79f7eac95424f693fed5c64be3462a86d7fdc9361e5c62afd500b87fdb1ce1afde8bb39c5e96e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131769, "uuid": "564171d5-00a0-49cc-b650-d8b359299d68", "value": "T1D3B3090AAF600EBBD86FDD33069D0B0635DC555722A93B76B674C428F74A54F0AE3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131769, "uuid": "0362c9e8-8cd9-4151-ac7f-f115df3de1cd", "value": "1536:YOYvIrst9LSxx3XAD4jKUFyobFkMw7HQ7+MnzZm3bzct/BffexNh5hI:vneD6Qu5+Mnz//MxD5hI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763131769, "uuid": "b6310340-ae28-4af1-9bfe-247806023dc8", "value": 113696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763131769, "uuid": "adbccc54-0491-4152-80ba-b715dc807351", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131769, "uuid": "5c69dad7-8ffa-43b5-a450-cee944a3f470", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c961b23-c0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763081271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081271, "uuid": "c613a1e4-5fa4-4730-a967-b30843d18ec6", "comment": "Malware payload (Mirai)", "value": "aaf7f5bd3c19f772ccf6010bf69e66ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081271, "uuid": "ad3e2c97-79be-45fc-857b-fde1c827ae24", "comment": "Malware payload (Mirai)", "value": "4e3a2e60f111df12b4fe8c20b2236a6af30fe90c11634d01fd53183f2d9a7f9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081271, "uuid": "3732b422-df40-4bca-adbe-231a9e680b55", "comment": "Malware payload (Mirai)", "value": "82e8829ed08e5fb7b8c6541f2c434717f51834cb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081271, "uuid": "e56a2cab-5f42-4d02-9c71-8b010a49dba9", "comment": "Malware payload (Mirai)", "value": "987c407cb965b5d9e41d13a7a946a4bd4edefc2d6ad61b09a9da323606075e11b70107ede00f1ba5950882714e651940", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081271, "uuid": "86dd6ede-156e-4b8d-aa6d-5dbaac2eb6e0", "value": "T1512309C8F443D9F9DC5A09742036FB2BDBB2F6BA2329DE43D7A495236C51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081271, "uuid": "65508e4c-0167-4b7a-8d09-ad259b1e5066", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGAZq/4Qw7bn2ihe:Gv4QPfZfW5XTOeoEz0qAQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763081271, "uuid": "bfb4089e-e1ea-4d4e-83aa-1a89bc129ce6", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763081271, "uuid": "8e18c285-2374-4943-96df-a8c5b240e263", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081271, "uuid": "a6aea185-a79c-4118-87d0-539be4d86223", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b64095e5-c187-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763144907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144907, "uuid": "0457730a-c805-4dfd-acd8-742bfe244e37", "comment": "Malware payload (Mirai)", "value": "d4f33a99330feba807cc46d4b6a41370", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144907, "uuid": "de4b68cb-7325-43ad-afe0-068753a64a4f", "comment": "Malware payload (Mirai)", "value": "4e712ee085d2b7e9697607d0fad375b786d46dde1ef7c85ffa449bf9aa839b72", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144907, "uuid": "da5952d7-6de1-4313-9ff3-96b28c24c255", "comment": "Malware payload (Mirai)", "value": "56feddd37fdc0b3fce6cb0d26bc888f68cc59cc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144907, "uuid": "9236e9dc-41d9-4a6c-be67-49e60cb5d8c7", "comment": "Malware payload (Mirai)", "value": "1eb62dcb117799daffa6abb047cd39d961bd4cd4f843edcbac12f6031e679c7f33e989af2c64c8a00e2b7a3dfc5c40f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144907, "uuid": "c3337d2d-23c6-4855-a9d1-936c922d22b2", "value": "T185A2D03CE0160F66CCBB32BB81BD2BEB119CD511EA8C5B86EB84C9671692295E534D1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144907, "uuid": "1ef7ecc2-00de-4837-adb8-1a5c70cef52d", "value": "384:MyRCjYIWjKgItC8vd+tIMvgrj/HyoVSLN9inmWNSGbC+v1RQq:5RSYIShmktFgrj/SoVSZ4nmWLb9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763144907, "uuid": "9995c380-457e-4a1b-853e-484a062e300e", "value": 21708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763144907, "uuid": "1494cc16-9132-4a7c-97b4-dd70a8bcca60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144907, "uuid": "8d476cdb-d42e-4a19-817e-76b130aa709e", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3c5e78d-c168-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763131588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131588, "uuid": "f4907887-15c8-4f24-abfb-2d8004cc88cf", "comment": "Malware payload", "value": "8f64ec1c6ac17a3f19ee88fd22eb2b46", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131588, "uuid": "7124dd32-9589-4d16-9074-8668ee68469f", "comment": "Malware payload", "value": "501cce9c9ff55227fcd29f875fedf894032a8cc2e90f1256ecd9ad9f74e8e5bc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131588, "uuid": "170b403c-8823-415e-b89e-5ffdc9929eee", "comment": "Malware payload", "value": "c4fde863c0c5c6bed24041cb7cdf33e75131971a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131588, "uuid": "6923efe3-4629-4e49-859a-f1953e382c96", "comment": "Malware payload", "value": "296c397744b505494d549331f66e23ba9ba271e043b6d15004923cf301e385914ea7271b25866fbf6fbf890b73dba127", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131588, "uuid": "3f73dc9c-a4e5-4cc8-b368-ff133f2922c2", "value": "T1ABA2D02987A03A5ED931D23B59EF304A7F4100898517A7C8784C70DD18F8EB16BBFE25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131588, "uuid": "b7405deb-b143-46b1-8e0e-b76fc8be7e05", "value": "384:ODyaNya4JjxBGRocTOnpt6Oo/0dRILfS0qso+auNPbOy7/NimN8dWXS6SVtj7Ea3:rwyacB2anf6vzeft+hZhN3adHtbwa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763131588, "uuid": "ffcbc2be-e902-4e14-ba28-b353d0a3f2f5", "value": 21766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763131588, "uuid": "b4af8e60-8eb7-47aa-b853-c9d84bad5696", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131588, "uuid": "4873e921-55f0-4cd4-81f4-edd915f2cde5", "value": "PO# 45821 and 45822.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a6b403-c0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763081229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081229, "uuid": "a8e8815f-ae1d-4962-803f-ee7d7e35be7a", "comment": "Malware payload (Mirai)", "value": "08cf2b5ec640f3dc1faa4f89576b90c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081229, "uuid": "a1c9832b-f8b7-4560-851e-678302056347", "comment": "Malware payload (Mirai)", "value": "50324ea50e7a14a5eb5093198146cb17ea620f70247ce7e4a740dedb866f2a98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081229, "uuid": "8de002e6-3a61-4997-a28d-6a1802f2bf8b", "comment": "Malware payload (Mirai)", "value": "38447c5dc1b03e4f3b27f29276c5c7f3d64b4a1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081229, "uuid": "3a2f7f87-1ddd-48db-9314-6b412d9bce70", "comment": "Malware payload (Mirai)", "value": "3536ecc25927a079836f4b0d05feac1d038afb71c27dd9bce062ffba68050235262f8dee7374bbcb268cf3136ae12040", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081229, "uuid": "daf96bdc-d7bb-4cbd-acdc-b2deca787a89", "value": "T121A2D115D345AEF4DFEF9C9457C2C2C2B6E946C6278AC8F340FEAF016506046B789C59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081229, "uuid": "8a6a7689-440d-48e5-a12a-9351c905bf79", "value": "384:9/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5t1M4uVcqgw05VxJr:9RxsSVsMD6xiJJE5zRWNza4uVcqgw09h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763081229, "uuid": "2c9a1799-a1ad-428d-9d26-6f4fbd96b881", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763081229, "uuid": "1d97f318-9d6d-4321-9f37-78dc2b02f00a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081229, "uuid": "09672374-b09b-48de-9726-e6232427e678", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa2500d-c153-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1763122419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122419, "uuid": "330a7ced-fc6f-4e69-b883-e3ee8d543d5c", "comment": "Malware payload (XWorm)", "value": "79292fadad6077d68df1ccdfebad2690", "object_relation": "md5", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122419, "uuid": "f4d610aa-c5fe-4f74-b12b-9cc26d14250a", "comment": "Malware payload (XWorm)", "value": "523afc5343538e1c08c3198de625c58e019b7bfbdb8f0d6e52012c7829578af8", "object_relation": "sha256", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122419, "uuid": "ad41ce0a-0c9d-4ac9-8963-3c3b824ae2fd", "comment": "Malware payload (XWorm)", "value": "f3cc3cf65b224c2bb2cc83e77d003c2c3734a735", "object_relation": "sha1", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122419, "uuid": "27e53e6f-3c32-4061-a112-1563283a0645", "comment": "Malware payload (XWorm)", "value": "bccf230e5525218327c3234265dbcbaebd9140d5a1e8f5582bb7e0ba75a026cbf23cce904658842042c4dded3ad97aec", "object_relation": "sha3-384", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122419, "uuid": "cc99a281-4b97-4823-9940-3048676aeec8", "value": "T109C2B082BBB6C514C4DE4F7DA8FA83681A33F5825652EE5E4884801D5DFF7504643FA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122419, "uuid": "e43b4c4c-e235-4f3a-829b-1e2687874f7b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122419, "uuid": "6f7c77e6-ec91-4e8a-9841-2c273384a4da", "value": "384:cSD9zBJaNYI/jDMGgsDX5xWlBe1DA3vYjIco7OWc2f4maSgKhle0+aCArEAOQ:FgZjDrgsDXmlBAA/Ycco7/c2fLaJQT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763122419, "uuid": "71832317-f2ba-4dec-bb71-1df7b63d71fc", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763122419, "uuid": "533ff37a-0951-44ed-a59e-417251b5a51f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122419, "uuid": "b2d9ab9e-e04e-4709-ae7a-dbe788777f65", "value": "523afc5343538e1c08c3198de625c58e019b7bfbdb8f0d6e52012c7829578af8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9067e6f7-c185-11f0-a129-42010a9c0007", "comment": "Malware payload (Tofsee)", "timestamp": 1763143984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143984, "uuid": "0b7f89f0-fb13-46f1-a8e1-aa7b96401f67", "comment": "Malware payload (Tofsee)", "value": "e6708a489be32c4481b38083f3fd6f94", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143984, "uuid": "e2d6e55d-0d0f-413f-87f2-57466032f321", "comment": "Malware payload (Tofsee)", "value": "52bc6f40fbaaaca7535503c680ae568c9968eea1cad48d609ee7952565067048", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143984, "uuid": "9fd4b2ce-a511-4e5b-beb5-89595c75a3f0", "comment": "Malware payload (Tofsee)", "value": "9c669031bbe6bb94b1166b48c8f462eaae0ac663", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143984, "uuid": "24e7479e-e474-4224-bf61-13e39fd4caeb", "comment": "Malware payload (Tofsee)", "value": "c7423723065d5a6ecaea548ac21176392a199ae20261130e07b3e1d58878667f049e21c62234862802ea3e8342f05cf6", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143984, "uuid": "be3919b1-4645-46b3-8270-ce1790fcefb8", "value": "T19B960123A38E233EF06A56375976D970553FBE61651A8CE397E40E4CCE290A01D7FE42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143984, "uuid": "fe35be9a-4d1c-411e-baf3-8a604f32e2f2", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143984, "uuid": "0379233d-7a0a-4927-bbad-2d436a17d3cc", "value": "98304:aDbRPQlAsV2EWv11/Fatytr3OwTvUtBIUTUxAav/e:aDb9QlAw+jayRO6vU7CAk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763143984, "uuid": "a94a0563-c059-49f6-bfdb-7914bc657cd9", "value": 9214486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763143984, "uuid": "58f38d82-961b-4330-a67d-274d9b5ab7f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143984, "uuid": "4cba2cdc-e022-4c68-98be-3d774f781ba8", "value": "52bc6f40fbaaaca7535503c680ae568c9968eea1cad48d609ee7952565067048.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5754c93b-c153-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1763122414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122414, "uuid": "06b59cea-0c2e-4f0c-b89b-002563ba80b7", "comment": "Malware payload (AsyncRAT)", "value": "c93622dc2d4f41de9683699728a475d9", "object_relation": "md5", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122414, "uuid": "d621574c-c210-42e4-951d-c92056fa7a34", "comment": "Malware payload (AsyncRAT)", "value": "542c967f9a953d232f5adcbaee0ef0ff0da65e617ed0c79cd042b419cd9ed68c", "object_relation": "sha256", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122414, "uuid": "67e52752-7785-4595-8eb4-c003b1a868ae", "comment": "Malware payload (AsyncRAT)", "value": "2496649e6ee2be57d4b81df3c478067a29415476", "object_relation": "sha1", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122414, "uuid": "eed478f9-d904-4883-a511-8f37e1618d79", "comment": "Malware payload (AsyncRAT)", "value": "50ef6dfe06ab01f15087bd0620a7a01f1e37e37d2ab94160c1aa589996778d195ead0259a7571eaf7fc173ee3f67f720", "object_relation": "sha3-384", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122414, "uuid": "224204cf-cfb3-448c-aa4a-3aa326719b69", "value": "T156F24B48B7A04615D6FFAFF119B361060A30E60BD913EB5E0CE889DB2F637808D513E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122414, "uuid": "73b18c60-1764-440e-99a4-465856f37f78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122414, "uuid": "ed03babb-406d-4ee5-8827-df2a67b9c1a3", "value": "768:dq38VPCpR3XO+WzDQp2/cs75p3OFu9YiOjhw/vWG:dC8VaHO+mpR9peFu9YiOj6nWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763122414, "uuid": "f40b563a-bd24-4d93-8b8b-f78d10040e00", "value": 36352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763122414, "uuid": "059f9361-de79-4fb4-9e6a-0bad55259bba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122414, "uuid": "ac3db036-f298-4a99-83df-4f39c581b972", "value": "542c967f9a953d232f5adcbaee0ef0ff0da65e617ed0c79cd042b419cd9ed68c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e942544b-c175-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763137261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763137261, "uuid": "5ce758ce-9a38-4ae4-a404-c55e61c05062", "comment": "Malware payload", "value": "8a174de00e14e6c51464b2abbb020800", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763137261, "uuid": "2bda0714-f486-46ea-b0da-be65c466f2c5", "comment": "Malware payload", "value": "546d3fdd8a6c86aa968d8a1f1fe7f938a9180d20a69d1d0efdca0300b562182d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763137261, "uuid": "ac59f668-c2ab-43ad-b47a-13bdadd1bf8d", "comment": "Malware payload", "value": "06d308439d03e64b59c57c626b2d97ab4a907ae7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763137261, "uuid": "e9132136-1d2c-4bbd-a201-12bff60098fc", "comment": "Malware payload", "value": "c7aa9f85cdfc45a434d05717698ca76492a747c42fbb2b9d6b440e23e59e06ea210d9e05b5c3a01c9b9d249f007886c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763137261, "uuid": "58dafb81-ef50-4d8b-b8c4-74fec56c2738", "value": "T1CDB22A86D50354F5ED3B04B028EBEBFF96763A215437CCA6EB60EE46FB52C251848709", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763137261, "uuid": "54101d71-f343-415c-b448-33006668360c", "value": "384:he7+h8mNCK1NIBhbDhwcwhcY2/rsw+66SYr0OrZ2t7KaS7Fhic:M7+h8moK1a0ZhZ2zswT6SYYKoMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763137261, "uuid": "11827253-629e-4db4-8239-398ea10cc893", "value": 24542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763137261, "uuid": "474e5951-03a8-4e6f-9db9-df97c370328e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763137261, "uuid": "a29f8e3e-eb39-47a9-9ce2-faea10a6e8aa", "value": "SecuriteInfo.com.Trojan.DownLoad3.40744.22238.18969", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876bfa13-c176-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763137527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763137527, "uuid": "3805c656-09ad-48e3-ae1b-55371681eaed", "comment": "Malware payload (Vidar)", "value": "b7a09534978efa4ad6f79682a81e12cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763137527, "uuid": "560d370b-23bd-4685-9f93-45bdd137c25d", "comment": "Malware payload (Vidar)", "value": "55fdfe215663f518b050daa974358dd52d46d885642a6c3b982c924a0c2fd2a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763137527, "uuid": "a890e1a0-6004-402b-abf4-d5f889b761a3", "comment": "Malware payload (Vidar)", "value": "df234e414ad69bf1e3c8e02a093e3e13a78e05f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763137527, "uuid": "60888031-e002-4f72-81d5-fbb82cf26533", "comment": "Malware payload (Vidar)", "value": "27f8ec831342eeebfc5808ee4ef2fa7c55a4181de2a7382de454a4c6f8a589a929443f539e29f05d9c32c0d49f9f931a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763137527, "uuid": "004d3a5f-37cd-4453-964d-8414ac34a70c", "value": "T1A23523686628DB03C95B0BF41960E0B413B9EFDCA815E7125FEE6CDF38BA7104992753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763137527, "uuid": "313966b2-14ba-444f-94fb-a347c0c77734", "value": "24576:9HAwfwoS51HgyqKZyrWfqiF3T7tfEwTs:XTS51HgFGy1iB7tfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763137527, "uuid": "55ecb87d-0a88-4364-8e51-f261ebc6ec41", "value": 1077248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763137527, "uuid": "590dd146-f8ec-4b49-8b05-6884808f85e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763137527, "uuid": "12d1badf-5592-4183-8956-e99beaefdcf3", "value": "get-hacks.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32b8832-c153-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1763122594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122594, "uuid": "741df151-ebd8-4e19-af45-187f6c12827b", "comment": "Malware payload (XWorm)", "value": "18dbe1bb67957a96b35bb39407a9bdd7", "object_relation": "md5", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122594, "uuid": "c17de3a4-eb30-4300-9102-b82b66afccdd", "comment": "Malware payload (XWorm)", "value": "58281e2d22c3e26447fb53d9068fc373d8a7bad2b5446859a66eafd512aa56f8", "object_relation": "sha256", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122594, "uuid": "13499d3a-094e-4dea-92f5-082284b43644", "comment": "Malware payload (XWorm)", "value": "afe0877cd32df705481286a5020adef014770c88", "object_relation": "sha1", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122594, "uuid": "34ef4602-0d91-4a9d-8587-84659bc45da9", "comment": "Malware payload (XWorm)", "value": "a9288c6f81895b78a9af16a0f32185d110e55fedca38c6ada5ee306facb4b246544ce7489c11b4296472eaf12ac5558b", "object_relation": "sha3-384", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122594, "uuid": "e409215b-f98d-400f-8752-37aeb6dd646c", "value": "T182C2C1046BD9C335C2FB4ABD897257544A73DB881853DB1FA8C0401E2DAFB498E539A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122594, "uuid": "7999314b-769e-4bb5-8062-7173787d4ad4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122594, "uuid": "bdbc2f41-3774-4d83-b5dd-fef921d5578a", "value": "384:Ky6INO/O6++uEM5cEtCtXigjBmKufz4ZNctI9evF3NDESXOoPsIra8Eg:zn+uEgSigazuNR9GzDESXvV95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763122594, "uuid": "d6ba5d72-2058-4a64-8f93-d04d9befa9d0", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763122594, "uuid": "6ea1860d-716d-456d-8e01-a8e42942c9e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122594, "uuid": "c75aef44-8d94-40a9-9f7b-5219aa95ef9a", "value": "58281e2d22c3e26447fb53d9068fc373d8a7bad2b5446859a66eafd512aa56f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0137493-c135-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763109677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109677, "uuid": "8ad4abcb-f5fd-4269-9cab-c6d0c5c631be", "comment": "Malware payload", "value": "818a77180b0d4adc31b35e52898f1439", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109677, "uuid": "a985c76d-948c-41b7-8cdd-4680abaafbef", "comment": "Malware payload", "value": "59299bfe3877daa33c85d345a32cb438ad765d39049fed604eb2051b80a2c4b5", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109677, "uuid": "a9b61bed-1f34-464b-93cc-b949d1023d52", "comment": "Malware payload", "value": "0ce1af9223045a081dc7fa8505f567ab34d2a579", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109677, "uuid": "af6b38dd-264d-4cf2-baa6-50f3b2af8fe1", "comment": "Malware payload", "value": "233dc3f55009c20d9d72ffa3e5f7733c14e8d2e33f081fae2b5c2fa94e85a1376bdc6074b792df93e2252543ccb4fbab", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109677, "uuid": "306a69e9-e50e-4ead-8861-8e62fa5ccbda", "value": "T108513A2F3A202A2AE6B7BA3632C36345DA700F0879F0F5348807AED45891CE28208099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109677, "uuid": "2478750d-c883-486c-b864-b2e0c342c0c6", "value": "48:96aYyv+e8YhXkxV2GIyubj3shuhGrLp2/uIOKjEZQNGOD1oQ+P3sU0bRsb/WTHyB:QaLvb8YWx8GIXbj3shuhHWP+N4f+sjcM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763109677, "uuid": "591457df-2b1a-4c72-9085-a514a94b5bbf", "value": 2449, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763109677, "uuid": "9ec66f76-d163-4bcf-bf02-b6bc5a8c20fa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109677, "uuid": "d9bb8c42-182c-48b5-b7d1-5b46d9157277", "value": "SWIFT_Transaction_11-14-25.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4be81a-c194-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763150366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150366, "uuid": "d2e3ec0b-89a0-4e61-a425-5ff2a0fd5062", "comment": "Malware payload", "value": "aaa5098c9caafccf15362b017825c64b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150366, "uuid": "9ccdd96e-2c13-4b0a-a449-3f7f578bb50f", "comment": "Malware payload", "value": "59c29436755b0778e968d49feeae20ed65f5fa5e35f9f7965b8ed93420db91e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150366, "uuid": "7b0bca85-71d8-4731-9de8-7bfd4520748d", "comment": "Malware payload", "value": "f5fc002cc1f87c9c907be7e04170e89de4f0bda8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150366, "uuid": "49c944ff-ef46-4e15-9ae6-49fa3271e7c8", "comment": "Malware payload", "value": "29617d25bcb2550593d80c6a3c2813673b8e798737a0ebdda830c929addd6b145972f7292f202627ec0e9c179f67d7a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763150366, "uuid": "ae092b73-130d-4ec4-a372-1fd0321fd507", "value": "T18B9533D309864BF0BFA2EF3451585D86EA60EE744B7CB2B8F3B0A27436436E5E160475", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763150366, "uuid": "99286854-134c-42c6-9503-c4ac1d4eaf52", "value": "49152:EpCKabVQ+9qlNlpjN8H8JZGtucdfFY91ujYIQ+:fBqnN8H8HIazujYIQ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763150366, "uuid": "8553f975-d7c3-431c-a346-2fdb92090500", "value": 1880264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763150366, "uuid": "dbeebced-058f-41ee-9f26-8b08f000486f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763150366, "uuid": "ffdd4d3b-4ff0-4bb2-bf5a-cc9d51f40501", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941a89b4-c127-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763103618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103618, "uuid": "fde16a9e-60d1-4108-933d-803d4ab5afe8", "comment": "Malware payload", "value": "8c35817928272f6fbead77c438c56d65", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103618, "uuid": "289abf07-af92-479e-9405-bab02fcebf3e", "comment": "Malware payload", "value": "5a373365fc6ba417775d673ba54f8ccea5160e487aa878acbe8efff392669540", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103618, "uuid": "04705c8f-a2c1-488e-99c1-4d8613c63b1a", "comment": "Malware payload", "value": "471f92fe39ed004e721064af550d65374e0b7691", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103618, "uuid": "7efdba39-d8fe-4aa2-bdd8-c5f87f6dbc52", "comment": "Malware payload", "value": "178b0c4b97c32fab28661b6055683c81dec24f1a48cdb3b5b7bba2c0d9f57491d74fef1e6eaecabe0ab45b973c97a131", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103618, "uuid": "e917f55b-d561-4403-aa45-cf9d0c892e9c", "value": "T127473386F712548ED4F64B31487846B81277FC32CF1BD2936898BA3D18B76E14F58AE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103618, "uuid": "b2c2c1b2-8cce-45c4-92b2-3ca7374c48da", "value": "786432:HCN6NgW2W2O7csZG0OlYbsPEwegZBh3P2:Hg6NxBBQ0O6kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763103618, "uuid": "bf1a0bf9-df70-4f7e-8454-06a706a9b78e", "value": 25443264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763103618, "uuid": "a6070def-ecd7-4f12-bb9c-b081af333c90", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103618, "uuid": "93e282f6-6d62-4bae-82f1-856815ed635d", "value": "j1sp7110.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce92d59-c15c-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1763126557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763126557, "uuid": "8e3e69e2-298f-427f-bc43-f144fb8ea53a", "comment": "Malware payload (ACRStealer)", "value": "a9eebe1cb0f2b7582581b5a1bfb364b2", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763126557, "uuid": "0d80fd94-5489-4dbc-ad1a-fa8928e85e37", "comment": "Malware payload (ACRStealer)", "value": "5a4f6f184148b49522ee0ff07468462eb75fd3b8701ca9498f5c04e90a29fa61", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763126557, "uuid": "9b528581-fdcf-4de0-bfc6-61f880716e6a", "comment": "Malware payload (ACRStealer)", "value": "2d8f4db9b2d45122a4aa2f7e336f77dc7731e806", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763126557, "uuid": "80b30781-8fe6-4538-aa9b-e98c2f4c4ffc", "comment": "Malware payload (ACRStealer)", "value": "4ff5be908d38550829aabd3fb4997644e0b6188d2c938cd1dc36e2e3a307728a53bfb0316f0b52913f22cc9fc6a2fd48", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763126557, "uuid": "a7a0e0b0-3251-49ad-9d41-b8b3dafec239", "value": "T131176C1732EC0198F0BB927D8A9BDA46EA7278154711CBCF19E0425D1E37ED84E7E722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763126557, "uuid": "d91698c6-8bb4-4ac2-838f-26bf6cee0764", "value": "8a6efacc9c79e3588a2dd442ee1122cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763126557, "uuid": "eab94a85-a246-4dc6-94ab-dacad34e4d3e", "value": "196608:jVU75hhwk9FKOU8wBSVW9Qq7g3aRA93r2uWk:5+5zp3KOU8wBv9Q0iFrWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763126557, "uuid": "93210eb0-b3f8-4a58-9d62-9db5b65fa045", "value": 18493088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763126557, "uuid": "307916be-0b24-4e34-a3e5-f529a788b9f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763126557, "uuid": "ecc9296b-1502-416c-9f21-eba5f74486b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9de025-c17a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763139064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139064, "uuid": "5d0d63ae-2bd8-4365-a818-d8b0ee725082", "comment": "Malware payload", "value": "69b19befff5f4106fc05e488bdc70672", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139064, "uuid": "cdd1b489-3f4d-4b24-9257-977ec8851227", "comment": "Malware payload", "value": "5b5c0f4d79ec58cff170a4e6c0810d9ac0f1a8370fefd5f8070a361516aba072", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139064, "uuid": "907f5a85-4a5d-42a1-9522-63718d761a74", "comment": "Malware payload", "value": "9c37b40fedef7db3083f0cee23b7ed98eb07af99", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139064, "uuid": "c7a58acf-93be-4d60-89ff-5b5e8decc748", "comment": "Malware payload", "value": "8201025224dba167b575b67ea309f5716c80acff35002efcfc90b2c2d0236e75c56f3b134b0a8b7886755bc688790c0c", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139064, "uuid": "3ae2531f-fbbc-4416-b819-4e5ae51c5763", "value": "T191110C0EBB050081C3B13FB06C8A2E26126412523312AE231B3F04A92EFF367CA8C18C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139064, "uuid": "cf4b05c2-cdf0-42e3-b8a9-df8e86f91cdf", "value": "12:5jKrrLNsmruywUPkbnmVq8wEmruywUPkbnmVq+ZHrrLNU+MtwoL:94lsmPynmcFEmPynmc+lre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763139064, "uuid": "5638b3c7-5c5f-4632-85f9-862a8ee8047b", "value": 884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763139064, "uuid": "afcd3b8f-e243-494f-acc8-a5b5b6cd9572", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139064, "uuid": "255d9f03-a82a-4973-9cac-2743fab56d11", "value": "Attachments.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416e6bdb-c182-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1763142563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142563, "uuid": "412b8864-7136-4449-b435-b6ae5a78ee08", "comment": "Malware payload (LummaStealer)", "value": "45c7e81edfdc705bce7cb688d333fbf1", "object_relation": "md5", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142563, "uuid": "b7f49c22-c55e-479e-b7a4-32d7d6cb11c1", "comment": "Malware payload (LummaStealer)", "value": "5bb834476d2e6a67e5698ac2fbe2fd075e1c85e24f7bf54d4e0d47f7706f8b2e", "object_relation": "sha256", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142563, "uuid": "6d212c1a-e00b-4d42-87dd-c85c47049e58", "comment": "Malware payload (LummaStealer)", "value": "0ae3fb22e9c0beb3269a8724724e19efb814d82f", "object_relation": "sha1", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142563, "uuid": "422efa32-39e6-46b3-826e-9e04e1c05bbc", "comment": "Malware payload (LummaStealer)", "value": "08e2d3e64e19ff1c05b2fbc80691852a5ebb5295ed70ed427cf2a41c6007bcf90dbb2bde677bcf67949509c3cecaadbb", "object_relation": "sha3-384", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142563, "uuid": "5ad62471-cc60-4de7-99cd-7e7865276628", "value": "T12E269D937E99C867D359B23288F251F7A625BC4A233127F719107A3A6E333E019B5731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142563, "uuid": "a0250fb8-7bd5-4c4b-ad30-3db2f1dceec4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142563, "uuid": "daee45b3-5c51-4d98-a3bb-8f5932b13664", "value": "98304:pEUG+kgglLsUGV4OiZrq1DfPHNADtV6v+O6:pErlw4O7NADtV6v+O6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763142563, "uuid": "11c9b809-f695-44fc-bb07-097542f3f922", "value": 4752448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763142563, "uuid": "82156d48-30ef-46e3-bda2-e8db78867f00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142563, "uuid": "df7abe4a-cfb2-46fc-af86-b9af282c0107", "value": "9rbB6rVHb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acc85bbe-c172-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1763135871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763135871, "uuid": "ec01b092-095a-4c0a-a18d-25aa6cc9c8db", "comment": "Malware payload (PhantomStealer)", "value": "7342adb19d672dcd4dcc2068c35923dd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763135871, "uuid": "f6aaa2e3-2eec-4aae-b7cb-265afb813c97", "comment": "Malware payload (PhantomStealer)", "value": "5cdcdc7a4dccf4f3aa5d6989eca5b0f470148eef49cd0d603065cb602d19ffbd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763135871, "uuid": "cf8204ae-82ef-4931-a636-02e47fae7e1e", "comment": "Malware payload (PhantomStealer)", "value": "f5076c3d8843dc9a42f7c1b9003a97e81a287cdf", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763135871, "uuid": "6e2ec6f2-cd18-47e9-846a-4dd47fac91df", "comment": "Malware payload (PhantomStealer)", "value": "37925b8123f3730a49a2519f4562653ef63c9292a48600fddfc5cfde30dd23dd2c28b14e0b5adc0f633ac3d0f602898e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763135871, "uuid": "e49d0e1c-ba22-4841-a25b-12ac914da397", "value": "T14F8611A0538CA7D8D3A1980B5A4561C4E7FD9C8D9B3FE9147721A6F68F326F8005E4F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763135871, "uuid": "96b16916-cab2-49d4-9ff2-bb9579c8595e", "value": "768:WKin9xcFSC6UpjRWBUZ22Z0VRzSEmrIpxG4X9J+VmDHzJ+G7NW:f3SCFIBUL0VUXrIpx1J+2TJ+GZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763135871, "uuid": "47438d67-dc7f-42c6-9928-0193aa8c8763", "value": 8367718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763135871, "uuid": "d12120f8-6182-490e-9e5b-acc81f4fbc92", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763135871, "uuid": "8aca82bf-5283-49e1-8f12-5202eec870ba", "value": "zahlungserinnerung.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d3d71bb-c0ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763078534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763078534, "uuid": "e70d2502-2135-4c4e-a82f-feefecb6d57d", "comment": "Malware payload (Mirai)", "value": "f51e213b91628aadc986c686a7908777", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763078534, "uuid": "63608ec3-b858-43e4-8064-7ba18c6fd289", "comment": "Malware payload (Mirai)", "value": "625c60b9a8b0347d5a3988d73bf19d9c5bc9bf126fa8720dd28c648edb4a0975", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763078534, "uuid": "0ca04f27-284c-4727-ab3d-84ce52ad5dcd", "comment": "Malware payload (Mirai)", "value": "e7571cb084497b4b3186bbfbaf3310a4da6cad86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763078534, "uuid": "5ad7f71a-1257-47ec-ba71-b85629bf4346", "comment": "Malware payload (Mirai)", "value": "619cf670ab8f5c13eb700870c2204a66159f602b8c9cfeb72a936f3f335a142523e14e87c818e25c3a994572332d2b71", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763078534, "uuid": "e9cdac2b-7616-4873-86a5-720c764c8321", "value": "T1F6E31946F8819B16D5C112BAFF1E124E73131B78E3DE72029D246F257B8A8BF0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763078534, "uuid": "4e2aeb36-33cd-4472-b509-2ca5c938cc35", "value": "3072:ZF4fzyPnW87VTI0kXXJGzn28qLULu3Dsxkasd7ejND:ZF4ryPnW87VTIBXB8q0u3DsxkaSOND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763078534, "uuid": "257a3a8d-9438-4029-b849-584d8b18aa82", "value": 149212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763078534, "uuid": "ded9f157-3f73-494d-ae29-60936e1f0244", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763078534, "uuid": "d129d54d-e9e7-4fc6-8ea4-c2ef51f590dd", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1ad165-c140-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763114285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763114285, "uuid": "d8d11b48-3b12-456c-9a46-c9d524df3ce6", "comment": "Malware payload (RemcosRAT)", "value": "4845e5b5907373b1fb56d0abb6423596", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763114285, "uuid": "4b873763-61ff-4fad-bd18-64d78d84d0e0", "comment": "Malware payload (RemcosRAT)", "value": "62da0e40b7ea9304ca48d767fd6ddd0ad1305489622edebde730d0ab942a1271", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763114285, "uuid": "f94fa93c-8000-4e42-888a-174b8b65b23c", "comment": "Malware payload (RemcosRAT)", "value": "cab7836b388a7ede80f4db92718d9822d3df442f", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763114285, "uuid": "68c0133d-d1cd-456a-8781-53dab6068520", "comment": "Malware payload (RemcosRAT)", "value": "d01a5082fa54e5d4c54a9bb454c96d70ced4056d2d237b218df44080c4c8c4ef560cc98eba816873fc21076f2b421f87", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763114285, "uuid": "9621baaf-54a3-4668-b653-76a131d4c880", "value": "T18863FF350424497E53253BAE0B1C52164BC1C76F7E58CEA2B69659E3EBC37A23D278C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763114285, "uuid": "65009a20-7176-4812-bfbc-0c16f411b388", "value": "192:obe2D/QzJnzpuyZBIfcDvml2WcWuBg9e6abzZEniZuBbaEbQFunFI2bzHGVupF22:ty", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763114285, "uuid": "dde98678-f600-4677-938d-07f6ddeb06d6", "value": 70405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763114285, "uuid": "d5f0ca26-aed0-4b56-a3dd-a3f6799e3af8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763114285, "uuid": "8953c0d0-7a67-40c5-9b49-b30242e87cc5", "value": "fsdf98932898gf9g987dsfhfkjhsdf8098sfd0808gdf8g90880d8fgd0fg8098fdg09.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c471c244-c140-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763114436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763114436, "uuid": "da7d9f72-1d87-4ec9-b6bd-2fda2a496be9", "comment": "Malware payload", "value": "072f1c43a4ef4e21933199fc9ce3bba7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763114436, "uuid": "932edbd7-b15e-453f-a309-7e271e9f102e", "comment": "Malware payload", "value": "63d1ec878af783fdd858604c6ddf7021dba2624e926afa8c09d8211d5ed6ea45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763114436, "uuid": "d2d3c1dc-0fa7-4c39-96e3-94ecab2b1576", "comment": "Malware payload", "value": "e4f9d65366d1a872ba020750a00e30b22dc882fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763114436, "uuid": "5c105cc3-e9a7-4fff-8c5d-3309740f2c21", "comment": "Malware payload", "value": "3f002617c54c85a56cee065a0d777447f9ab658c6d28d19e4b8658dfa2906e59f79f54419339768cd04a5d7eedf6d006", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763114436, "uuid": "47eb6545-490f-4f60-8bbc-12880955a4df", "value": "T196C607749351D565C1ABC0708FC74EF465A1A13B41342E0E2BC4D92A2EBAF71AF9D3E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763114436, "uuid": "9a9c83e1-4b68-4302-a18e-db05a8e628fb", "value": "d53ac8c387436e296a26d641efc75189", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763114436, "uuid": "bdc2ea93-ecf0-4a8b-b49d-25b2ceff1caa", "value": "98304:1hJsZQLV3eJW1yq0H9xMh18ZDiIhQauiPLIOv:JQQLVDyqWSf8ZDi4VHzZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763114436, "uuid": "72346729-731c-4a88-a5fc-31fed64bbd1c", "value": 12226048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763114436, "uuid": "c7d85aff-4aaa-4fbc-8d21-359dab17c1e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763114436, "uuid": "30ab2a42-3a58-459f-a37b-79fea4e46da1", "value": "libbrotlicommon.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4fb904a-c177-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763138006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763138006, "uuid": "e45b3a13-3506-40ff-b813-3a76e7a4b452", "comment": "Malware payload (QuasarRAT)", "value": "1ef7ff45d0ef9689ac61b451517a08f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763138006, "uuid": "0ff98180-5c21-4f96-b559-18d1df7a68f9", "comment": "Malware payload (QuasarRAT)", "value": "6475a67a8117925b5ddf98899466ed0a818040eed7ffa6bf4795059116b9f5d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763138006, "uuid": "994ca75b-cbda-45bc-8299-683ddde602d5", "comment": "Malware payload (QuasarRAT)", "value": "27b366c11a4bd793876dacf79ce5abc3462529a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763138006, "uuid": "aabfcaad-173b-461f-bbc9-02f4ea35c5f3", "comment": "Malware payload (QuasarRAT)", "value": "74db815e818ed195e922a26534603f408ee096b8a7223d4c490b92669ae3b2df635aafaf7fa94ded6626d8484282d51f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763138006, "uuid": "4d7866cb-51a9-425d-ac70-e191874f5a26", "value": "T1CB73C068A79CC52EDAEF4F7E6872192207B59B145003CBDA0DCC65EDECAB7004664BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763138006, "uuid": "a8dbac69-aed5-4c7b-98d2-0de12088e593", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763138006, "uuid": "20858e5b-8444-445c-8556-9dca72bfc4fa", "value": "1536:P0lY4ejfqJPoz3bXNaKde3Xao6qvifL8psSwait+oKy1LD2:P0lY4ejfqJQrpaKIHOqaj8CTKy1LC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763138006, "uuid": "b26b8180-9f83-4f54-afb9-26ab2c853dac", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763138006, "uuid": "d64ef5bf-ae00-4777-ab59-319624462f3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763138006, "uuid": "365202ea-e616-4cf4-9e9b-a253fbfc8850", "value": "Sp0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89df4282-c0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763081267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081267, "uuid": "ef1439ae-ff47-487f-b87d-22d12027978d", "comment": "Malware payload (Mirai)", "value": "340277c9f3344602c500821bb825b6a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081267, "uuid": "fafa8997-eca3-4acd-a460-abfb88d682b9", "comment": "Malware payload (Mirai)", "value": "648e875e5a74264b6422c888e69a3eb469934b07d481c9585d82cb76c288ae1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081267, "uuid": "1e086d6f-e368-43c6-94ed-351d53ef1bae", "comment": "Malware payload (Mirai)", "value": "ad667ee21c6cc5f2220f847227ad28050cd2339d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081267, "uuid": "1ebc8e8a-2c88-48d2-b0a8-e9542940297a", "comment": "Malware payload (Mirai)", "value": "c23823993ea3d4b6e83f5f61b4cc261cad1059c5ba1aded86fecf094e10efc2fdccbaf3bbca1e11a55d13eecce6f6251", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081267, "uuid": "b28ff8a0-83a7-4e97-907d-1c7140f2cffc", "value": "T1D963951E7E259FBCFAAA863447B78E16564833DA37D1C581D1ACD6012E6064F340FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081267, "uuid": "a76a32f6-7ae0-402b-8ca9-80608bc6824a", "value": "768:7ZmnnogDILQHYLQHPVVMr4mgYVVMwKykNVVM6r+g/RtrVSYogDOsS5siv5XLatA/:UnN4ZH2SyOyuIq8LMEIUq+cvtpvXzsL8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763081267, "uuid": "42564c19-f623-4626-a615-53a9140d55fd", "value": 72024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763081267, "uuid": "0fde66e8-8e86-4f04-bbee-89c15a944bce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081267, "uuid": "ff54b95e-cbb3-485d-ad30-5516512ef313", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88ebd8bc-c124-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763102310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763102310, "uuid": "802ef0af-8097-4dd7-83a8-cbf3041acf3f", "comment": "Malware payload", "value": "48baaeb3315499d9dd0be7fd1fac4e0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763102310, "uuid": "2810fb1e-a5e3-4390-875c-fbda65e5df89", "comment": "Malware payload", "value": "669f906faeba2ab00b7e121b029a818880d895c7f2b9e09804d5f1e813d8f2dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763102310, "uuid": "0a87b303-16a4-4749-bb80-73b1d42d5503", "comment": "Malware payload", "value": "a40887597b8e54067dc1871e66076094fc7a7142", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763102310, "uuid": "5aa6f52c-1ac6-4f83-b9ef-d0bcd7295d00", "comment": "Malware payload", "value": "9fb082f0117482f2199fb5fcff57efd2bceb9353db92f51d36ddc66c645a0028e4dfaac8263dd19942fffec966a535eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763102310, "uuid": "645f90ad-db2f-485a-b512-06fcf8766f9b", "value": "T12613428CF86A673FC3E272FEE79853CE323A17D867877626C235425537C9304A926914", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763102310, "uuid": "eda6d689-400f-4292-a7a0-6049ce4e4fe3", "value": "768:7sGB8DXKQqRfav7o1xDO3bIzo7J4I6MjkcTe/y2q:7/8Da2cLSUWSp9+ay2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763102310, "uuid": "7b4e4a11-3dc8-4334-b86d-bf2adcf396a8", "value": 43131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763102310, "uuid": "21491f14-fd79-4b47-887e-4d4e8d0b006e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763102310, "uuid": "6f35a955-2ab7-43b9-8475-e50e5c07a171", "value": "wewe7.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10e70424-c169-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763131744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131744, "uuid": "e523834a-d400-4294-9ae3-71df1c4df637", "comment": "Malware payload (Mirai)", "value": "e43f5fe3ebfec6edbd1359f20ea19a1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131744, "uuid": "876fba20-b657-44fb-85a3-20a13b575488", "comment": "Malware payload (Mirai)", "value": "6a13bf36c1d1290b410a29099bbcd3342dd34ed5cc2ab9d24d827bf79fda5fac", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131744, "uuid": "579288ff-3074-4049-bcdc-401b92e693da", "comment": "Malware payload (Mirai)", "value": "4d270637e28c2594df6ea1216ad8c48de7dabbee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131744, "uuid": "2b549425-b157-47ae-842a-d48c3245116f", "comment": "Malware payload (Mirai)", "value": "ab81c039ecd4add113e327a01a8137c4943928f41f4e2f6f72e7554195047754420483a092c4293ea6c69de4a0e3d07d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131744, "uuid": "33700eae-72f4-4da4-b343-598da1dd7065", "value": "T175E2E0074179620CDABF003194FF7B07F115E392E90669AFCD60A67E2C097FD6A642A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131744, "uuid": "d7c6c164-5d84-4531-b955-c52529f7ab1f", "value": "768:+ZPfKE+em+qZfNRsdcOaZ0gq8xJLae0cOHx2nbcuyD7UHQRjT:+sE12NRGDgtLaeb2x2nouy8HyP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763131744, "uuid": "cd5a312e-76b2-4df9-957a-483dff966c02", "value": 33332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763131744, "uuid": "8ada0649-a4db-440a-8790-6f6703b585e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131744, "uuid": "16a82ebf-7d82-4e13-b955-3e33049ca11e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6415121-c162-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763128988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763128988, "uuid": "71b45456-f31b-4eeb-80f1-ebc93c650013", "comment": "Malware payload", "value": "d5356d43a3050fabac92585242423592", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763128988, "uuid": "6f712305-b6cd-4943-b287-74b119a35849", "comment": "Malware payload", "value": "6ac0f309571a4bb7fb60249cc01637efb479baeb001b5c1ef751ce11e3be519a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763128988, "uuid": "6fbc5756-e56a-4f8d-a5fc-629a51ca5033", "comment": "Malware payload", "value": "7d903e66ca9981da609fa085a3c51e73a4742a18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763128988, "uuid": "3f960e84-feef-4b09-8362-bd570e389536", "comment": "Malware payload", "value": "e58b384218a84e6310fd2ff55d065b8af346a76f570e9f8327ffb1905be11d33fa062cd05e73159fc6a88bba5d812e5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763128988, "uuid": "705ebea6-8e2f-4b65-b24b-45cc35b61a8c", "value": "T180D5014607CE6190F372BE096F164555F3E1878A288B643E752057CAEBE032F37B1E69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763128988, "uuid": "5af7e75f-ff55-4287-95cd-b605805a742c", "value": "384:WBCJHd8t1meAXiizJPKjhYllQ+Otnx4ec7CsablN5PlEGdPPPOomI:pkjWeC7CsmlN5Pl1dPPPOoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763128988, "uuid": "3df143ea-4c91-457b-bf9c-ee3e42e4dfa2", "value": 2992178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763128988, "uuid": "13e4a615-eaeb-475f-927c-e134f946df62", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763128988, "uuid": "7d511f54-f58f-4ae1-b942-baa81c8a56da", "value": "Docs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be7cb1e9-c153-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1763122587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122587, "uuid": "5dc73772-0afa-4962-90bf-7cab7d99ebf6", "comment": "Malware payload (XWorm)", "value": "e6d53e4d6658aa9ae63eb97a87b5ef8c", "object_relation": "md5", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122587, "uuid": "ea96561e-10e4-42ab-ac50-961fdd39994d", "comment": "Malware payload (XWorm)", "value": "6b671b396fe548cd407e3bc83ab462546cabbf3953ecbb79152b52a29555694a", "object_relation": "sha256", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122587, "uuid": "3a1164bc-9c23-4a9f-9050-a78458d5ed0a", "comment": "Malware payload (XWorm)", "value": "716db6cde88d441a2f552a1d43598205c0761fc0", "object_relation": "sha1", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122587, "uuid": "aa4f7749-cf2d-44d7-bc40-cd6ea40ec048", "comment": "Malware payload (XWorm)", "value": "5ca48c60aa63f965972a49559d5c215d8ba45a3ecfd7bcb9e61eb798a8f3c619bbec5216016406cddcdbd9295a2f225f", "object_relation": "sha3-384", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122587, "uuid": "992c3af8-9a1d-4b22-909e-b7f13baf7689", "value": "T147C2BF0A9FD54329E8BB1B39D4F943654271F58590B3EB1F18E8518C5DB7B90090BFE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122587, "uuid": "38b363ff-3820-4fb1-a44a-f9ef8bc12572", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122587, "uuid": "7cc81aca-34b4-46c5-b6d0-aeb5350f60a4", "value": "384:ySDxkozLPaBn8PIpYEiyrxxW9WhtHiWG7KKHpANklXuwQaJArE/AOB:z9rjy8PI+ELruWXiWGx2NklwRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763122587, "uuid": "6d1a1a15-64fd-4f07-bcf9-a9a7fd93a8f4", "value": 27136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763122587, "uuid": "6f833c9f-d26c-4f50-8393-b9939c4772d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122587, "uuid": "360e8150-b841-4728-8697-e539d30d7240", "value": "6b671b396fe548cd407e3bc83ab462546cabbf3953ecbb79152b52a29555694a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38bcf53d-c166-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763130523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763130523, "uuid": "fbc85aba-6d1f-499b-b054-9f4069436a82", "comment": "Malware payload (Vidar)", "value": "9b73ca6ea696c420cb36203c8065d18c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763130523, "uuid": "0d8b42d1-7a77-4d99-a1f6-f8dfd27b4fb8", "comment": "Malware payload (Vidar)", "value": "6b802b866eb6af5dd5583f112f4005ce4db9c6c82017401b98bcf76cca2cc59b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763130523, "uuid": "c533a4be-82f5-48f8-b6a3-10d25150dbbf", "comment": "Malware payload (Vidar)", "value": "fabd534ecb94c04079f08ad873da3798b5fcc974", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763130523, "uuid": "ac93f971-7033-49d4-9598-04ffc61dbc19", "comment": "Malware payload (Vidar)", "value": "5f1352f93dd16f7ffcd2a1e24da21ac8e4ae668af02112fe4aaa0a14c3d41df32639ea2c5d95d790cbbbf33f28891f11", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763130523, "uuid": "bac618bd-b595-49a3-b8b8-462187f3f9e4", "value": "T164352254227DDB07D4930FF44930E2B147B58FF9A931E12A5FEA2CDBB83634641A2792", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763130523, "uuid": "f23db7b0-365a-444d-8058-93de68dbbfc7", "value": "24576:1tkL/pM58WaNpBouf5OwREKFAQ4qdB2zyrQADGSUbUb2aduTsK:1ChM2N6C5hRHFuqb2nADGS8r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763130523, "uuid": "d9fb950b-3192-400b-a5ff-df33a2df7857", "value": 1074688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763130523, "uuid": "dfdc6428-546e-4157-a6ed-b31c155315bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763130523, "uuid": "aab9de5a-40a2-4303-8da3-d1a93e22f354", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96fd53cc-c127-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763103622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103622, "uuid": "993fc817-0c9f-4982-9674-019a8429ff77", "comment": "Malware payload", "value": "6551ce89484f7707645b4c08bbbb23ed", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103622, "uuid": "ab10a980-c281-4ad5-9fa0-4060f6f04d6e", "comment": "Malware payload", "value": "6d6b8a49585f66d4eec4f4532dbfb0083e32558dea468942d75664cfbd30ad52", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103622, "uuid": "5a28a6ec-ee84-4bb5-ab5c-6684dd30a97d", "comment": "Malware payload", "value": "4b691aa1b80d183d78d4a706bc68982fd70abf72", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103622, "uuid": "62e869a6-ada9-45bf-919e-4c724d4f6046", "comment": "Malware payload", "value": "64829ba521abd7db989044b109571dccb968ba68659ca0ed9bf78c39d87508bff1ff00eeb569d31c5dd3964368c235f9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103622, "uuid": "c3c78dc3-5430-4aa9-98f0-9d9a38a174c4", "value": "T11F36F08BF708992FC87714F259AE523262574D168E8397436C48331C69B76D83FADBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103622, "uuid": "fc26c28d-90d3-4441-9cb3-3fb21219a86f", "value": "98304:M402YQAihBojCc1o1GrWxKMPWstVgHQnsbH6SvBx532ZRDgLCr4fT:Z02YQA8ojv+QrWxKMJ0WyHfvBx5mXYT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763103622, "uuid": "cff3fd76-90d4-4775-a74a-2af9c104657b", "value": 4879294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763103622, "uuid": "db435734-1b3c-4ad9-bb96-ddfb03a35cf7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103622, "uuid": "e64a75b2-0a93-445c-aa03-aed496464aef", "value": "digislot_1.0.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fac3726-c13c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763112469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763112469, "uuid": "e4c4d7ae-85af-4843-951b-db717b75f513", "comment": "Malware payload", "value": "dc688655fab2df06b47c66c8c00c6463", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763112469, "uuid": "d790e707-7436-464a-a517-c330ea1fe9be", "comment": "Malware payload", "value": "6e0b3a7731a4f038335ca41c15467a2ff8a2c51b6ce22f62f137c203eb369f53", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763112469, "uuid": "0979d007-144a-412c-a30e-38c68c6b1be8", "comment": "Malware payload", "value": "3d05987b622d8d98d1907598e6d610cf9ae8d0b1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763112469, "uuid": "d0e0a839-d8d5-43e1-a876-5b8bca053bc2", "comment": "Malware payload", "value": "d90716215fec83b616c58a72bbf836699b851ad959b12a1ca40bb33f81e799e0bbf8246b47d785e6a23ca0ac9cbf9708", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763112469, "uuid": "6494df69-8653-4f6f-a850-4933d9955208", "value": "T107272347EE49CD6AECF6533AFE32032334325DA84703C57BA5A9B6387E731C25A90591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763112469, "uuid": "9922f4ee-5a60-4d7f-9220-9205af410f5c", "value": "393216:2MBEbkpSkwuKxGQ8CdDLHStnafO0nvGqf4JJR4OfsU5r7uoQazo:/BE4gLuoGYDLMn9AvtfwJqqHt7uj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763112469, "uuid": "c0b0a700-e9cf-47ca-8a49-a568f5ab190c", "value": 21259050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763112469, "uuid": "17d4f1ae-6937-4348-bb5d-a25541923a5b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763112469, "uuid": "51a233f1-f30c-49bb-8e06-1cb7391c0abf", "value": "TV-Garden_Ver_12.03.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba3db1e-c102-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763087739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763087739, "uuid": "ea529502-b444-4595-a659-d8027deb8f05", "comment": "Malware payload (Vidar)", "value": "637c475fa4eeda02f2190d503dbee9ac", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763087739, "uuid": "e7f56877-1d6a-468b-b845-71fdc05c34f8", "comment": "Malware payload (Vidar)", "value": "6e16ae3826675bb41a5e10679de9b6c9bd6e052098aae038a8b3b7ffc637070f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763087739, "uuid": "10ab23ee-f43c-4cee-ad36-d070fd4c1334", "comment": "Malware payload (Vidar)", "value": "4bc90400492950ce1d1fd88f31708bcba28d0318", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763087739, "uuid": "09613fa1-2fba-4f1f-8c39-4ddb6c9059ec", "comment": "Malware payload (Vidar)", "value": "8402b194bed96d5f1cf1ac9309e9e15e4019492868571fe25c1d42982877afd9f33b251c4f644a73080ca8c3574322cc", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763087739, "uuid": "c1142038-c415-46ec-bc02-f3fafb715734", "value": "T194D45C7AB490D143F918C4B414F19B2DF921B07286762AFB099091A3D95BAF08FD53EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763087739, "uuid": "b2b0c55e-af45-49c9-93e8-380e045e30fe", "value": "3d5945b60ad9445639ba92f86ca39319", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763087739, "uuid": "7236d887-6d88-4a29-a74c-288e33c5ee17", "value": "12288:/3bMO9+az7+lw7uEcj2s7NUbQaR4Zl5re/I/Bu48CXTq:/4O9+az7+lw7uqs7NUb09q/c8GT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763087739, "uuid": "b086fd75-bd98-432b-a312-dd96d4bbc466", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763087739, "uuid": "86ad17b7-9da2-4e6a-96b5-1bb5cb48f082", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763087739, "uuid": "efa1198b-aa83-41e6-9344-b268be5b913c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d38ef1-c13c-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1763112486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763112486, "uuid": "a011489b-ff09-45db-9d74-767450df70cc", "comment": "Malware payload (Gh0stRAT)", "value": "6a98b91044f88388b298769b8e5ea194", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763112486, "uuid": "a8543d4f-4124-4c91-bd70-cfd7a4771078", "comment": "Malware payload (Gh0stRAT)", "value": "6e3c15ad836e158e821a051d38ae44282da1f897528b0cbba4218fec3c17cd3a", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763112486, "uuid": "f560a890-4f35-4be4-8f9a-20eb2a0522f8", "comment": "Malware payload (Gh0stRAT)", "value": "fbe6257d7420b38abc95e6d41882977f1e85c115", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763112486, "uuid": "4bead4db-67ad-46df-993c-5f311bd2fb50", "comment": "Malware payload (Gh0stRAT)", "value": "64c0a0f9742d39982acadeef4994b17421eb74153da88f26f2541266252911bbdbbb63e6e772678759e5896aaf974108", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763112486, "uuid": "815d5487-91e0-4564-814b-b20db3d67204", "value": "T1D44633AFC14926A2C4E036657C853B7C7F649196079E49FBB2B00B719ECF8A7104D8E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763112486, "uuid": "2a4e8f7a-48c9-40e6-90c6-cbf04ae40410", "value": "98304:GJKrD26oiYbXrStwlHuk876ODT9oItK3Oe4JeKSBecARVAYIbc3pTcgoaSEp:AGYi8StbpoItK+e4JeKSB7AYPATcgo1a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763112486, "uuid": "00c2a9c8-fa7f-4ce4-ac73-3756e5f4bd58", "value": 5372812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763112486, "uuid": "617f3ecf-dd41-4842-8007-75a7698c58a9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763112486, "uuid": "44617438-8444-4b10-aad3-60819565b30d", "value": "anyunlock_c-yP7k1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d153137-c183-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763143039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143039, "uuid": "1c33c5e5-3f64-4979-a886-d7ff8672cd99", "comment": "Malware payload (Mirai)", "value": "1d31fefac8d76762270739865ea91d46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143039, "uuid": "a6a5d85d-f665-4fab-95ac-321a38dfe243", "comment": "Malware payload (Mirai)", "value": "6eb9597a7e2860f6f072e1858b859ac93afd556ce65de7cf6182434672ae27d9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143039, "uuid": "7a0f4667-5e57-4ae5-9084-f8c803622969", "comment": "Malware payload (Mirai)", "value": "1101c290c6d668088888fb0a628be4bd1dbbdd3f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143039, "uuid": "2f939693-01cd-4e3a-a3d4-c7ea73f24249", "comment": "Malware payload (Mirai)", "value": "8e58bea531a1768c699854a0674e46c5096a0cf474029f860b6508ecf327d5980a92a00496d16538fd20f01a806482a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143039, "uuid": "02e68a14-fcdc-46cf-94ad-dd45b68fd195", "value": "T10EF31903771C0A83C05B2EF02AF727F183EBE91116A66640F61FEE845376BB1A519F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143039, "uuid": "a978ed0f-5a86-4078-a12a-839470ecb122", "value": "3072:3IV8txHd/xp1ydzoKstn6vFBv7nx/2KsCD65SwR:4V8txHd/xpcOxB6vFBv7nx/2KsCD65SQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763143039, "uuid": "7bdd02fe-e878-4817-971c-b6a9e3c5a172", "value": 166283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763143039, "uuid": "dd1b5531-9e81-467a-9dce-76ae9c7a6258", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143039, "uuid": "585972e9-3510-441a-8f77-09e3afef1150", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ea3944-c16b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763132711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132711, "uuid": "f740d0b5-4702-43fb-a917-2cd5af59714a", "comment": "Malware payload (Mirai)", "value": "d9d0879fa7a32b228a4c8e6b2177f4d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132711, "uuid": "3889350e-eb9b-48db-bc81-8b4ec6a2e282", "comment": "Malware payload (Mirai)", "value": "6f8d78026bee9bf1b464bcfc0449c33b3f2301fe93056051f28aa7055a6a2852", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132711, "uuid": "90aa7f76-1e50-4ba5-808b-5cebb211ebdd", "comment": "Malware payload (Mirai)", "value": "a2227f7e39d28be1d03e2a1a04d1ebc6005763f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132711, "uuid": "be837f6b-8655-45d1-8d79-53c04ad48f2d", "comment": "Malware payload (Mirai)", "value": "5e0643de9bc6a87389358708c769e4123002a1b3e043917aa58f580297311bf6ca280a56ac59bac5f3406223ec09b9b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132711, "uuid": "3a90aab9-99e7-41f8-970b-9e050bbe1d18", "value": "T1E563964A2E219FACFB5C863547B78F20B68833D626F1C644E15DEA015E7034E645FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132711, "uuid": "a01c2c1f-93b8-4bc8-bf5f-299c3a6070d6", "value": "1536:KT5R+BxS1VslPzb//b/d/b/SPLYHrl+OO8t7xIy7wbZnI:Kr4xS1Vsd+Ql+OO8t7xZ7wbZnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763132711, "uuid": "b1260b93-7d5e-48ce-9806-013aff7fa238", "value": 71696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763132711, "uuid": "55e2f75c-22d9-4c32-8661-255b0d63c5c3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132711, "uuid": "b58d84c5-70d7-491e-ae6d-ded37f17a80e", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4ff14b-c153-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763122373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122373, "uuid": "c32f4aac-ea24-4226-854c-a61f6be15f6b", "comment": "Malware payload (Mirai)", "value": "3ca859d618a88f28367dd4200486ecfe", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122373, "uuid": "7092cab2-ea98-4044-8065-6263a48feae2", "comment": "Malware payload (Mirai)", "value": "70c7ea52d5c83fee1478d87a415b568b77b649fa45cce7b503c66df195888fe3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122373, "uuid": "c755b3a5-e1e8-48be-afac-c76228d583e6", "comment": "Malware payload (Mirai)", "value": "f783549d0ec4ad8e58634ccbf429935e22f50e51", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122373, "uuid": "efcb23ba-2096-46c1-9303-3f268f6572ad", "comment": "Malware payload (Mirai)", "value": "2abb4798ed55ef11467875ab109c1c80e22a23f19a19a03d384d16791470b76b22e5ada237fe34e9e95a6e7b512e9000", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122373, "uuid": "ac11ac61-70fa-452d-bc54-4f791cf2f67c", "value": "T1E90128CF34E1C930A99045E5B6938A28F28CD0D65DC217CCED6E4CB9548DDDD3415EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122373, "uuid": "63bbbc51-6910-4974-ae73-173cc849d49e", "value": "12:vWOZF85ZMNM2V4ZMBAZOUNHW62caKWcITUcIT2CIRlG1lcITUcITC:uOZF85EMy0MBoLVW62pPSYM1lS4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763122373, "uuid": "635f3a69-9d71-493e-b656-49445f9e3a2c", "value": 758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763122373, "uuid": "b14825d3-63f6-4854-982c-03962f196953", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122373, "uuid": "f38fb5f3-5501-439b-9187-8c9e7f196553", "value": "mwah", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ca86f9-c0fc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763085239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763085239, "uuid": "bcc6cbb3-901c-4177-82e6-240b220e7dd8", "comment": "Malware payload (Mirai)", "value": "85723dd9e36e19200e24806f0ec0c12f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763085239, "uuid": "04cd31f1-4831-454f-93fd-55f5879da6ac", "comment": "Malware payload (Mirai)", "value": "714f9656327b607f64c56db2cce242d28f8cd28ddfb5cbabd52c72af84e097f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763085239, "uuid": "f673623c-1ef8-478c-b39b-82f5b3b6c86c", "comment": "Malware payload (Mirai)", "value": "dc1cd665ffe7470838a1515a95aa4163a4b4c7aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763085239, "uuid": "b52d8c37-aa01-41a1-b0ee-4f1271287166", "comment": "Malware payload (Mirai)", "value": "246b547933fe6ee0617545b9e53a8b06f697022e8af7e8b89cd97cbfe82b0ad720e1b2712220397115aa2f2034cd4d40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763085239, "uuid": "cdf9c9cf-c08c-4d7b-93d4-9706ded6e3f4", "value": "T169531986B891DA17C5D4A2BBFA5F41CC332163E8D2DF3203DD116F597B8A82B0D6B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763085239, "uuid": "c66022ca-4117-49c4-8970-cdee9df8545e", "value": "1536:/ET0OqjhWV+mK615XXx1QLH8dtnTuybVR:MT0OCmJXB1Q78HTuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763085239, "uuid": "4c282a96-072f-45f6-9f34-66680e0fe8c2", "value": 62316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763085239, "uuid": "f4195605-083d-4706-af6c-ec7c3ff42560", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763085239, "uuid": "525202d7-726a-4eb4-8adb-a5b20451b76e", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e8c161-c12a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763104701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763104701, "uuid": "55a3ba2d-b4fa-46e3-adff-b3f27d4d59c9", "comment": "Malware payload", "value": "0a8a272a51e726323bd02c67071f0950", "object_relation": "md5", "Tag": [ { "name": "IndonesianFoods", "colour": "#98856A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763104701, "uuid": "eb21c9f4-02d4-40d3-91c1-269279a4d8b5", "comment": "Malware payload", "value": "721f03a937e6a81cd6c21e48262094bf7ffdd1e7cac3d03efee95dd5b8ec8028", "object_relation": "sha256", "Tag": [ { "name": "IndonesianFoods", "colour": "#98856A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763104701, "uuid": "9a1d31ba-9cd7-41c6-a003-e9524e7f4c98", "comment": "Malware payload", "value": "e8dfb5df7b98e5cb1cb2c69e7529cebf71366904", "object_relation": "sha1", "Tag": [ { "name": "IndonesianFoods", "colour": "#98856A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763104701, "uuid": "07403b2f-e659-49d4-bd07-90c2de364ce7", "comment": "Malware payload", "value": "d607d49485297b088840cd6ae22adfbcb95c0c2fea680234cbffa43d9fa494cd9e064e7022771076be5f320f2d910797", "object_relation": "sha3-384", "Tag": [ { "name": "IndonesianFoods", "colour": "#98856A", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763104701, "uuid": "8da8214d-d9f9-48c4-aaf6-d271debb9be1", "value": "T175F15755A7A701138AF45725BE424502BFAEA221B38693AD33CD40593F9F814E347BFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763104701, "uuid": "c00d20d2-20db-4278-8efe-78c97f9c0269", "value": "96:EBZPWwkwzdvmnj4wzwBoc9DLWb+UrHv1hdfNL1/yZKKyCSBEdBxAknfK:KLBCsZ2b+U5EKKyvmGkni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763104701, "uuid": "c3f4b21c-049b-4ff6-b8ae-552ba5a56b80", "value": 7499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763104701, "uuid": "6869b57c-12e9-4a75-8728-9f3e880d35d6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763104701, "uuid": "0e575129-ccb2-4929-a340-7824a18291fe", "value": "auto.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0084a52-c131-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763107959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763107959, "uuid": "414a1597-8640-4335-8636-cf9a9f5abc07", "comment": "Malware payload", "value": "a44e7e04f397851061336cf835ca232b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763107959, "uuid": "c4552bad-4d43-404a-a657-f0f25fc37585", "comment": "Malware payload", "value": "73915b326891a0d4fc56c7eaf0627310161e7ca6a5720c6ddc5a9f88d791f748", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763107959, "uuid": "7ad136e7-aad1-4100-b4a2-4e156ca684c3", "comment": "Malware payload", "value": "f80179194db9e22a64a800b6746500089e26c28e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763107959, "uuid": "dc288c80-d232-4237-a08a-e841e56be5ed", "comment": "Malware payload", "value": "6221898ae392c413590de78a6645712c403189e82d9191856f1339312620213bc32ca1dd97c3b430cef61b760af3b7d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763107959, "uuid": "b641fcff-6441-44fa-9578-0751d147f485", "value": "T127C2D1E9E94648E4DC99D4B40AF9831866380F82D453AD4365CAFBC2DB478A03543BE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763107959, "uuid": "3f40ccdb-c088-4fa7-8598-9b152e1193c8", "value": "768:t0JoW8ejvY0ABOLLog4MaZ6nF8Iqa4JgGlzDpbuR1Jh:t0JDrYdsLX4xZ6F8IB4VJu/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763107959, "uuid": "0ad8e7fc-6dee-427f-8db8-4b56454ecc22", "value": 26936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763107959, "uuid": "1c920219-b7ef-414b-b8ce-d366f79481c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763107959, "uuid": "14b9e3e2-6764-4c33-8b2e-cdbc94b90f5a", "value": "wewe2.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b520135-c0fb-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763084517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763084517, "uuid": "9329b048-cddb-4260-bd97-63cded07f66f", "comment": "Malware payload (Mirai)", "value": "30a84863952767c0805418387a406f26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763084517, "uuid": "f3da0b79-a4ef-433a-ae83-edf688319521", "comment": "Malware payload (Mirai)", "value": "73ef0e9dccc2d8a5b17d1c0aab975e59099adf6882d1f6e48c9f8361fd286c17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763084517, "uuid": "45d08b8a-4eda-497a-8684-8f442dd2a62a", "comment": "Malware payload (Mirai)", "value": "5171de433f1abcbbf0a302c9edcd61c6c7e05859", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763084517, "uuid": "acb99b52-5f3c-4135-a9d2-413b5b078363", "comment": "Malware payload (Mirai)", "value": "4e7e9cb078c4158a90fcc696ff7aa3d9eea7a038ec080bac81e69e1f60f8ae34ff4f58134f01df9533c83c56987716f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763084517, "uuid": "29131d59-66a9-4cd0-a7b3-1cac939f8f0a", "value": "T17FC30945FC515B13C6C712B7FB5E428D7B2A1798E3EE720399256F24378B86B0E36142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763084517, "uuid": "ba6e8d3b-00f6-4bab-a795-35474ac7ccb4", "value": "1536:ph0R0bnaS8P5CmRsKb21yy4V2n4EbQGIngl/7wyw75zMQGSzkpSqOvum8n3YIOfS:4RCqFiKbU4E98PAQLvux369E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763084517, "uuid": "0db3ec37-1285-499f-8c82-25ba8062fb1c", "value": 129696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763084517, "uuid": "9e5d4845-830f-4e40-8c61-5e0d4d7758f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763084517, "uuid": "e1cffd70-e691-49c2-8f5f-0f9ac5aed393", "value": "nshkarm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95dfed5f-c179-11f0-a129-42010a9c0007", "comment": "Malware payload (Phorpiex)", "timestamp": 1763138839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763138839, "uuid": "c8272a33-6c70-4398-a30a-bddf62f14118", "comment": "Malware payload (Phorpiex)", "value": "94cd39133211cfd7efc6a3322f06ca11", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763138839, "uuid": "3682c3c6-d66b-4d6a-ad92-e130c2eacd36", "comment": "Malware payload (Phorpiex)", "value": "7436220538e6cded0c499167424975a2aacf93217dca40c683f0610b4f3eb3b7", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763138839, "uuid": "c41ff57e-cd21-4a27-9898-4e48b36fc02c", "comment": "Malware payload (Phorpiex)", "value": "714cca1da752fe6549b53aaef547c744c99d0e3b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763138839, "uuid": "d776261e-417d-4d22-9d81-aa7ff793cf20", "comment": "Malware payload (Phorpiex)", "value": "fccdbbdfe6b5f7b4efcf06ff211a0ed478f99a072d28fc3f00bf5d72ddd14ad06aadc0d981ef994c45ff4c907e9354e2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763138839, "uuid": "429930b3-f923-4f3e-b46d-bb569f861683", "value": "T16193F742E5A0A47FEEE986FA91F28D68542CBF75134948E392502657C7203FFBC7502B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763138839, "uuid": "9824e38e-fc86-4ea0-9117-c9e1322013db", "value": "f7da79b7c3f003ced1454bf7330a5f87", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763138839, "uuid": "5f6a47a1-58bf-4ff5-8809-a17577fa6abe", "value": "1536:82qBXVOFmav82jR8LtfTlYf0H32Aep9B3uxwg8:tqxnOrR8LVl2Y3lIv3u98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763138839, "uuid": "a63b6e3a-5478-41cc-ba3b-80bd6c3e2d64", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763138839, "uuid": "aecb1838-4616-4ae0-88be-2db630a478a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763138839, "uuid": "a626068b-7792-4452-9130-6e3c82410700", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c26f70-c189-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763145711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763145711, "uuid": "75d85b10-ef3e-463f-971f-0589eb87e9a5", "comment": "Malware payload (Mirai)", "value": "14f4f76be91e92ec05b496a4f7e9f97b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763145711, "uuid": "a6506911-ab7b-41d2-8844-c18b07d2b7f7", "comment": "Malware payload (Mirai)", "value": "757693c0a24036d1e19e5b2946ac90ed64bde2a826343cc42ff54bde8d0122e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763145711, "uuid": "d0343723-9ec0-4ad7-ae88-73aed9764ff0", "comment": "Malware payload (Mirai)", "value": "e74bfc8d944c12d4c1adf229fc0ab79aabaa1e77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763145711, "uuid": "ee635bce-8d22-44f3-9f33-606338dc4ae7", "comment": "Malware payload (Mirai)", "value": "b459e4a1c0e5875429c2b5cc00126aabc43ac767aa9d4c9a23e798c8a1bd0b13a7453d79a13f6cdbc9053eca11f9e1a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763145711, "uuid": "08a917be-058c-4355-9d2d-7667e0d49f1d", "value": "T1F903F13E1D870692DCB195B1546C23923A7708ABF053A88792C6EFA7CA051FE51167FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763145711, "uuid": "f465ae61-afbe-4887-82fe-8d06ce8ac1db", "value": "768:lGHhKetoCKzkoTziNPG/uhe3nfjYVaNLBy9g4KJgGlzDpSO+I:EPoCKz3Sk/BbY0I9zuVSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763145711, "uuid": "e5ab1553-e6e7-4d80-a992-5f1ad7717bf5", "value": 38680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763145711, "uuid": "daea11dc-b902-4343-8d0c-8ae37f402f36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763145711, "uuid": "9e747d15-d0cc-4908-9926-a6740e3cbd46", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866b4b48-c127-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1763103595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103595, "uuid": "8b7f6612-ab99-4858-b4d1-8d2b5df72de6", "comment": "Malware payload (Gh0stRAT)", "value": "765a1773bc47b631875becc4bac03ffd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103595, "uuid": "c2dffb70-9571-46f8-83dd-683d511e56f7", "comment": "Malware payload (Gh0stRAT)", "value": "758dbbdd9df5d7e383b9ae936d9184a772319d478f2201cc5fc767157d239bb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103595, "uuid": "8ddd0bf5-7647-46c7-929b-1d63bfde60e5", "comment": "Malware payload (Gh0stRAT)", "value": "f62278e5218ace60a36b3ea6247569eeb475e7f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103595, "uuid": "bc63d636-86f8-4dd0-8896-48c896cf96c2", "comment": "Malware payload (Gh0stRAT)", "value": "c4393be9fb394ec04db1d69dd3dd75d2bc03a9644982c59ebb0c4c6eb2ce72a156ce36d21a28c7176a572a5b7d0dea24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103595, "uuid": "3ef64a2e-af18-4e07-a876-04c06537af9c", "value": "T1FD273323A6CB953FF17E45394AB3E326413B67A028178C52DBE8049CDF295D81E3F646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103595, "uuid": "5e9b6a38-bb5c-472f-b731-c415747706ac", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103595, "uuid": "091ab955-7ded-4edf-9f7d-22689c009aba", "value": "393216:Sw2SLf9j+M5Ci23JF+p9fAhTVDN+2f6PegWsAeZJPnfQzI1oxlqN:d2Sb9l5ITsAE2f6PLWjeEzI1oxlqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763103595, "uuid": "78b933be-666a-4e21-bcec-4503dcc0005f", "value": 21217560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763103595, "uuid": "290753b4-cd52-4a07-b391-73d2deebf6b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103595, "uuid": "1fd02053-6e56-4300-a46a-2956abe5ea82", "value": "SkyrimSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742e7d05-c121-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763100987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763100987, "uuid": "efd20bd7-b8aa-46e6-b8b0-1e40604ea02a", "comment": "Malware payload", "value": "a81caeca5025c301f46edba1edeedad2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763100987, "uuid": "62f0a9a9-4fd4-4ca1-886d-50f97a2fcd52", "comment": "Malware payload", "value": "7598d0100b3d9654f65ffd98ce9dfc3fb1997c7b17af31c9804e892e0a72aafc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763100987, "uuid": "eb9b8465-647a-4bc2-9c52-e2dfd80de9d4", "comment": "Malware payload", "value": "5a87dfb8f90f8829546683ba47fb2f78d20df429", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763100987, "uuid": "033d86e2-7496-40f1-898e-3ebd1ea61f6b", "comment": "Malware payload", "value": "1cca20c859c65f320f25e3390e36148c0967833413ca305aa7fa0378251d67258064492c29ecb0abc7437dae8570f79b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763100987, "uuid": "df08e9f8-d18a-4da8-9960-4a43a950fd7e", "value": "T121231B41B31C0847C1B36EB13A3B17D0E7EBAAD22294E385661FEA89D075E335586DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763100987, "uuid": "5de211b4-57ad-409a-9069-aa570d9adb53", "value": "768:nSJ5FHrdLNc6SAoBejGfG94KrLu/1lTEA6Q+JrGNFeRtrpGIO:SJ/HrdLuZB0sw4iLAlTEVQwG+RJpGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763100987, "uuid": "ab088f82-3e05-465e-9f5d-f769a5713264", "value": 47336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763100987, "uuid": "94d362f6-9a14-45f2-bd24-09fe5e1ee9b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763100987, "uuid": "49abdf56-facd-42dd-942d-41e2a7a647c4", "value": "wewe8.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7592c20-c182-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763142815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142815, "uuid": "69451dd7-d437-493f-9302-7b6d948bba9a", "comment": "Malware payload", "value": "9a409dc780458da30b892de175994a2d", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142815, "uuid": "5ef323e4-761c-40fb-ae5f-9c8b2235177e", "comment": "Malware payload", "value": "7694046365c947d22100312e61626a6bcbabe76d849154d03b48ff808e31caa0", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142815, "uuid": "4de1c32b-480d-40bd-9020-5e8dd4d40a41", "comment": "Malware payload", "value": "f6571a326049a6294972b1e9dfdb1e297b35bc09", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142815, "uuid": "c3bd410e-0f5f-472e-ab28-457c52c191fb", "comment": "Malware payload", "value": "2d9df00c6adc430deefabbebf701b6edde2147d233aff5a82e87998446525c12f3260e62469ede4ef4d027201a349f00", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142815, "uuid": "c5722f8b-5337-4f8c-a69a-731eb04f8d9e", "value": "T14713E1652F326285E8817B34085BA217A9775CEDF6B30ED8025E4C337323D917851BBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142815, "uuid": "0a81b077-bd02-4670-8bc2-4bde036484c7", "value": "768:HXDr/+VDUjSkXU5OZ6AtZhCliReMn41M6L4uKqQHxjWGuZbkYpry:3n+5iXIOZdzAi1nuBcqQRjWGG7p+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763142815, "uuid": "29a29dd9-524a-4ad1-acbe-cc9af246eda7", "value": 45256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763142815, "uuid": "ed87dd68-8c8b-44b6-b0bf-c4d4de239e78", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142815, "uuid": "ae032e8a-045a-4f98-8cc8-24e9162cc735", "value": "Deadline_Approaching_Notification.txt.lnk.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1730288-c16e-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1763134242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763134242, "uuid": "2bc426f0-7fe1-4171-b0d3-fb23c51bbd08", "comment": "Malware payload (Joker)", "value": "568cadde1b684be86b44fff7b770cd2d", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763134242, "uuid": "129ea775-ddb0-4845-a2f1-a657ff1f9e0a", "comment": "Malware payload (Joker)", "value": "78a496dd6366eeebe4bfa6268d5a3018823edfd10cda48fe08380801416c3863", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763134242, "uuid": "01f14daf-8398-4678-a194-004ebbeb10a1", "comment": "Malware payload (Joker)", "value": "fbd2b7cadb33ee79bef0aece573f9bb228cf0e47", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763134242, "uuid": "fc9bd6dc-bb83-476b-ba5b-3bddb9aada60", "comment": "Malware payload (Joker)", "value": "60962033bb6dbe06c008da9c6511f7d3733cf65c786613f986fe14040a85470af0064319ab32f0671295e30a458bf589", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763134242, "uuid": "4f0ccaa5-b466-441e-9b49-209898f1b867", "value": "T10327120EBB0D9B1BDCF2F0394D592722352BAC547601928B5510B26C7AB3EE54E4B7EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763134242, "uuid": "7995ca90-a2e5-469c-97c1-f0cac2efc31b", "value": "196608:oMACoLzP8H21oh3VNgPkSnCiRamw3/+1ssGkFnZyVfPzVxCcM0ZFBBYBBaGeIrsR:oMWPpopVaPZCz6FZcHznBBYBBOIrvM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763134242, "uuid": "929cac60-238e-41cb-9ca5-e79561901b4f", "value": 21310782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763134242, "uuid": "7e16dd87-7f0e-47d2-9a5a-32f0d1be8bde", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763134242, "uuid": "994927de-39e8-46d7-aced-847783d03c0d", "value": "Short+Drama+TV_3.6.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8aac5c7-c0f5-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763082177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763082177, "uuid": "3f17d630-b923-4efa-9f47-c352853b3c0e", "comment": "Malware payload (CoinMiner)", "value": "0f36a9c83892d83df94b8e8ca0fb77fb", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763082177, "uuid": "7959a195-f2b1-4792-a7da-d91a2bad710a", "comment": "Malware payload (CoinMiner)", "value": "7a1ce7981617497fe17c998698146437831520e9ab4dd5c454097ccf061f093e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763082177, "uuid": "7356722c-6a24-450e-acdf-20df4ce77031", "comment": "Malware payload (CoinMiner)", "value": "49e500ebbb278a25722de0581d8b1f8932dcab9a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763082177, "uuid": "b849dd74-16c0-47d4-902e-bb2b7701213c", "comment": "Malware payload (CoinMiner)", "value": "413e9726f9a6c66326e6b1030e7629125a8fde6c39351529777141a00bd2085d90ffccaa772203bb1115cbc5c7e7e3e4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "miner", "colour": "#CDACE8", "exportable": true, "hide_tag": false }, { "name": "Monero", "colour": "#0EE640", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763082177, "uuid": "0fd3ec3d-cfe0-40cd-adc1-41f464e7a5bb", "value": "T19646D07BC21B4F9799BD2FBC934B5DBA72354060AD0BB23A9B7108F4D93994141AF348", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763082177, "uuid": "d863809f-5bca-4fba-bccf-6626288d4cb2", "value": "84364258335aa120aa66630a9ee645bf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763082177, "uuid": "7db05b62-9225-45cd-a5ba-239c8cce5bb2", "value": "98304:/SPDHaHlqK+RLADEzgkKoi/FUl4XcPx0sJkI2eCGhP1KihWbxbi3cYi:/SPraFqKa4RFlMPG2CGRg9e3cY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763082177, "uuid": "50708188-41fb-406b-91a1-e4c0ea280bff", "value": 5738496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763082177, "uuid": "724f7c12-d487-4b3a-a34d-b175f18fb0bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763082177, "uuid": "8c5f614e-4096-41d6-8bdd-3a53c0b74687", "value": "smNoGPU.malware", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a02e266-c0ee-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763079039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763079039, "uuid": "1b46b801-b54f-454a-be52-d2875a0edf3d", "comment": "Malware payload (Vidar)", "value": "032ea73370e72db4bf892ff6cb2586e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763079039, "uuid": "eae1b9f8-79cb-4ce6-af5a-31010ad9a47e", "comment": "Malware payload (Vidar)", "value": "7b625384c79e693390972a871458728ad2db326306b30ab0a8c6c540462cb9fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763079039, "uuid": "bc7622b1-57e6-42a8-ab15-c6bc900d8149", "comment": "Malware payload (Vidar)", "value": "4ab0b8e7b27af20605f7e757c414e0f2ecb4ca56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763079039, "uuid": "508c4d4d-4e66-4ce5-b784-2814b51449a1", "comment": "Malware payload (Vidar)", "value": "1e7a0b5f2d11768cb55b693d62f15a84415bd296f2057da9885de5a06a1ef785c6404b30d506c480bf58f0d2a74419fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763079039, "uuid": "cb6d1252-3a45-4b1c-837d-af145622ff47", "value": "T166D45C7AB490D142F918C4B414E1AB2DF921B07286752AFF099091A3D95BAF08FD53FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763079039, "uuid": "74ffcf23-0823-4687-acc7-957232b608f7", "value": "006748064ae2ea0b7d198ab8c4d5aaa4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763079039, "uuid": "a5d0f565-6d5f-49cb-8541-b926d09d46c0", "value": "12288:q3QMO9+az7+lw7uEcj2s7NUbQaR4Zl5re/I/Bu48CXTq:iZO9+az7+lw7uqs7NUb09q/c8GT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763079039, "uuid": "cd9dd3c4-063a-44fb-befb-eb622dd6469d", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763079039, "uuid": "8cfd6322-4c30-4f84-81a8-6282e471be83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763079039, "uuid": "9d065f79-3278-439f-9c9c-c8b6cec52275", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a794dc-c12f-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763106845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763106845, "uuid": "64a6181e-d3ea-413b-8566-5e5408b27219", "comment": "Malware payload (Formbook)", "value": "4d523528f23117204f07986a742253e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763106845, "uuid": "2daed6e0-e16a-4b25-a223-f61ab28725e9", "comment": "Malware payload (Formbook)", "value": "7be16d08f76a1f88d6ff634df15d045d532e8a7b67827e21f4c7d71f37f3718b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763106845, "uuid": "575f5ad4-2aed-45fc-99be-63441d47b4f7", "comment": "Malware payload (Formbook)", "value": "da6d219217dfd00f71f653e201905bd868c9f50b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763106845, "uuid": "2e288e24-97aa-40d4-9ab3-784bc0ac050f", "comment": "Malware payload (Formbook)", "value": "740dec6bce6967422adaf5941955398caf9210292480131a7908156c59240a99199bc4dd08409327f475d280796d3ce3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763106845, "uuid": "30dd5af1-21d0-4393-bf6d-1372316e4513", "value": "T1A2F41294224ADF23C0764BF419A1D2B957B4EEEE9821C24B8FE9BDDFB4297114401BC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763106845, "uuid": "77f13bda-d5bd-4974-9559-d8e4242d21e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763106845, "uuid": "1f7b51c6-cd96-4595-aaa4-71053a16ad02", "value": "12288:+LNpfdN19RnxH7rj9DBrynBgJF3xpIZIL44CWO83wln3/p50OsS9q/2FsDOvBrxT:zBA+OL0fB50heFsKNx5Ts+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763106845, "uuid": "a5e4c2b6-f93c-454f-bfd5-152a34f8ea64", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763106845, "uuid": "0e68c5a4-7a1c-4796-863e-5290e85f3bac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763106845, "uuid": "0d301b06-7b77-4619-827c-883e93ab128b", "value": "New order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bbf622d-c19b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763153318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763153318, "uuid": "80c140da-6a9b-4897-b711-fb6eea26222c", "comment": "Malware payload", "value": "3ab9169baea97c90315d862197f7fd82", "object_relation": "md5", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763153318, "uuid": "140466ac-94f1-4e06-92bc-2931757e54cf", "comment": "Malware payload", "value": "7c6ee59efacf7b93c9f85709c0d40d8958dfb34eb06ecc1d1ef22d3f17c8dec5", "object_relation": "sha256", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763153318, "uuid": "1f33ecdf-03d7-45a5-bf86-84cf90f671a5", "comment": "Malware payload", "value": "badfcd1619e535031049ba3905dd5953d8067a87", "object_relation": "sha1", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763153318, "uuid": "64b437f6-3fe3-4e30-b972-026e82b049a4", "comment": "Malware payload", "value": "0e50c366861f6eaddcf97b76b2442f9a9c65ecd321d36f3e67c1cbb7874822f6213a494cbae94cf2d563199a15dd2e45", "object_relation": "sha3-384", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763153318, "uuid": "fb1cd976-430b-4643-bc39-6596d27d3da0", "value": "T159E5C81AF7B650D5E1BAC038D543522AFC7134A5833C97EB92818E895B60BF8EE3D741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763153318, "uuid": "2b4b2475-c3ca-4dbb-a624-cbc6ca1ef67b", "value": "9f71757441e73210351359a9f7ea7d18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763153318, "uuid": "d57c75e9-a3b5-4ebd-b55e-48efa94c9374", "value": "24576:JBpYRMg1zmLWZ5IY6GA3wKif7Uq/9WccUFd:JBSRMA0GA3sf9kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763153318, "uuid": "2d25c519-1ddc-4482-94ed-a7884d9a76de", "value": 3259904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763153318, "uuid": "d9f64c8c-0c30-449f-909b-b229e64453af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763153318, "uuid": "7093a33c-6f7e-4576-890b-8d7300711bbd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c005dc-c121-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763100963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763100963, "uuid": "d6793559-02d1-42f8-953b-9ff387cfb486", "comment": "Malware payload", "value": "14ae3a9c35022e29d4e324a6c6374680", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763100963, "uuid": "219b00a5-9f3e-4781-8e94-6082327cb707", "comment": "Malware payload", "value": "7e114f39bcdc0fddf168ee4e396bafd87a089c9b8f0055d4d74916b451859d45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763100963, "uuid": "d919acb3-868d-42dd-aa91-a37bccf3ad6a", "comment": "Malware payload", "value": "8e47858f623a3367dcb8f0037a8f26ce91141358", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763100963, "uuid": "c800b5e2-f9be-4c14-bb0a-24f10e5c720c", "comment": "Malware payload", "value": "308cca3eb85030cb8d8c5f4aeeb61628e531b213d7ca35e2623127e4d124c1f387fb5d7e33e6d4f6107624401a3295dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763100963, "uuid": "0f029733-1f0e-43fd-904e-c3fc94efdc1c", "value": "T1E9B2D028DA580ED1D7ABBEF04DE1F7C52BE29EAE739284B03880C741262691171D7DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763100963, "uuid": "abec4b9b-e8f2-4310-a40d-422b522ff402", "value": "384:Xr3VoDaaH8YqYSjzKat857ByYVr5HmoVwGs7qJq8rp7sxCM4uVcqgw05VxJN:iDjcmSjt857ByWlBwGsl8rOH4uVcqgw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763100963, "uuid": "96874d92-d5e9-4b54-9912-f971a84bc215", "value": 24352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763100963, "uuid": "6691d6df-c147-4c03-aeff-2c90c3fc9309", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763100963, "uuid": "8aa9c715-9919-419e-9c45-a7cec80a69cf", "value": "wewe8.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56bb3fad-c13c-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1763112534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763112534, "uuid": "4b858ee4-95e3-4e5e-aacf-10a4b994df7d", "comment": "Malware payload (Gh0stRAT)", "value": "3408cb766e5bb471eae787cb80618cde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763112534, "uuid": "77b8f6ca-9465-45ab-a772-dfc7654f7fd0", "comment": "Malware payload (Gh0stRAT)", "value": "7e3462dbaafd402d8883886044e6fbf533026fa38d1d181ab55743596dfb2121", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763112534, "uuid": "31e708fb-8ea3-4e6a-8e5a-9fdf97d9c7c5", "comment": "Malware payload (Gh0stRAT)", "value": "085f34b75d32972e902a13dfa9afa6e3a200a24a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763112534, "uuid": "4da10e9e-bf5a-4558-b4ec-9e06796f8daa", "comment": "Malware payload (Gh0stRAT)", "value": "977ea2793c5485d09b2cac1aea115228f0870fe06530ec682ddfdfce1b69085a5460a0bc2f1e0cd57e1959463a0a4b2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763112534, "uuid": "57c71bfc-c7ca-47ed-8a30-940234c0d1b1", "value": "T179561217E2CB613FF06A5A3609B2D226593BBA6065124C67A7FC386CCF261D01D3F647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763112534, "uuid": "a30a6c99-616e-4463-8966-b93c29a906c0", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763112534, "uuid": "12b88a5f-e9db-4f92-87dc-fe69e67947e8", "value": "98304:uxHXS1WR3uMooQbPrURINHAa2JiCdJ9YKzoFOqQtAwKLoa2rDmYAlU5pzcmSa6D:uS1wKoyURXNYKzogqQtAwKLD2GjizcmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763112534, "uuid": "b616672c-9f65-4a1d-bb7c-180d3ae98f82", "value": 5918720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763112534, "uuid": "4754a316-3b3c-4c5d-ade5-8cc572a19cef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763112534, "uuid": "0e7709fb-c04b-4dd6-8862-72d97766a43b", "value": "anyunlock_c-yP7k1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea0ce90-c194-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763150450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150450, "uuid": "987d3ee4-67cf-48ff-a4a7-278c08094afe", "comment": "Malware payload", "value": "2463d8d5ce608ecfb224177464a3f7a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150450, "uuid": "5afd9dc4-1d31-445e-ac0f-9f30079bca53", "comment": "Malware payload", "value": "7f1b7e921dde341bcfea9f0ed334e2b0ac652aa8acffd22aab5d9536375c78c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150450, "uuid": "f476b7a0-68fe-497b-934b-3081822035d2", "comment": "Malware payload", "value": "24f30562d2971ea69b949c3dd1db6aba977f5d43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150450, "uuid": "a7bf9112-223b-4ceb-aca8-da3a3aa8117c", "comment": "Malware payload", "value": "a5cc0c44e92f03d14a6f15011a290a416a9942e470a159e6cde33fb88fd5989dc56da103b231d6b5df3b7b701b5b43ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763150450, "uuid": "cffdda11-d206-4c89-bb85-07fb01569b9d", "value": "T121365C47F5A364FDC19BC434475B9963BA31785802257EBB66C0EA302A33E705B2DF62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763150450, "uuid": "2fc430e6-2e5d-4d6f-ab89-56ebbe77ef3c", "value": "98304:bicE4DAAwr28YBMESisWQJQ7PdRK36+aCIHIchK6KlUbdsmtWt+/:biRVcRKraDQmin", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763150450, "uuid": "dad93c99-8612-462d-9c9b-68c12a5305d8", "value": 5040232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763150450, "uuid": "da1cfa28-efe1-4d62-9f38-c613e89a86a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763150450, "uuid": "d94d73b6-1393-415e-8eb3-461c90aa2c93", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a59483bf-c125-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763102788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763102788, "uuid": "a16bf698-e6d4-4635-a029-142fec4b06b4", "comment": "Malware payload (Mirai)", "value": "8edcc9ccff9de0213981040f0f4e6683", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763102788, "uuid": "078b2920-11e5-49d2-9908-7957a551ccd1", "comment": "Malware payload (Mirai)", "value": "7f7ebb7ec97135d00d4e8c17f7296646093cb6c134f2c7d7f646dec708dd54f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763102788, "uuid": "a3afff70-6cb0-41ff-91f2-4c80d28cd435", "comment": "Malware payload (Mirai)", "value": "dedb34d311b79ecd126640149df5388deec26997", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763102788, "uuid": "74d4078e-efde-4e2e-bbe0-eb64f6ea7150", "comment": "Malware payload (Mirai)", "value": "aaf8c307621c337800b50b75e1dfa465bc61422f0c5fd318a122d1ba8270ecb5dc66542c6612ea5d1218b02abdf85dab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763102788, "uuid": "8ad41eab-2aa3-4b0d-b1dd-f23608cc4724", "value": "T1F2135C89AA83D4B2FC9225B2153797624A76E07A453CEF16CB362431EC13B10A71F39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763102788, "uuid": "b1cdd660-34e4-413c-9a43-32bc8b9e5875", "value": "768:Zf24ajJ9kPLtoSqm0NR1hUfCoMEoaEG6y30iLP8WOtaI5E:TajJ9kPLtoBJCMjtGXjLXOtaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763102788, "uuid": "5bb6600a-054b-4787-b1b5-7598a3c6b697", "value": 42096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763102788, "uuid": "266bfa5c-ccef-4f5a-9058-6f747a75f9eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763102788, "uuid": "50f9370f-df20-4ad0-a394-60176cd838da", "value": "wewe1.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4bc9abe-c185-11f0-a129-42010a9c0007", "comment": "Malware payload (Tofsee)", "timestamp": 1763144018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144018, "uuid": "62e9539b-507a-474f-818f-df594db2dab3", "comment": "Malware payload (Tofsee)", "value": "ff902a84f55eca08bb91ef9c677ef3af", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144018, "uuid": "4bb5b22e-d378-4929-87f3-aac98fd4fd10", "comment": "Malware payload (Tofsee)", "value": "82400202f2bfeaa2b43111ad71931f00a27f47409001ece27f54009440b1643f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144018, "uuid": "3c5b25b8-9b4d-4478-af1f-30a407e1e025", "comment": "Malware payload (Tofsee)", "value": "ec4bb6338c8a022530eefe60071bd500ec054d2d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144018, "uuid": "0e2d288a-dc0d-46fd-899d-42284d35c1d3", "comment": "Malware payload (Tofsee)", "value": "6f9c2b4bab85e6cb8c01655f78e28094b87bafc2326364594600de1193f830b6dddfcc4684ff99c30f047e23c013829b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144018, "uuid": "9aa5c004-1427-4376-8c5e-2bca552b5c63", "value": "T117760117A94E533EE46A19350A739F48553FAED0A81A8CE392E43E0CCE394511D7FE1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144018, "uuid": "80b41bee-96a3-461f-a699-db3975be8ae8", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144018, "uuid": "13ae4e25-8512-41f0-81e7-00b6f484b46f", "value": "49152:pDXr89ns5kXCvW+IkxGZ2rBYVjBB1KnXy8QJ+FPslspd2QfqcdJaRXJykpucT9ER:pDbGsORf0SVjH1ck+lsqeKrMXbu4g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763144018, "uuid": "47c25aad-f6a5-4d62-907a-b1e4b60fdbe0", "value": 7264811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763144018, "uuid": "6d4cb93f-c3a4-48a3-874f-befb79deea05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144018, "uuid": "f996c1c3-5cdf-4939-a136-5cc5d03a4f41", "value": "82400202f2bfeaa2b43111ad71931f00a27f47409001ece27f54009440b1643f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61bcb379-c17b-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1763139611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139611, "uuid": "d5771c47-28e4-4756-bc69-e8bd3c9121cb", "comment": "Malware payload (SnakeKeylogger)", "value": "9433f9e8ca52c84b8655b2b5af477624", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139611, "uuid": "7d5d6f4f-1122-4e0f-8d6e-096f14c1d5fb", "comment": "Malware payload (SnakeKeylogger)", "value": "82fc5ecf0a30f1049c72121337eacf3221927dd2ad9f1579e805658baca32d61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139611, "uuid": "ee561fa3-67ad-4a34-9380-e17554d1565f", "comment": "Malware payload (SnakeKeylogger)", "value": "fe1e8e7117982bdec3c8a338af8e81dca1b0f707", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139611, "uuid": "23af1cf3-638a-4b41-8055-00c42e945689", "comment": "Malware payload (SnakeKeylogger)", "value": "99cd156e28910514feb9167c4b79903c553a482d725a8c89050d97a2fc2f5d2a1a61547133a1e0f3af1b3e23b476c800", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139611, "uuid": "2bf73919-f04e-4032-84f8-1b974f44fbfb", "value": "T15725BF2373DD8361C7B25273BA25B701BEBF782506B1F56B2FD4093DA920122521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139611, "uuid": "8895435e-1d92-4758-8ecf-18091d11e5ea", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139611, "uuid": "87683050-d631-4f58-b97b-e975680abbfd", "value": "12288:Ftb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSga07WE3wt1zFS+6A:Ftb20pkaCqT5TBWgNQ7a8YdFS+6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763139611, "uuid": "24640bf0-9e81-4a0a-a47c-06f17f574e90", "value": 1006080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763139611, "uuid": "c046135a-2aa2-455a-88c2-ef247f805331", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139611, "uuid": "ce92914c-d702-4c44-9a8b-621f953aa636", "value": "z94dhl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d2ad10-c152-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1763122116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122116, "uuid": "61986d06-ba92-4878-8f0b-70dae49a5c67", "comment": "Malware payload (XWorm)", "value": "7f29778fa8711e638b2d831cd45041d3", "object_relation": "md5", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot8024716497", "colour": "#C22CC5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122116, "uuid": "18b6286b-3d2f-4d2d-b4c6-5b7ea15fb067", "comment": "Malware payload (XWorm)", "value": "8386bd90ff45dcedfa76204fbc85438c341de8218181f415e723b94f703bc172", "object_relation": "sha256", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot8024716497", "colour": "#C22CC5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122116, "uuid": "738dea79-b8ba-4e01-9e24-b13f1356d8fc", "comment": "Malware payload (XWorm)", "value": "58da7a4665accd378c1fae713a8c259865e1542e", "object_relation": "sha1", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot8024716497", "colour": "#C22CC5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122116, "uuid": "d120251f-841e-4533-b5f0-78cc489dab55", "comment": "Malware payload (XWorm)", "value": "adfd0dbc1614373e52563845012eb9952f9fa77dc0f4c98b157e1de6f67adc1f04bfb4ed0778899181759dd5b163548a", "object_relation": "sha3-384", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot8024716497", "colour": "#C22CC5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122116, "uuid": "c0472a8a-d673-4343-80af-c7460967dbc2", "value": "T110446E3DE9E07CAB569F2FA2B9321DAC12572E45BE701E7B801642140DEA307BFE515C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122116, "uuid": "b2c1d754-17f6-409c-989d-596d0a4e110f", "value": "6144:mE5jbt++bytZWMOIi4jyTLkRiEtDVyGN1Z/mRE+JNk99E7tt3eSVw4KXd9Ver2m2:zITyTwBelZZes7Jpfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763122116, "uuid": "05f3c17d-5cdd-47d0-94d3-bc0d0cdd9e0b", "value": 268568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763122116, "uuid": "2cae396f-4597-4be0-8c0d-e7f78548d042", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122116, "uuid": "9c21cf3b-1437-407d-aece-8a1dc40584ce", "value": "PURCHAE_ORDER#77021.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aeb3937-c174-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763136647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763136647, "uuid": "47100766-e338-4765-89d4-1c1a5850f86b", "comment": "Malware payload (Vidar)", "value": "cbc83451d3398f76ee9492ef83110559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763136647, "uuid": "df96c6f5-589d-4dc0-8767-9307bbd83392", "comment": "Malware payload (Vidar)", "value": "83a06e47e84ee7624f0682ec0500dfc9baf2f7d271c91bfbce7a96816821ada0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763136647, "uuid": "defaacf9-e182-45f2-8e8e-e2f61f7b4a65", "comment": "Malware payload (Vidar)", "value": "34fc1fb71f45d284e86ae4ba93e78930065b9cc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763136647, "uuid": "6631187b-a602-4ae6-a006-ad395b3bfcab", "comment": "Malware payload (Vidar)", "value": "49b0e32b2358500b40de754e5ed811cf3e97b3b5ee94b8dbf0567957e2c5a7ecbd1fd502a0b68873321602b9a130da15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763136647, "uuid": "af191277-daa9-4380-9e9c-6960f96e5362", "value": "T182A5230663D1A0A3C0BAA77298A203934B373D626E75C1BF17D2D82D5F732D46475B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763136647, "uuid": "d9187855-904d-4d24-843e-71cbe9b5ad58", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763136647, "uuid": "23957cdf-88bd-4ad9-a85b-da0992a56272", "value": "49152:djf6sBXeV2EXXrtQMRG0iyS7hrdS+zOPIwrRMMULDnIoFlJjorX:YGOVvXJRGZ7hpS+2wDnIKDO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763136647, "uuid": "9ebe9c0e-c665-435d-a8c4-801df69337e5", "value": 2109440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763136647, "uuid": "60b8d490-6749-4fb3-9110-de891b81b256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763136647, "uuid": "be3b9100-4cc3-4156-b238-363ef818f119", "value": "Aura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7304123c-c0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763081228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081228, "uuid": "06a1f4dd-d3ae-432e-b975-01ae4185e63e", "comment": "Malware payload (Mirai)", "value": "1c3da754a73d3822ae98ac4ad7eaa843", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081228, "uuid": "1a4a0aba-9d32-430b-bc47-ebf108e0fa1f", "comment": "Malware payload (Mirai)", "value": "84cb65e956e4ab06f68a974ad9f6096ffe314856d074d397c1c4b064bcb86843", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081228, "uuid": "8464260d-5421-4a66-8702-7dd2599e9733", "comment": "Malware payload (Mirai)", "value": "4ac3032bbfb72796aa6e37ad3e6d5688e4dc32f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081228, "uuid": "fec9ae3a-5def-4a03-b38c-3bf79d772c85", "comment": "Malware payload (Mirai)", "value": "4711e6f3b868567b8da05e29ca95253f6c1d1e08047586469387169c434b625d97e6c3608acce2ded263863f26cee658", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081228, "uuid": "2cc6a03c-3d22-4dfa-ba76-b1de6b22329b", "value": "T14FA2E02172A32E66E2ED1C3CC96E8357F9671BFC90F5327579415A20C94D30A2E38A4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081228, "uuid": "793e735f-4f84-473e-b5cf-52a8ba674f8a", "value": "384:UvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjeWIhymdGUop5hF:UvQn4j+ZO5fKAlx7Is3UozP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763081228, "uuid": "4cd090c3-fda0-4b4b-b2fe-a1657e398a8e", "value": 22160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763081228, "uuid": "fd4a39e6-e34d-4f69-a700-6ecc350a4758", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081228, "uuid": "bd4a9209-d912-426a-b4e4-0cccc91fbb85", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81f421d-c18c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763147111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763147111, "uuid": "25b896ac-5667-4b32-87ea-5f7fd9280d4e", "comment": "Malware payload (Mirai)", "value": "be0ea0211da917f9d90ac317205345a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763147111, "uuid": "d12da873-e5c9-4591-93fc-8ebf5aec2bf6", "comment": "Malware payload (Mirai)", "value": "85b03acc920b097272bad78b33b52474edf0306def913bfd7a007214cd56c448", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763147111, "uuid": "10b1bc29-1f90-4891-8e2d-e0f540d737a9", "comment": "Malware payload (Mirai)", "value": "759e482303f42a24f9dd80f922de6b2fb507d462", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763147111, "uuid": "4a1da558-704f-4aa3-9632-266db3ebd09d", "comment": "Malware payload (Mirai)", "value": "5eea014fa73c4f8c002916fb9f35ec6ebf49160fedd43fe013acf68b7e2d126ca57c403c2164c21fa686c8b1b4f744f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763147111, "uuid": "4320a3b7-a347-4058-8253-51de731fcc60", "value": "T1C3040A01B8114B57C5C32BBBB7DF42993B336B5897DB3301AA18BEB42F8679D1E29111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763147111, "uuid": "78fa7033-bf7d-4e56-bfe7-f3b6594e53de", "value": "3072:MZZK5NIowDH78IL5Bkbt+7dQM2IDbTvkBGYivZ8uTEG3N+BwR:iO6owDb86nkbt+B1TvkBGYivZ8uTEG3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763147111, "uuid": "bfee5e3c-10a8-4269-96a1-b6d875f71f0c", "value": 179026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763147111, "uuid": "8e1366be-298d-45a0-91f4-f36c24907f07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763147111, "uuid": "dd93ada1-cbe6-4b9b-86e1-40532855c41d", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d3f86d-c128-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763103911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103911, "uuid": "cd2eea9f-7845-4b77-bc6a-96d34aafcdbe", "comment": "Malware payload", "value": "0bb4805845b277ee90513037df4e0cdb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103911, "uuid": "d6157659-371f-4cc0-9efa-899b0fe09907", "comment": "Malware payload", "value": "866cd55f33aad1b4489af8b03d8514248fcac46440f53e2db2379c525a485883", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103911, "uuid": "8defcefb-ef44-40e2-8e88-623040d96967", "comment": "Malware payload", "value": "bf82ed1d674191686394aac0ebad63c45b4e2af3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103911, "uuid": "518bcb4a-ce0c-4cd2-aec9-407c86e160f1", "comment": "Malware payload", "value": "d7d402e9e8a0f6a01649d6fac56780bda50e9d3940d3fe01c38c6a4cf9742d2db31144a6901b402d70b9102ecd2fc83a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103911, "uuid": "270494e8-36f1-4792-bc22-3bf4a11376bd", "value": "T1B8331BEAF800DC7DFC1EE73B8457040AB230E759059216362367796BAC7A2A44977FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103911, "uuid": "31ff21c7-98cc-47b3-a292-8cb5885b66bc", "value": "1536:g5QojLB0lwFqUJF8pxdS68HW1/yndLeH7CVAM+mR:guXgqUJadSG/Odys+mR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763103911, "uuid": "495eb895-201f-41d0-a913-5c319de99f15", "value": 54640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763103911, "uuid": "0fb06bdd-ba66-4276-bad4-5ba3de188a5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103911, "uuid": "5bb736fc-df11-4c4c-b8ca-a70d4ba5e7e6", "value": "wewe10.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b253d6c4-c197-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763151772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763151772, "uuid": "c2dd9ef1-9fff-4415-8b27-fd3ccba73861", "comment": "Malware payload", "value": "13476b92dd95ab76731e4a0a9a197bf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763151772, "uuid": "08e397d1-7f22-47c5-b117-bdee2523036d", "comment": "Malware payload", "value": "86d4926c600814842ed12c4b689a4d437e94abcbd8009dcbd0d60731b26664ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763151772, "uuid": "c12c5f76-b842-4b23-9675-ada2f3461286", "comment": "Malware payload", "value": "89e9a1e8896ad981c80b3045a6d83d363f73746b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763151772, "uuid": "bc950435-9dcc-4055-811f-ed65ec1694d9", "comment": "Malware payload", "value": "9a39af5f1b7c971610e68015d73df155cef4596dd722e9511c8d79c11f48e749b6f15cd003fb13bc34813334a914a052", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763151772, "uuid": "012700c2-c2c3-4876-8635-2dd38dd2e846", "value": "T151E5C71BF6B610D5D1BAC038D553522AFC7134A5833C97EB92818E4A5B60BF8EE3E741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763151772, "uuid": "0c454cea-85d1-429a-8857-5b74d9c1001c", "value": "08e72a96e5f5739a6a2efbc8518d8644", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763151772, "uuid": "10e2ca68-c1c5-4a04-95ab-dec374fa7a87", "value": "24576:jqxKPwDa6moRg2mQwwNLsvQiKjVGK8PWrfQb3XOZ1iRtO:hfoeqwwGvQHjToOcLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763151772, "uuid": "e6d3e3c5-64a8-4fc8-800e-8ecde7b7ea24", "value": 3140608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763151772, "uuid": "d6c06dab-638d-44bc-87a8-e8cc9f732949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763151772, "uuid": "537ad8b0-bd3b-4142-b4e8-b12cce9dcf10", "value": "SecuriteInfo.com.Variant.Barys.334082.31167.12971", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d5a515-c0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763081256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081256, "uuid": "1ea4e7d7-a202-42c8-a828-38a3959f962a", "comment": "Malware payload (Mirai)", "value": "70054db5ceb4884fc014b1afdb88a147", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081256, "uuid": "b674652b-282f-402a-82d2-438bde012cf0", "comment": "Malware payload (Mirai)", "value": "8799eb3ed52feec55ea087af16ce1d9de4e41ec46dc56e535eef85edf4de1d14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081256, "uuid": "38217aa4-5956-41f5-b285-ab57656910c2", "comment": "Malware payload (Mirai)", "value": "19ce0c6718eb049efa0509fc66747f8fd0f49115", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081256, "uuid": "e9d819b0-8516-462f-a8e3-b63c88564b15", "comment": "Malware payload (Mirai)", "value": "f9db8dea77595887c103079d311314c2382b442ebca71a76c83b70501d894424497d0b980cb1333899d6a7c08483a32d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081256, "uuid": "bdf02483-a966-4ffb-b5fc-8984c8f2852b", "value": "T12B334B42322C0F17C0A35974252F5BE487FFFAD122E4F685251F8B668A78E371489E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081256, "uuid": "70dcd114-00c6-4305-b37e-27b1b76470fb", "value": "768:3SjbGSLlRrYj0a8C/dQOhPC/+I20Ja6ZZ+GwPS4yns96BktDgIPi8TwE:ivW3jdQGqt7Y+Z+zN9cGgI6bE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763081256, "uuid": "5ab98f76-be79-461f-9224-4178b882cee8", "value": 54364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763081256, "uuid": "16d9b06a-74e3-45ef-83a0-b55761e070dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081256, "uuid": "e682945c-7dcd-417b-adc7-4655bd9f6a25", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f351b65-c166-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763130480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763130480, "uuid": "ce92d367-5663-4224-89de-7fd5871a2a53", "comment": "Malware payload", "value": "0e0c4ace1c4cfbee0e4b82c0c66d2fa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763130480, "uuid": "11fc6bb0-d026-470b-9caf-7a80d2c11490", "comment": "Malware payload", "value": "8af4b393b9a01e10d3d3816b5571d079f11d9535c41f5e179576ff1c10eafdef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763130480, "uuid": "3b48ac5c-1b78-49ed-85c8-fff15b8141bc", "comment": "Malware payload", "value": "6b2f720649679755566c00b9ec39c1a388a8bdcb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763130480, "uuid": "67d10a18-9ef0-49eb-9c71-a3b41925d8c0", "comment": "Malware payload", "value": "206efe49d53cb2842e0fdfeee77606be006c044349690e5fa29cc50790357ec56a4ece32ae9a618f038cd3e37d633f2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763130480, "uuid": "081bac6b-8523-4e32-94c3-41bcdf41abd6", "value": "T15C04F893B904DEF6F40AE77204D30B257232FB664A531A36B3177969AE3A2C43427F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763130480, "uuid": "3dfcba9c-8849-466b-8500-c99b7c5ff4b2", "value": "3072:Z3IHN+wNyaPbpRTbJNHyOUHHbhN9s7L3QMIjAhnSxFXlfv6BG7nx/2jsCD65SwR:ZDIyajfTbJNjUH4LAZjAhnSxFVfv6BGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763130480, "uuid": "e177f8ed-cac4-4d6c-8b2f-029060d643b4", "value": 182114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763130480, "uuid": "0399122a-a142-44fe-9b87-1c79d680d688", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763130480, "uuid": "97c7ce6b-a515-4699-bfb7-c98367abecbb", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "720a8e7c-c0fe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763085951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763085951, "uuid": "4a922689-9c18-4372-84c7-cd8f208fc1d0", "comment": "Malware payload (Mirai)", "value": "46ac015b9c147f50a880d812c0b61c5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763085951, "uuid": "ce71e48a-5481-412e-9879-f992331d2896", "comment": "Malware payload (Mirai)", "value": "8c43b130a5e8a93c2cb5927419e8ee002d65ccb389001075a61f7e183f764396", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763085951, "uuid": "73fc1530-51fe-4597-8404-97679d80292a", "comment": "Malware payload (Mirai)", "value": "4b921737690a75bd1bb9ec4b1cd8733e89235627", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763085951, "uuid": "fe0f6f38-a0b8-4e63-8e92-65667e6f7dbd", "comment": "Malware payload (Mirai)", "value": "84bfab706dc8f7632ccced50a546d6294ead753ea69b203ed492f1cabe2ece6efae4602e542cdf1c9e7df4770767f4db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763085951, "uuid": "3c48a6ac-0697-4202-ba53-88af24f157d5", "value": "T19783B5097F654EF7E86FCC3746B95B0424CC950A21A83B797D74E818F25B24F16E38A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763085951, "uuid": "d667acb2-ae44-425b-be6c-72cdbcfdd57c", "value": "1536:eg2Fd2KGML/NVFgNyE5yflEEAdY9hisZRIxh84xg2xcuybVR:L+xGML/NVUycHxcuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763085951, "uuid": "71707e49-99c8-42ef-b049-e361a3380f6d", "value": 81552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763085951, "uuid": "08a5507c-a6c9-4865-a50e-f2eee9816fdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763085951, "uuid": "fb8af06d-7c24-458c-bfb8-25dc1695a85f", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67cd9f3-c166-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763130841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763130841, "uuid": "6acb11f3-06d2-4db1-8b5f-d9fffdde709d", "comment": "Malware payload", "value": "fb9056ab569aeb9ff495c7fbbe5802a3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763130841, "uuid": "9b627ddf-225b-4594-ba52-5979565a0e3a", "comment": "Malware payload", "value": "8c6265d760f8ff07a0fe36be30724aca9996223d057b85a6c421365ba503699b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763130841, "uuid": "545a77af-2f0c-42f7-8e57-32b4af695275", "comment": "Malware payload", "value": "1ada708789c969f595514805a517fc8ab776f8fe", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763130841, "uuid": "02b67ff2-507b-4991-8e41-7b2b72dea900", "comment": "Malware payload", "value": "987f61c45ff1fb8fb81c6d3f02cc4d92b9bc0971be7560486a78f4884c71117c131d6a4d481dad56a05fa46e5d5a8f27", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763130841, "uuid": "8ac63df1-52d1-4c36-9f68-8d40adc12695", "value": "T128E56A56BE9079E2D06BEA32C96365917B617C0A1B3233C76D90B36C1E727D0AD39F04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763130841, "uuid": "a0aef591-dd7a-45a8-9c68-58effdcddbfd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763130841, "uuid": "340391a1-170f-43a1-a1c0-12d8ccad2f1f", "value": "24576:S/szyoq8X2P/nwKgBLNG170lT4CUzaWfL+TGlbHOmjI1huNilLMrDqUU6NjbQxkZ:S/s2oxmPbgBNsaT4CmwUd2Pho8xw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763130841, "uuid": "714a5954-90e2-43d4-81c9-c172d58c3a57", "value": 3141120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763130841, "uuid": "fb3a51e4-56d5-4f94-83f2-493d388f85ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763130841, "uuid": "1f8d9f87-eef8-425f-9ba8-9366eb4e6f56", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd42d4a-c0fd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763085674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763085674, "uuid": "f2ef80c9-d74d-48bc-86eb-9f0971c2d958", "comment": "Malware payload (Mirai)", "value": "f5d8257405639406c2b6e7d34d750d80", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763085674, "uuid": "24a639df-06b8-4ca2-818a-b3f984cf28b8", "comment": "Malware payload (Mirai)", "value": "8e35f336b50ef3ce4da8356f81ab0ddab7378cd8faea6507d7a5eb753b3a8d00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763085674, "uuid": "67be7f90-5d62-4e2d-ab1f-6fdee5acf4c5", "comment": "Malware payload (Mirai)", "value": "7297a512c62e785916e9f5db22efa499eaf0d1da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763085674, "uuid": "56a3f53f-292d-47e2-940a-82d0e60b213b", "comment": "Malware payload (Mirai)", "value": "640b60a80bc973ffd210993f7506091e66344f1b66a3adead55191f9816024a6236f4d60907bab7d4379939d88dfcb50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763085674, "uuid": "7b07d90e-961c-4f49-8ec9-92329d478fa4", "value": "T17383F74AF9819B11D5D962BAFE1E118D335317A8E3EF7202DD105F2477CA92B0E7BA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763085674, "uuid": "3104f874-d9cf-422f-ba26-a5c647f9574f", "value": "1536:19nc2137a5A3i6QylvCqLQwPOi5+OWtWdoYJbPcEWqhllfYi3Djjs8uybVR:HNW5kQylv3LQwPcOIOoYJbPcE9RDjI89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763085674, "uuid": "ec390936-3a36-4a1a-b875-97f609c6cd4d", "value": 84576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763085674, "uuid": "03d7bc56-a561-487a-844c-adf4d19d5918", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763085674, "uuid": "699059a4-fdae-48f9-acff-8cfd0d532b61", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f97e02d-c179-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763138641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763138641, "uuid": "e01f6a0e-d648-4891-bf18-f38bc82e78b2", "comment": "Malware payload", "value": "db73a83c104d68a504ad5ef35c960f71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763138641, "uuid": "99c5e258-33a4-4da0-b206-a2b2eca029b7", "comment": "Malware payload", "value": "8e41c68e837dd6246b1da6e837b5c8eefd1efe9cfa32b0a64326c0e84fcb169f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763138641, "uuid": "6a4514d2-81c4-48f0-86cc-fd856ed6dc63", "comment": "Malware payload", "value": "0af7b36ee3e63391566e5d4d02c7c379dd874050", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763138641, "uuid": "e508675b-b23c-4567-a90d-f50fdd8a45bd", "comment": "Malware payload", "value": "fb402477ae37a2a48766c889db74db00fe3ad15d138ea9da5b22739d30cc957149ca302ae9c28c59073430020451ede6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763138641, "uuid": "ac78ea94-a4f3-46f7-a389-5da63d3b8f62", "value": "T171847E86F2A480E9D057A07851BBB30BE975385C072056DF33E849592FE37E07ABB751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763138641, "uuid": "4eb04dbc-43fd-446d-b04f-b53423d12e16", "value": "1736fa406a16a1735a8a79bb13ed7741", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763138641, "uuid": "23ef1a7e-57e9-4796-b8da-3a973d0a71d7", "value": "6144:yJ+27zXIxuON0To8w1/gdLhwBLxot4JkxhQ3YHU4KjMTkNeXi0T/nUrbpThSkg:yPXsmLSZxf3YHU4KjMT9T/nIkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763138641, "uuid": "0728eccb-ca6f-4ea4-a8a0-1f48b781eac3", "value": 372224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763138641, "uuid": "cc56e264-771e-4eac-afa7-bf2877457512", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763138641, "uuid": "8fb30e79-4eb4-4438-8092-542cba89d990", "value": "free.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfa629c4-c13e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763113623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763113623, "uuid": "06115155-3182-41f9-8c9f-fa0a7c07b35d", "comment": "Malware payload", "value": "cbbed24ca30bbb3a728795fc08e8fa2a", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763113623, "uuid": "9fc81b48-b2ca-4d2d-a996-3b6c44aed468", "comment": "Malware payload", "value": "9528ade7ffc1a6a4f29c67f14699b560149ae871820481c3415eca999b0e5cc7", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763113623, "uuid": "f72df15a-2b5d-41c0-9851-3b318535160d", "comment": "Malware payload", "value": "1e82d6782ba76b252f3b22885b8a6fcab7dac19c", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763113623, "uuid": "089182eb-7421-4124-8c13-a467e4a3cc37", "comment": "Malware payload", "value": "c70cc337cde01dbe53dc30d067a388cb8da634b42d7f78c38714d373170774a21568df9cd47b57faefab87cb8dc88e0d", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763113623, "uuid": "9d4c7d88-2cb8-45d3-a94a-e1d08fafac22", "value": "T11F148D96F7F6C916CD58473A8CE657963732FC428EE3430B22847B1E2DB16B0581365B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763113623, "uuid": "42c0007f-98a8-4d95-9c20-e76c0be9809f", "value": "6144:3onQMKpwZtG6cPXNaD/ACk+46fDw//BqnNcNq+tkF6+NL1w:bhtkF6+RW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763113623, "uuid": "60cfb36e-c841-4019-a645-9ce5eac0f39d", "value": 203264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763113623, "uuid": "a437ca8c-e1aa-45d3-a02c-c1d3bda84473", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763113623, "uuid": "42b2a4d6-861f-483e-af8b-9ab8de71ccfb", "value": "202511 \u82f1\u56fd\u822a\u7a7a\u8d26\u5355.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58fa13b-c187-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763144905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144905, "uuid": "fb9c05d7-6452-4f84-b35f-92e30bbbb551", "comment": "Malware payload (Mirai)", "value": "d0b84c277a0e4b739f7bdac971939418", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144905, "uuid": "78ad52c3-3dfe-4502-8380-17216c2e994a", "comment": "Malware payload (Mirai)", "value": "9556672eaf1573720fe806ce034899a820d1eb9799fae9733e8673c639c214da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144905, "uuid": "36657240-1751-43b9-bb5a-92b0033552b6", "comment": "Malware payload (Mirai)", "value": "96b6cba03cc3c3488c2d3f30be7c272f64386929", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144905, "uuid": "114db242-37ad-46dd-9213-8c4ff0c79996", "comment": "Malware payload (Mirai)", "value": "dc10775c14fcf4a862f90bf5a94ce62e8f923c17e6b5a8a32e8db8926d7b53495079f9728cc084359f69c32943b7215c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144905, "uuid": "1455bb30-0e75-4f0a-91dd-301998ec6a52", "value": "T104833A22B9361E27C5C0A87B21F34725F2F6538A25F8CA0E7D620D4EBF256503197AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144905, "uuid": "919f9312-dde4-4560-9c24-161f1c45ccce", "value": "1536:+apqCVBUtkIPtW7lpzAGtRztEt5cNE58bt5eiGU:0MBUI7P/C/El7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763144905, "uuid": "31fa4c24-2560-465c-9cf2-2137a9b80122", "value": 88700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763144905, "uuid": "fe5294e9-5856-4ecf-8f8a-afdcb9563b23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144905, "uuid": "2e69e697-c1be-47ed-b5f4-a04234360f5b", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8699b5-c135-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1763109668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109668, "uuid": "4f7dd470-7be3-43f6-b501-c9b19e09d30d", "comment": "Malware payload (AsyncRAT)", "value": "fb781fbf8f94961f2dd67b2bb47674d5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109668, "uuid": "a7d56aff-9273-4e29-9f2e-43e7c55a7826", "comment": "Malware payload (AsyncRAT)", "value": "967d195195f66df9b6157c8d849960a3436f751ffc2a8fa5bdd2b77ca147d36a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109668, "uuid": "ab01eadf-f535-4148-a162-478d3b7c710c", "comment": "Malware payload (AsyncRAT)", "value": "43f1aaa77290993b04a4b45598dc5b8c82774c71", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109668, "uuid": "3d6d7018-f35f-4d38-96f9-0c558e234a0e", "comment": "Malware payload (AsyncRAT)", "value": "4ec082c55d8a0c78a9153f79261c84c2b32cb60fe0e28906dffd20ee31a590355a3f15d1844b16971e8f994ab61f511d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109668, "uuid": "0cd248da-1713-4804-9736-942ba6010714", "value": "T18715AF2373DD8361C7725273BA25B701BEBF782506A1F96B2FD4093DE820162525EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109668, "uuid": "c3c484da-c206-4eff-a5fe-9a65d2ad6afb", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109668, "uuid": "9e71c7b0-bf0a-47a4-8e16-d92eb64ac71c", "value": "12288:Ptb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaD7cIcR66A:Ptb20pkaCqT5TBWgNQ7avc3R66A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763109668, "uuid": "5de91563-8f01-41a7-8b1d-c90c50a5ce84", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763109668, "uuid": "6a5b5c7d-51a1-4d09-82d4-d6ce0e518319", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109668, "uuid": "0e89286d-7644-464a-bd97-a93533eaccae", "value": "Acknowledge New purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228dee98-c169-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763131774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131774, "uuid": "070938a5-43ce-40fd-bb7f-d9164a5ec474", "comment": "Malware payload (Mirai)", "value": "44495e58381d506e9ab6390cf892fdd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131774, "uuid": "cf9a015b-9e86-436c-a133-5f1a9524c8e2", "comment": "Malware payload (Mirai)", "value": "96c818a555ac2548e9db65fc20b099b3325e216308675dc025f49b7949e8591a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131774, "uuid": "d5e82e8f-af7b-4107-aece-868c904c424f", "comment": "Malware payload (Mirai)", "value": "80129e69243d7ac0cfed3f69d0610bd74dd1c958", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131774, "uuid": "122ce6c3-7fbd-49f4-ad6e-75677bd4ab95", "comment": "Malware payload (Mirai)", "value": "8ca78adbf78c2a772fe5af977c390906b93e4e0301527ec90e10bba615a92c0345beb375b290b10eb555999ce5837fdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131774, "uuid": "1ac98d24-db0a-4dc0-9e05-3be60b87ed09", "value": "T15C635BC69583D8B4E8100278707AB762DF33E57FA876AA9BE79D58229C115039307BDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131774, "uuid": "d7512659-6524-4fae-9317-d229d646705c", "value": "1536:IDkjQnC3OKp9meSrTe+VdmTKs33wmY5h:IDkjQCeomxr6UdeE5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763131774, "uuid": "c2f79995-a4c6-4026-9412-29ebf4f7e4ba", "value": 70788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763131774, "uuid": "49c18024-1446-43f8-aca3-8ff03d16e872", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131774, "uuid": "a72ed2db-a015-4215-af02-4623ed23cf4e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6de28d2-c163-11f0-a129-42010a9c0007", "comment": "Malware payload (NetSupport)", "timestamp": 1763129526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129526, "uuid": "41e147ca-edd1-4f05-aadb-ecf965d073af", "comment": "Malware payload (NetSupport)", "value": "c0e57ce7f575bb7061bbf0c5718fe364", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129526, "uuid": "b0d7c385-941e-4e52-9480-7c756d7ea6d2", "comment": "Malware payload (NetSupport)", "value": "96d81c1650f3f048d5ee6bfa8f7b99a0eef58269acd2eb252a12d147019ec6b6", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129526, "uuid": "8e446b83-2ae9-424b-8120-80e91c82fe50", "comment": "Malware payload (NetSupport)", "value": "8a5ec662124230b1f39d3bc6e7b03f0e7a4090e6", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129526, "uuid": "6d6eca5b-3408-4af8-af79-e9045650e64b", "comment": "Malware payload (NetSupport)", "value": "3c584ecfa615b1c1de17e65e893cb8cc537c0c2d0681dd0d8b431e2ba4f3451cabb175978799229331f9644d37bdeeb9", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129526, "uuid": "421ea4de-e3b8-409f-931b-5c3a7fe35b0d", "value": "T13C1733D3D0A44D9FFE601234661C1EB0AD6C27504AB7A4513EC7B466D8C0AEACFB774A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129526, "uuid": "6cc190f1-5acb-4539-a0d7-3a0bf548d445", "value": "393216:Oi+QC/FbiGEvJemda5tY30QOMxvADAM7zA2QusxqShRo1eYVG:M/gGyJPdWSrOMGjfAOsVRqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763129526, "uuid": "3fa3ddec-08e4-4cef-ae52-55f008e370ff", "value": 19372167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763129526, "uuid": "e426d4e4-5901-4668-894d-ea250f476af4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129526, "uuid": "1b333638-cccc-47e0-a114-0daaaf377fb0", "value": "lopayt.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b01cff-c153-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1763122404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122404, "uuid": "9240f275-bbba-4f66-b1f3-e1665bdc646b", "comment": "Malware payload (AsyncRAT)", "value": "5f118eec90ef5258e8ddab6f251a38ad", "object_relation": "md5", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122404, "uuid": "7519a6fe-d0f0-4252-9c0b-67a486cfe20e", "comment": "Malware payload (AsyncRAT)", "value": "97ec3dc7c5d1ecf7d76c0a7e1506b3b59d4e4fb7d48d01c33b3fde7603b14496", "object_relation": "sha256", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122404, "uuid": "3e25616c-46ca-42ee-9833-9b7065387edb", "comment": "Malware payload (AsyncRAT)", "value": "6f8f631572d7ac7403b317132941fc484b82ddc3", "object_relation": "sha1", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122404, "uuid": "566d8a86-3c7f-4ef3-84d2-8957849b71e1", "comment": "Malware payload (AsyncRAT)", "value": "de30691b88aad166bdf5bebbb39d510714434d750e76f9f330b10a4da2bb99cce2efe8a93b4dcff3e8334f7745f91575", "object_relation": "sha3-384", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122404, "uuid": "785c03b8-8515-48b8-adea-f1334ee6e88c", "value": "T1C9534B48B7A04615D6FFAFF119B361060A30E60BD913EB5E0CE889DB2F637808D513E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122404, "uuid": "3682c5f3-ce44-46d4-9f2a-1308f5a6fcba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122404, "uuid": "749d3cdf-5002-423a-83a0-85b2e262bc14", "value": "768:dq38VPCpR3XO+WzDQp2/cs75p3OFu9YiOjhw/vWG:dC8VaHO+mpR9peFu9YiOj6nWG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763122404, "uuid": "32f982c2-e872-412f-a583-2845034aa9b1", "value": 65536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763122404, "uuid": "ecf29751-a6dc-4e79-990a-7a4d0b73789c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122404, "uuid": "69575284-22e9-4457-9b6c-f09a4c8b98f5", "value": "97ec3dc7c5d1ecf7d76c0a7e1506b3b59d4e4fb7d48d01c33b3fde7603b14496", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52db3c1-c153-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1763122571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122571, "uuid": "5079dfce-cee7-4586-9a8d-07019e751a4a", "comment": "Malware payload (XWorm)", "value": "9758b4cffd86797a85326b0dfbf8413c", "object_relation": "md5", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122571, "uuid": "b4abedb1-6a80-4ebf-992f-ca213e191f6d", "comment": "Malware payload (XWorm)", "value": "99e742e332afb1e9a3e0baf76aaf5e67c0851bb8967a4076f88ef17e86e15838", "object_relation": "sha256", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122571, "uuid": "5ab54712-d840-4b11-b642-653d7d41415c", "comment": "Malware payload (XWorm)", "value": "6aaa979547e94925813834da68d5e030c596d9c2", "object_relation": "sha1", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122571, "uuid": "23d10897-39b0-4ad5-9488-6993c53bf74a", "comment": "Malware payload (XWorm)", "value": "34703821209304e2ed55f91fa1e7944fd0cc1facfe001013c4a087964ae7fdd09e299edb106a5db258fe950a498bbf53", "object_relation": "sha3-384", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122571, "uuid": "4da55275-12a2-4393-87ed-9f8e22d93f95", "value": "T148C2CF048FFE91B6E8A94B7F9AFA57184731E6813606C75F6D44406C2AF72848A1F733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122571, "uuid": "3de5d9c8-169f-4696-adb9-807cc08058ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122571, "uuid": "cf5e3674-67de-4282-a6d6-80191b2b3f17", "value": "384:fy6QhA14qZTA5uUPcOwDJgPETcbG8FOokSIro38EK:844SecOwDJgF3Fvmos3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763122571, "uuid": "e0b781ba-fd45-44a9-8945-dd4a51161bcd", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763122571, "uuid": "10c7c441-3630-4d72-8a3f-88ae8ddfec5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122571, "uuid": "a50b1655-f75a-4c72-8d75-e2a3807ecdda", "value": "99e742e332afb1e9a3e0baf76aaf5e67c0851bb8967a4076f88ef17e86e15838", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4173db2-c18f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763148339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148339, "uuid": "79e6fe97-ecfc-4748-a31d-ba050c94f093", "comment": "Malware payload (Mirai)", "value": "a91027a076c73e9df86e54f298093ca3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148339, "uuid": "8b27b4e5-97a1-4722-bf23-ebc60389b3ff", "comment": "Malware payload (Mirai)", "value": "9ad91e2bfda32c279eca3fefe92c9442ccfd5b40da43d5be946d0dee3e3d4998", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148339, "uuid": "6dd43e0d-e704-4f5d-82c1-21a8d53a1baa", "comment": "Malware payload (Mirai)", "value": "e8d8c2d2b65298b3f764e9e043a2de3d7951cbac", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148339, "uuid": "54d0475a-0e62-4742-a17c-996b96aa31bf", "comment": "Malware payload (Mirai)", "value": "c4547a21b882d332d49d30c76db4bb2c8753a58ef8197611721f620ecb7666d45fc86fe9856f0d0209163acf9534cc3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763148339, "uuid": "2c88fc0d-036d-4e37-9e69-acb00f7ed40c", "value": "T193737DC0E653D9F9E9160AB05136BB378B32F5395029E763C794AB73AC83A40D71639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763148339, "uuid": "12d21249-79c0-49c2-a428-b30cae5164ba", "value": "1536:WXzZLCEahaBOxU+Nh193DrC6kOXWwbjxwyvQ7HQ00gNjSQhj3LS9fAE3Tn6eJMP:WXzZLCEahaBOxU+Nh19zO6kI7PxwyvQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763148339, "uuid": "988c476a-feee-4b1f-9346-1282d14e8fa9", "value": 74644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763148339, "uuid": "8bac87e8-9c90-459b-b33e-49937ff1b1fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763148339, "uuid": "59cd9195-f278-4713-976e-99c5f4aa9bc0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f50126a-c0f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763082591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763082591, "uuid": "d51f74ca-58f2-4945-af8c-aadea26e5973", "comment": "Malware payload (Mirai)", "value": "050d282624ca28c7c5d97c879b9b6055", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763082591, "uuid": "da969391-d935-4314-b230-de623cafab6a", "comment": "Malware payload (Mirai)", "value": "9b9764585122f6e0d842fb301963fed0cb6cba5a12740fec2c660d1f636bafd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763082591, "uuid": "3702dd87-fdf6-4da5-a495-675d2b6c00d0", "comment": "Malware payload (Mirai)", "value": "323eec490f2c93c0842c062f75d9217663a440a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763082591, "uuid": "76f9f0f0-ff5d-4d68-bc1f-79799d1cde37", "comment": "Malware payload (Mirai)", "value": "9bea9de66db3e45909f1ebb3ae5ec22f5a3086eebb4b3a791d3e043b37cb6e7deade62ce1435ba44f2650d5fcf1a5b41", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763082591, "uuid": "0fddb48a-fc15-4e61-aef4-f4f4ea4d9c57", "value": "T1C604D71AAF610EB7D86FDE3706E90B0539CC550722A83B753674D528F54B90B4AE3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763082591, "uuid": "17675531-62b2-4037-b20e-f80c34880f1f", "value": "3072:ANe3ZrFoXv+mTvwicQZQkCgfY0eiKkfxjeL:href+mTvpZQkCgf8k5K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763082591, "uuid": "51bf2ebd-bbad-4777-9c2c-2b55cf411ab2", "value": 186468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763082591, "uuid": "319e6389-1f91-4415-b4e2-78ce84643fa3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763082591, "uuid": "d4c87a73-22b1-46aa-b6d8-d740b653448e", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e960c3f-c139-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763111178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763111178, "uuid": "a15f4052-efc1-4c39-83f2-32420e5053c8", "comment": "Malware payload (Mirai)", "value": "e914b54683332411a0576de999830c4d", "object_relation": "md5", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763111178, "uuid": "68e86b35-8e54-4770-b854-9e8c22dbe8b3", "comment": "Malware payload (Mirai)", "value": "9cc5a8dcac40dcd963148d9d77926e5397515675949c80f72a77adc8e25403a4", "object_relation": "sha256", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763111178, "uuid": "13f99d59-d37f-44d3-9149-9217581f4e6c", "comment": "Malware payload (Mirai)", "value": "8cd15739685dd83e65db993db12e04584554efe8", "object_relation": "sha1", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763111178, "uuid": "598c5909-4f56-4fd0-99c8-61551c45c774", "comment": "Malware payload (Mirai)", "value": "5d4a2a48f696ee6fa1071cf0296ada055a4e08188471f44e46b9a18fdafe4b41f58e9f7d3544781533c534be699e3a4c", "object_relation": "sha3-384", "Tag": [ { "name": "DDOSAgent", "colour": "#428B26", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763111178, "uuid": "8abda045-0488-4fe1-8cf2-8e7de94353a9", "value": "T104F3635BAE10DF29F75C973006FB6C28834A23A72AE5D64AD19FC6002E3135D5C4FAB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763111178, "uuid": "4e3abc6a-ab74-409b-95ba-2aca2eae4793", "value": "3072:/ljfB8+6u+qbXFuYKxF/Zr7grUw8+NI11/2V4s3GLJBlFb1lCW6sC:/RB8+6uVrQYKxFxr7grUryrGLJfFb1lC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763111178, "uuid": "031f3849-54cb-45d6-a20e-037f7e48b587", "value": 165600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763111178, "uuid": "05366065-b5a0-4cf2-9970-de403f627e03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763111178, "uuid": "1c45ee74-f683-439b-96bf-9a8e7ce00801", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d376c1e-c163-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763129215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129215, "uuid": "9782a583-eaa6-4f96-8a2a-5d523534db13", "comment": "Malware payload", "value": "58819f15857409b0abbd622c8abd0679", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129215, "uuid": "5cdb0633-db66-4fda-8c78-290d1fa5393c", "comment": "Malware payload", "value": "9cf46c1c1fac81a70c13d481df342f3b3f0c9a5e46df5f9c751e614d0e199bc2", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129215, "uuid": "86743626-9b8c-4c05-b294-cf8dcc42326f", "comment": "Malware payload", "value": "85dcfe437ad3db0d5d7387840d18c4c2a4263031", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129215, "uuid": "6fc23ab6-c9fc-4443-8644-2ee8785ce628", "comment": "Malware payload", "value": "67d4d0b512a01e7725a6c09aa72a082d101a32f407d1686bc6d8ea1d96f64d0f8846243b5dd9365c9d0e24a4692ee98b", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129215, "uuid": "df3f4e0a-dfc6-4fbc-9af1-f0e1d9e4ce91", "value": "T1C945DDB884AD7CC5970C32406A6E3595102A3D17CA3CBC5CE58A0B217E7DE9BEB5439F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129215, "uuid": "abbb8645-96f6-4dae-b6a2-c419fc00861b", "value": "6144:vLX4EOwB2P+k26hwYXv9+qWuI7p5DTBSVXHb205cEDmrSsPoPrUqwgSVF9XO0PIL:+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763129215, "uuid": "d545e190-74fb-4597-a0b5-6590d8860b67", "value": 1243482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763129215, "uuid": "08e5afc1-b773-4ff9-aaf7-239b5b49e066", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129215, "uuid": "4b89b99f-d130-4fa3-a06e-7a62e268f2f5", "value": "blackburn.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1049547d-c12c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763105544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763105544, "uuid": "2f71e411-14f0-4730-b30d-3a35c26910a1", "comment": "Malware payload (Mirai)", "value": "9c584595bb4e1f3c00aab4e9d3b05794", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763105544, "uuid": "7fe47767-0e47-4b0c-b8af-5883934a224e", "comment": "Malware payload (Mirai)", "value": "9d443b5b4cae7c5c825cdd553697f6fa324ba3bd7756576759af6fdcc1322657", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763105544, "uuid": "9c69cf55-d969-49be-b188-82c21b903cb8", "comment": "Malware payload (Mirai)", "value": "71a6061e6a5cabcd58e44765f9d05174dd92ce87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763105544, "uuid": "d1ed36b0-ec18-4233-b8a1-05f48580b0d1", "comment": "Malware payload (Mirai)", "value": "2b285e9f492bd8d3f7a18d3dcaca3e5f7d7320aef9d3a2d06d6d77fcebb9bf0fdb3068b66915db8f7b1763ea54e5a704", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763105544, "uuid": "baab1389-cfb5-42d1-b040-fdedf5f87c02", "value": "T15DB2E132061A5E87DBF8BD799A51C68136370BF9E1DB3274302D0970724ADA63AF415F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763105544, "uuid": "1fc9b2b1-f492-431c-96d2-8156e4876e6e", "value": "384:oOJ9HOmpMIfWWNHmOduv9ykc9ggjM0yK7C4hymdGUop5hza:oipp7esHmygoka1s3Uoz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763105544, "uuid": "6da683a5-54a0-4aed-800b-0216d3c8b2a5", "value": 25696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763105544, "uuid": "0bba1226-65b4-4572-bca4-ec7750ff540d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763105544, "uuid": "d836d930-d558-4882-b6de-941836958fe8", "value": "wewe4.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec774327-c0ff-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763086586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763086586, "uuid": "4cf7fe0d-3390-474f-8925-f326e4f720fb", "comment": "Malware payload (Formbook)", "value": "5f0434759b304feb29fcdc576643b076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763086586, "uuid": "fa52baab-5d61-4595-a859-8f6aa0867ce1", "comment": "Malware payload (Formbook)", "value": "9d9d5763e3a3e02b4e14ea6f7a15ba7ec82ec9a61e51e65b4b7a2489ff01e563", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763086586, "uuid": "09518cce-e50a-4ade-b2c8-26255d098510", "comment": "Malware payload (Formbook)", "value": "0dbe525ea1118ba2342192c1b1c702161d88f93e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763086586, "uuid": "7be194b6-1ee1-4304-baa8-5aaed3721c73", "comment": "Malware payload (Formbook)", "value": "afde2f337b4717db35ab92c6dc33b63925a8bb45c64c12e8f71077325cab290014a0453bd579b616a508c18f7ba045e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763086586, "uuid": "cc0fd4ff-8f57-4b71-8126-622d3a0a374e", "value": "T17A45CF1273DEC361C3B25273BA16B701BE7F782506A5F96B2FD4093DE920162521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763086586, "uuid": "4a61480b-73b5-4696-a775-49110ba6be95", "value": "0f7552f9514e3a32a8dc8a5a9d9c89a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763086586, "uuid": "0ce3f332-be6b-4007-bc50-463b92013eaa", "value": "24576:Ftb20pkaCqT5TBWgNjVYv3FMdFRB92azR16A:2Vg5tjVYv1MdFRB0ar5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763086586, "uuid": "c81c8bae-f52b-4d8b-96f9-c7bfe796643c", "value": 1194496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763086586, "uuid": "d1564c03-a23a-4649-9354-6e66553d3fd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763086586, "uuid": "79a3ce10-ac55-4813-9e87-4cd273034b70", "value": "RFQ25101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a654d799-c137-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763110520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763110520, "uuid": "7c2f2974-d810-42de-b829-6058759b4dad", "comment": "Malware payload", "value": "119d9c0a655a057b57a25224d0c63750", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763110520, "uuid": "1a7d44c4-6067-4329-a5a5-b4c6a1fb4f42", "comment": "Malware payload", "value": "9e463fdbd996e5bbe34fb8ad93ee45258bee9afa36a817837b79c9e78e2b861a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763110520, "uuid": "96871605-e24f-4ea9-80ac-04f2a0944c7e", "comment": "Malware payload", "value": "038489b69a140fce7e021385dba2653b06070fe4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763110520, "uuid": "764111a1-1886-46a7-883f-9a7dabd7d6a9", "comment": "Malware payload", "value": "a20eaecbf9edcd2db86d4ab2dfcef96e63c06fdb8dfdb8ccb04c433bb5bc8a3827e58f6a7b43889d2ad95379a661873e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "npm", "colour": "#8A9171", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763110520, "uuid": "735a3400-bb58-4444-9605-ae1357c77efe", "value": "T1A8B4F2C80BD5A033DA6A6DB04E4DA487B13CCC7347495E02758C6AB8CFE1135D6E6AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763110520, "uuid": "63d12d74-cf3e-497f-b80f-72bc8420de94", "value": "1536:6LSKS3kUGUfA8XsjFaEr1b9eFW7mQM6wxYZfhKIgIxN6ZwEkmVcH9ZxLlVpUBY3W:GPFaErGtuZnZ3SwWh05y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763110520, "uuid": "ee9082ed-3311-4822-88c2-3154f9364b7a", "value": 532133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763110520, "uuid": "9bdc4069-16b4-490d-9025-e33df357432f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763110520, "uuid": "f891fb1a-11fd-4918-ab9e-7d3cb4801ad3", "value": "USY8zHODFcz2px0o.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aface42d-c16a-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1763132440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132440, "uuid": "e4e20802-cfce-408c-9b5e-942b1dcf0ee3", "comment": "Malware payload (XWorm)", "value": "575c437ca7e7be6a92c281f0ba0794c6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132440, "uuid": "b067a1a0-3eb5-4890-abf8-f3ee8793bae0", "comment": "Malware payload (XWorm)", "value": "9eee104aa1ddc7ab9a4a2e1a9f6020bd01d0f19bfcbeddbae332b1f9b4439c64", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132440, "uuid": "b5607de7-5aa1-4bb4-9e42-89c73d2b3326", "comment": "Malware payload (XWorm)", "value": "87f1474dba664a62b966f79cddcc6d6f08560de6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132440, "uuid": "cd2d7d8c-ae47-4bdc-ad70-8337bb25ea95", "comment": "Malware payload (XWorm)", "value": "5595795fb80c9137a640ad6f7139a82ea03ece1288470dae31c782438426f6c26389de811dabb40ca9a30dfcb62d7d7a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132440, "uuid": "c056ebfc-619b-48dd-9450-e7b3dd504728", "value": "T180046039F560A8C8C67EA665C1FEC8E513FA465E57633E78A8A13438C433DC54A2C8F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132440, "uuid": "7b14804a-a151-4340-a914-15184dd96446", "value": "3072:8orDZWkTIKg8IC5Khaz9cOyyiBMFhPTF6dFArrXl02QQPgNUUOrmO7VPb+dIE/tn:tDFIKLF5px6d+rrXl02QQPgNUUOrmO7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763132440, "uuid": "020e6c05-99d9-4a86-ae42-b12ecede528d", "value": 189938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763132440, "uuid": "29d693ec-4c71-4525-8736-cb924ebd299c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132440, "uuid": "1e4b5c77-ced5-4539-bb6f-09465ec823ce", "value": "AWB DHL 7214306201.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57eff8b-c144-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1763116210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763116210, "uuid": "552c45a7-79bf-4dbb-a091-598f3382b5dc", "comment": "Malware payload (AgentTesla)", "value": "da69ecd1274c5bdd72f8a816b2536144", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763116210, "uuid": "1b4f3b26-852e-4597-bb77-861ca45591ad", "comment": "Malware payload (AgentTesla)", "value": "9fdc549141860e8bfbe34ab5c9e647b24ff1f6df0c73009da8a9ff99dd385a57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763116210, "uuid": "bdb60b9b-0c94-4ca8-b691-98437b01e470", "comment": "Malware payload (AgentTesla)", "value": "3ba7d810f1d3ce15d72d43ec18a950d95b763f5b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763116210, "uuid": "3972ad07-455b-44c0-95e4-24b17ea147da", "comment": "Malware payload (AgentTesla)", "value": "f9cbab0f014d9b3864b88bcc759f0ef8d65b501f9d93d34651b6becf6790297d05246c01fdafab935ec7cb2800ebd8fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763116210, "uuid": "4d8fa65b-b01e-4632-9a51-d9cbf29ae409", "value": "T104154B70DD38066A4F97179EFD920B52CAFDC60A173611F5E6DA030D62068ECD3BE668", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763116210, "uuid": "268b2ec2-e4d5-44bb-8742-6932387e98d0", "value": "6144:lFzOzXVvs6zhz7z4JJzZsnLzXRjzfzX7jzX7zXCz1zgzX3pzQzUzyRzhFzXsfozW:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763116210, "uuid": "5bc528ce-c004-4c7b-aae3-8816d613d085", "value": 916690, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763116210, "uuid": "75e81de6-a4d8-4ac1-befd-0277092eeb3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763116210, "uuid": "086e315e-fa26-4295-9500-2e3d6eec9f92", "value": "2025-11-14-0822_001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81720bda-c13d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763113035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763113035, "uuid": "21983181-c340-4887-88d5-9d3b22b7671c", "comment": "Malware payload", "value": "46dcf15fde4b9b597f5f4e4c5b6793b5", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763113035, "uuid": "4f055136-4247-4ceb-8c52-2afb5e9d0464", "comment": "Malware payload", "value": "a18fc2b9805de0f27aa71a18292f9dbb20c21699991b8da74e57a1bf13101c85", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763113035, "uuid": "64f19e04-d3a6-42e8-9010-05e80c3b233e", "comment": "Malware payload", "value": "df6f87fe0f811e0a4ed6869b4e42b880fa489acc", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763113035, "uuid": "edf27add-9cc0-42bc-ac2e-08af3f7dab55", "comment": "Malware payload", "value": "aac92caf1df0ba92124aed528feac11d4fe2d0e3298d6ef80942493af60ea9c396ec720fbb0504b47934fa5cd51e0362", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763113035, "uuid": "535aa7c5-9fbd-4aa4-b80c-962384bf92eb", "value": "T1B311BD4EF865453606F608DB0D252898A7DFC1DEA360D19FAA3C24F0875C6478577CD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763113035, "uuid": "7649f8d3-a09d-44de-acb3-5501712668d1", "value": "24:5mUGm9Lf2bbd4oczVn2DOIRH/yATLKwxUb/yAVgL91opbwO+Q8aIq:5fGmqDcdCOhhHQrdaIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763113035, "uuid": "11f09ac9-bb82-422b-9eba-bee6b4946f90", "value": 941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763113035, "uuid": "4ccd6a4f-c324-43ca-b31f-b64682fab32b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763113035, "uuid": "90c99608-29ad-448f-9298-a9c9c9602f20", "value": "Company_Portal_Windows_Setup.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83b88f3d-c195-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763150835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150835, "uuid": "e6b50489-bcd3-4362-8087-e08ff28bd184", "comment": "Malware payload (Mirai)", "value": "e52e859c22a0478182500379d301fd77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150835, "uuid": "0da9bba9-8d8d-447c-97d5-30bd87e98195", "comment": "Malware payload (Mirai)", "value": "a1cbc4b0188f1476ed7c316842583952b48c0069473d00b1b212fac91764450f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150835, "uuid": "e26f9cc0-f60b-4583-96c0-d0be05170f12", "comment": "Malware payload (Mirai)", "value": "bcdbee43a903a69309c135056326c60178c745b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150835, "uuid": "73c3afb2-144e-4def-bbd6-42d5d3e76f37", "comment": "Malware payload (Mirai)", "value": "370603e759be0349af44891d17454bcc22487c65cde6f7623bfdf815290638f8539e2df78cc1d9129143eb9109f01c27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763150835, "uuid": "e9ff4de0-82b7-4f3d-bf93-d749dbd59866", "value": "T1C2A3BF33E82A5C94C1850178F4E69F361B73F5C046571EF726EAC6A6504BEA8F50ABF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763150835, "uuid": "e63c7478-4ded-481f-bcb7-cfff6b4cbffd", "value": "1536:G/zx6FX2zJtM00H/LzCoYv2+1KSrhY7wxLQlCmvuV8S8WcU:G7x6REAH/LYu+cS2oLQllM38v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763150835, "uuid": "6e851db9-f14c-4060-95c7-1457c2eb30f5", "value": 103972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763150835, "uuid": "e7b03bbb-1fcf-447f-8c8b-093a360113bf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763150835, "uuid": "3f8be2e0-b056-490e-95d2-e560aeb9a8ce", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0cf86f3-c0ff-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763086566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763086566, "uuid": "a8c9d882-0026-4cc0-8ba3-9edbfedfa87a", "comment": "Malware payload (Formbook)", "value": "0384a7d1cd538445271c4940818a7b7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763086566, "uuid": "0f077e14-7e9a-4290-a791-ecc369f32c7b", "comment": "Malware payload (Formbook)", "value": "a261dd696014b1ee8348bef04980efda5d762a6563a08c0256d5f09fec1a8cd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763086566, "uuid": "d132d76f-24fe-47bc-ac96-b5a8b47b1f3d", "comment": "Malware payload (Formbook)", "value": "3e73abb05b65b135b104fdfd8a3e3112b214d863", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763086566, "uuid": "2915794e-035d-4dc3-9a80-06eac7e63668", "comment": "Malware payload (Formbook)", "value": "b738b6ed6112847d5a4a0e6576e2b07756c81490f86060c3cc327c2922faec7cdada84f3beeecaff4e4009643871463a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763086566, "uuid": "5c6946a8-9d06-4028-8978-ca63016a55e6", "value": "T1F6E422C064C4CC76EBA0B335807F8EC52726BA72CDCA2B6E6399F0577871247945276E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763086566, "uuid": "c628495f-ff35-46b6-bfff-d088eb64472c", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763086566, "uuid": "5e4dcd10-87ad-4f9a-946b-31c1281f4fd7", "value": "12288:xOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiwce+x48ZMJAgFRa/v092azLP:xq5TfcdHj4fmbVMFMdFRB92azr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763086566, "uuid": "edd318f3-f3ab-4865-9cf5-388639c8fd46", "value": 709120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763086566, "uuid": "580bf008-2b6a-4b28-a07a-d6e5ca7f0285", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763086566, "uuid": "2e8a5fb1-daa7-4f59-99a5-5807526ffd1f", "value": "RFQ25101.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "188091f5-c17e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763140776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763140776, "uuid": "9e1f3af7-e8b4-4e21-9a8f-67025f9fe6ee", "comment": "Malware payload", "value": "eee876b008cc6a02ddde922df21c444d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763140776, "uuid": "7b3d78f4-ff0a-44bd-939e-f950ea21c14d", "comment": "Malware payload", "value": "a34e11c2f4efe61f499b0a7e6968bd55b4c2fdfa72ffcd800c169f45b84c9ca9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763140776, "uuid": "c6b65952-b7d3-4fd6-b124-8903e789f967", "comment": "Malware payload", "value": "32e241d5e10ce57826d849c4a2d241ece248a351", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763140776, "uuid": "e79be5da-1641-4b56-a73d-062714dfcad0", "comment": "Malware payload", "value": "e1e3f60de203541f2d13342135b30dd06c0c581e861b13c930165cc1c48b472280f0215d2b1048acca71bce1eaec73ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763140776, "uuid": "484a6a36-d902-4deb-a7ab-e67eeecbd463", "value": "T1F832F981B2A85CF9D37D807A82D68EA6E1FE70112762CFCF0974C2690B53ED5653B741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763140776, "uuid": "a14068b5-fb62-4120-926d-f0b5df03adad", "value": "3b500a66ffd4a01bb4fb3e7e4b8227eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763140776, "uuid": "ac701400-e611-432e-b55b-3a32b36e30f7", "value": "96:hMe2ObB3yOZUuHKzK2AkFoG8kBQUW80pzmDP7w1vSHWj7T8GUFXqjgwcx2ksD6M:ht2ObB3QuqKAuUWmXKvYcH3gvIkY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763140776, "uuid": "b4cdefe2-dddf-4ccd-8615-88fb2877c42e", "value": 11264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763140776, "uuid": "e3942959-a4e5-4dc1-9668-8eb406fa2e5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763140776, "uuid": "272b01b2-2b55-46a1-8c14-7202746def92", "value": "SecuriteInfo.com.W64.GameHack_AGen.BC.tr.16640.11370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a101562-c191-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763148940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148940, "uuid": "83c08651-ecba-4afc-81ac-a46ac35377be", "comment": "Malware payload (Mirai)", "value": "c080122eae9226bcabfd36b30cc2835b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148940, "uuid": "a9219b16-cfb1-4cb6-8dcb-53061cac8d13", "comment": "Malware payload (Mirai)", "value": "a9f9fdbbef5b381ff23048e5b05f479f39051a6b3f19a90571aecdefd82c16d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148940, "uuid": "c0b78b81-1c44-42c7-b052-36d869dd6d45", "comment": "Malware payload (Mirai)", "value": "f0f1dcc47f9c8c19e0189e80bf4d05469235731e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148940, "uuid": "0c63167d-7b15-4068-aa5d-01434babb8fb", "comment": "Malware payload (Mirai)", "value": "f1ad22a16e0bfa4f976fc69e367418a655b6f81844dc470173d9f75fd453ee18d6fa348c68766bf10c00a342d1988c57", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763148940, "uuid": "f453b307-dc5f-4813-8403-e09c2431b447", "value": "T135732A02731C0E43D5B7ADB4263F27E083BFE59120F4BA85651E9B4A9375E325186FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763148940, "uuid": "d324b839-cdf6-4d4f-aede-5a8da7c95588", "value": "1536:GILqfdys9YLIBLHyGxIRZ7MU1DJhEjKZ3/q0gU2:GAidyqJByd7vJlyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763148940, "uuid": "2859ba92-fe33-44ca-815a-07f6c5f9e971", "value": 80344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763148940, "uuid": "220f505d-70ed-4299-87d8-f85e87021299", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763148940, "uuid": "c5ccf15e-8384-4b96-a32b-ca138aa8b9f6", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a15ba0a3-c152-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1763122108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122108, "uuid": "f5613530-5a26-4244-8d73-4b9a8e3608fc", "comment": "Malware payload (XWorm)", "value": "91fec493f4260243d40d17348a170a7a", "object_relation": "md5", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot8024716497", "colour": "#C22CC5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122108, "uuid": "c8594fa0-224d-44f8-9907-98534b15815a", "comment": "Malware payload (XWorm)", "value": "aa37d4cb1ee722cdb86919c4ae6258a193feefce91307e7b94211dee11312bcf", "object_relation": "sha256", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot8024716497", "colour": "#C22CC5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122108, "uuid": "ba37ecac-bdbd-4ea8-9bb9-bf46007151c3", "comment": "Malware payload (XWorm)", "value": "4b4cd0b9f70f61cf43ee977fa8e0759596a436ca", "object_relation": "sha1", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot8024716497", "colour": "#C22CC5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122108, "uuid": "9f8e7c2e-fbb4-488d-b50e-aef4e19aae9b", "comment": "Malware payload (XWorm)", "value": "d098352e72af08410c7a16bcd10153ec0d75f4fa3e5de9bd5147db9fb8c969d588a8636b064ff21faed912cc187dbf06", "object_relation": "sha3-384", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot8024716497", "colour": "#C22CC5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122108, "uuid": "5f47cf86-79ef-457f-a420-aabdfa555b89", "value": "T1938302BEEF66F15016D99EC880A0BFF1AE7281665BE984CA171ED07B54078F574102CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122108, "uuid": "c8618c47-b201-490e-885b-6cd97d6c688f", "value": "1536:Io2Ig1UvY4MpATFCKOqkaSbDgl4uChBQ8i3XRumxhK/w7Cl5rTSxxg:Io2d1tP6CKO3YQQ77bZ7CvSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763122108, "uuid": "b1fb8a3a-a9cb-412a-97ff-980f7d38251f", "value": 82535, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763122108, "uuid": "41908bd4-c30e-4ae2-9742-7598907b6bfc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122108, "uuid": "1829f58d-2041-4648-8498-1202ef1e31f4", "value": "PURCHAE_ORDER#77021(2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a0cf8d6-c188-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763145047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763145047, "uuid": "23689ba7-306e-477d-9d01-92142152e4f3", "comment": "Malware payload (Mirai)", "value": "8a2cdc37f59f7979b79d52b399461833", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763145047, "uuid": "1c46ae3e-326f-4067-bea9-7ae788f26c4c", "comment": "Malware payload (Mirai)", "value": "aa8957d62054a2ec5f3f8306f37230e79830aca7dfc26859dcd1c5496079ab23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763145047, "uuid": "7f81349f-22ff-4330-9451-2ea608a5c4f5", "comment": "Malware payload (Mirai)", "value": "2c1f5f2f8ad00dc61fc1e909c8102ecbc9f3b428", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763145047, "uuid": "d86340d1-dfaf-4ed2-934f-7997cdaa646c", "comment": "Malware payload (Mirai)", "value": "8687e6daf74f9c7381ec5f91a84beb51a98f20c64c373f167820f905f864326543b2e40bde9210e1539bac4611edbbc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763145047, "uuid": "826406ce-d0e9-4df7-b4fa-6021f01204bd", "value": "T12F934BE2FC02EE7EF84FD77B44570D19B630A3A125931E3573A3BA17A8351994863E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763145047, "uuid": "00999b8c-9ad1-43f7-9993-436859bb85fa", "value": "1536:TO6T+MTF9Kt4xj2mrbO8iJynaUZ2CQKmLMg5G744keh3TneVGyQ:K6aMTTAGj2mrbWynaUXm44Ah3TneVGyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763145047, "uuid": "e58d4d4c-5cfe-4566-857d-58f10f792f8b", "value": 92116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763145047, "uuid": "e586edda-3a6c-4a92-b3f7-c4bb556c8ee1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763145047, "uuid": "fe86604c-1e08-4356-8ae1-ed24242b8683", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7f360d0-c187-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763144963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144963, "uuid": "f087eab7-f74d-4dde-b790-06c625c5ce82", "comment": "Malware payload (Mirai)", "value": "e7f452833ac89e9d3377a32e0f9fff16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144963, "uuid": "4236f395-75d0-42c0-80b3-d1162ab5cc0e", "comment": "Malware payload (Mirai)", "value": "aa90ac528db92866a41a320ab61acfbb2b2c66e4dfca2844dd0f19cff5f4657b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144963, "uuid": "2a035f2d-8d7c-4aaa-a409-3167524ddd3d", "comment": "Malware payload (Mirai)", "value": "3f2c30af55b39e80016b52e8f728655db3454f83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144963, "uuid": "92bce355-a771-45ca-b006-47288774460b", "comment": "Malware payload (Mirai)", "value": "0bc40b01570e22d37bab5403bbb5ca21c2a2a072cc345641582d4f218ddaeaaf1b7153bc5c3686b1c19c48f3b4a1fe92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144963, "uuid": "d259d2a1-311f-4395-9ad9-b542bc4d7655", "value": "T1412309C4F443DEF9EC5A09B01036FB369BB3F6BB2228DA43D7A595226C41741E845DAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144963, "uuid": "fa43d384-73a6-4bb0-aae6-c0eec83ca42d", "value": "1536:Ufndw1GYx7ktO68NcP16tveXAGbV0/uffwXOP2op:8+1GYx7ktO68NctM8zu/Afweuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763144963, "uuid": "285feb0f-6ead-4f0f-ad83-601a1b71d3d7", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763144963, "uuid": "8e8069b9-60e2-4777-bd76-972b0e328234", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144963, "uuid": "fcbd6c7c-551a-44f9-8124-0415bbd84e59", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c027deae-c177-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763138051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763138051, "uuid": "1b0da62e-e755-49fa-b482-693adf18f06e", "comment": "Malware payload (QuasarRAT)", "value": "6c767e116697e42d25fae3001257277b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763138051, "uuid": "ddc5af7f-7b4f-407d-b79f-8b0c9e83916f", "comment": "Malware payload (QuasarRAT)", "value": "ab8169f1d856ca628a54ce250ec07c7c59690af8539b2c525356ee3beac9014c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763138051, "uuid": "4ad99bc1-d2cc-4fb6-a748-2aa2cf860971", "comment": "Malware payload (QuasarRAT)", "value": "a95d77c84513c0641140ab18f076ff9bc75476c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763138051, "uuid": "da282b8d-53c7-4a45-9848-a15954041eb4", "comment": "Malware payload (QuasarRAT)", "value": "b6318508e9ac9679e437e1a5884f2ab710a1c91a2ba05c9f61b40249ffd0c8169573c7a4a5deb16a3b489e48843baf99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763138051, "uuid": "650530d7-3119-40b1-ae05-a1e5b84d8d61", "value": "T1A2E56B143BF85E27E1BBE277E5B0041267F0FC1AB363EB0B6581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763138051, "uuid": "2efaae62-c6ee-40c3-946a-63e44c829248", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763138051, "uuid": "8acb5a48-d456-41e6-a584-2e18853bcace", "value": "49152:SvIt62XlaSFNWPjljiFa2RoUYIKwRJ6tbR3LoGdCcu2THHB72eh2NT:SvE62XlaSFNWPjljiFXRoUYIKwRJ6/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763138051, "uuid": "9ce0d0d9-41b8-43be-8b4f-ea3ae1fdc738", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763138051, "uuid": "1735a8a9-476b-4b5f-a298-40ddec0b1c3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763138051, "uuid": "048752be-0c27-41e5-931c-4dff61bf1a89", "value": "Archer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a63e6459-c166-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763130706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763130706, "uuid": "272e4867-dc35-490a-b2ab-9d1d55a819c3", "comment": "Malware payload (Formbook)", "value": "d1f5f8a4f394a3718bbd180f6e776488", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763130706, "uuid": "a42a6df0-049b-4995-aef5-e7d21c0aa725", "comment": "Malware payload (Formbook)", "value": "addf82deec14fc01840f30e639e4baec20c7fbcbd5404d1429846ccb8fb056f6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763130706, "uuid": "de5713c2-b18c-4c66-b04d-346aed459ce8", "comment": "Malware payload (Formbook)", "value": "ae3d08725949ea5443d6a1c55f1fe19ea0cd3e80", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763130706, "uuid": "308f09bb-77bb-4aac-8cf5-a7740d890e80", "comment": "Malware payload (Formbook)", "value": "423c36790e2d03d5a557e11e054b200b3da8dca9c0c893fc1b67e3923a67981f8fa43b29f41a23efa504f5ec564076f2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763130706, "uuid": "67c3f100-5ffc-4645-8ee5-eff5e00c04a3", "value": "T1FBE423C20C4AB975F372F06EC8CD9708B31693C999B5286D3253A8C7F4D5E2C9921DDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763130706, "uuid": "823076c5-b919-4e07-b9df-c7d1cf53d210", "value": "12288:oQafDSfRgTqttzaBBEKDPx8Eu0BO+0AXwl48zGJAgDRQlvK52azF5:lafutrKDPuEG+0Agl3GdDRn52azj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763130706, "uuid": "8ab78eb4-56ec-4ae4-bd31-ca8dfc3f031e", "value": 684349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763130706, "uuid": "fe7ab8a2-3c5d-4f28-b183-17af6305cd57", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763130706, "uuid": "5831b469-09f8-43b0-ba94-ed5c9716fb7b", "value": "RFQ25101.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20ce2bef-c169-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763131771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131771, "uuid": "19f2e929-253a-4fd2-a1cb-f72c9079b4b7", "comment": "Malware payload (Mirai)", "value": "c3de7ddb075bd6e5af7c96998359229b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131771, "uuid": "0fdb3525-ffa9-44e0-9134-25a6ded5eba6", "comment": "Malware payload (Mirai)", "value": "ae614a16f3ff3402122dea17e0909d4461c3e15115dd757e291d472db7a6fe6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131771, "uuid": "798d8543-6cb5-4c54-ac8d-1306e7bce63a", "comment": "Malware payload (Mirai)", "value": "a6bd5d1591d8800ebb03bdeb3ba46504b6bd2721", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131771, "uuid": "f61ad8e7-0f3e-43b9-b6e1-477a570a7428", "comment": "Malware payload (Mirai)", "value": "8a1fb69d3867fbab5fdd98ac0dd1984a4148f80fbae1363fc4cde01addda8618611efe31a91adc2eb0b5cff081f3dc8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131771, "uuid": "28f4469f-2a6b-4db4-a67d-cd556787fd1a", "value": "T170B3F80E7E219FBDF66CC63547B74B20976933D623F19684D26CE9005E6038E642FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131771, "uuid": "22b1154c-69fd-4e0c-b388-fa649aa531ea", "value": "1536:x9Y1nyynLdfUI1IglOMVR/pOuFgRZZIg2I0HlUwDSsj0Q36KNQnVRQ6WIee5hBwi:coEpYyg2I0hSsj0KQ7Q6W+5hBwi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763131771, "uuid": "9a00045d-7deb-480e-84cb-dec73a6da912", "value": 113696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763131771, "uuid": "ba7118d7-e0fe-4bb1-b2dc-be77832ba045", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131771, "uuid": "7e6d3e66-4fbb-4c70-94cd-4d82e7211078", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10451214-c169-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763131743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131743, "uuid": "501212a6-a745-41a6-891c-f7e712039571", "comment": "Malware payload (Mirai)", "value": "b9a12b53bdf4194d0bd675088679ba45", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131743, "uuid": "00984c20-7bee-425a-866d-58e5e9a77789", "comment": "Malware payload (Mirai)", "value": "af73b4b938bdd0840e00a70e6ffd1004d560648e0bc69a4a45b930dfd9e4fd3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131743, "uuid": "cc3c902e-5234-4e18-9432-d96224df206b", "comment": "Malware payload (Mirai)", "value": "f11a6567cdd4c890bff31ce67a55d498ce3a19a9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131743, "uuid": "8005f280-b871-4e4c-b96d-1bdc6957fab1", "comment": "Malware payload (Mirai)", "value": "15bb3ac12201a1881af8f25f17575fa9ea66492170aacec9539a9a008d9b73009df51f62c57d623dd44c379977337300", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131743, "uuid": "6a2fc632-9714-4563-9ab5-78e8b60964bf", "value": "T17613F1FE6A126C8FCAFC857D06D417B3BA620297204685063FD9A9C7DE02170B5937E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131743, "uuid": "2a616333-7e62-4f8e-b465-c0dcc23753b8", "value": "768:IFPxA7m0L7+gVSJSqu0DZtVKlkfu6XZBFEBQclLS35avnOOKEcdIJgGlzDpbuR1g:CP2i0L7+gV8SADZtVNtXZrEucggOOUdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763131743, "uuid": "add95b52-2537-4b04-97ef-1dda8474f156", "value": 43676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763131743, "uuid": "1b4ad792-83ca-475f-934c-bfc131dbd8fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131743, "uuid": "fdb7ce16-ee60-4cf8-86ff-0f8cb8ff0294", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7cb579d-c192-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763149741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763149741, "uuid": "2a02d572-ac91-4006-b2fe-46747f36ff8d", "comment": "Malware payload", "value": "15fc6280ba7bbd3f0c4e39dc75c8791a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763149741, "uuid": "c8a5f8af-e390-4d16-9d21-e14253a54867", "comment": "Malware payload", "value": "b0a2b9fdee589dab85194fd681620cb5fe0148348600e9072df011ab4f5eed28", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763149741, "uuid": "5b437ff7-e2f5-4d8b-9484-ebed3c4ad78a", "comment": "Malware payload", "value": "3a2cdc922ed31cb35f93839cbb3978ae53361be0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763149741, "uuid": "133c7111-446a-40dd-8ab7-aafc06dbc7d4", "comment": "Malware payload", "value": "e401940261302c1cef0427441fe1586ef7ae5d69495bc717f0b3f71e0175b6ceb0bfd9b036eb69cb8ed1f7683f95107e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763149741, "uuid": "10078056-ce7d-441c-8b2a-ce5c16c6751d", "value": "T161042B05EA408B53C09227BAFADF435533339B54A7EB73059928ABB43FC679D4F22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763149741, "uuid": "fa2e9f1b-72c9-411a-8283-ae84356e2d6f", "value": "3072:t80BCufhaSzab1PfU6aDAw+3ZfSmBhLawM/RbzzuKXS:tH7ZaSzab1PfUr6ZfSYBawM/RbzzuYS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763149741, "uuid": "408468e7-17cf-4e1a-90bf-7ee4d35ce38b", "value": 180595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763149741, "uuid": "8d3edaf0-1804-4047-a5e4-8722690c83fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763149741, "uuid": "aca37790-9077-4bd2-9b25-189772b7e329", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389a82fb-c17a-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1763139112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139112, "uuid": "27d5964b-9eb3-476b-92ee-cabc64494c30", "comment": "Malware payload (RedLineStealer)", "value": "7f09f2e1f5c20d70a9481ceb01968fd6", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139112, "uuid": "cfab8c76-446e-4c52-b13d-a161c921b5f8", "comment": "Malware payload (RedLineStealer)", "value": "b16245bd3a4eb3290200221ee20b2d4b425b7a2a6f49878059d01b807992379b", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139112, "uuid": "961d9b9c-6aaa-44a5-b40d-0e89fc70c390", "comment": "Malware payload (RedLineStealer)", "value": "a76720779dec7314c93d6262b24b1f288600ba42", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139112, "uuid": "33092de3-839b-4900-a625-528890d8b5f3", "comment": "Malware payload (RedLineStealer)", "value": "af18c515a76c192aef819a49c575e256d4fef85224600d042f563a932dda5121d2594d4ed5b5786556a5fd5b79be9f8d", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139112, "uuid": "7fb44e84-26b5-445e-9d9f-e01d8b242396", "value": "T1F6E4235BDCD6D36E7C07EDDA854E02B30E5D384AA5ED2ACA0045FD76826FF2D0854CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139112, "uuid": "38d98c0e-bb4a-46e1-8e25-a0a6d27b7aea", "value": "12288:Wncv51z2VU7Eh1/TL+qbThFNahzD48eFjMIYedr0DrjaVbOCvqGK2zVlHuJgDWw2:hvUh1YJD486jW24/jaVbOMqG3zfHugSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763139112, "uuid": "46d2120b-369d-47c1-944d-9449381a7c57", "value": 660024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763139112, "uuid": "c94018df-b9f9-4714-99ca-779b1bcea042", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139112, "uuid": "0c7b4a5a-99cc-47e2-8cfc-96a083492a35", "value": "Purchase Inquiry_KPCPU-2830.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dba7eb8a-c12e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763106744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763106744, "uuid": "2bf1447f-bc5c-4688-ab35-8e32db1a7704", "comment": "Malware payload (Mirai)", "value": "2443570a9b0070bb3e3e690a200fa6f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763106744, "uuid": "6ffe0b15-3c71-44c9-a7bf-2a505f70ac9d", "comment": "Malware payload (Mirai)", "value": "b1da7c9cf473f49fe948841e6d3ab3720f518dda6f24fa8fd6eb0aea84afa3a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763106744, "uuid": "30645051-2dc6-48f5-b06d-2882e999c934", "comment": "Malware payload (Mirai)", "value": "22df92996a88f13f6b9015cc26763b506ff289c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763106744, "uuid": "f17e27a3-2f35-4301-b8f6-4080c0e116c7", "comment": "Malware payload (Mirai)", "value": "0a23079c60432739c2c40b0343bfb83c80cbbbd7d1f3160be1b2a5bf07efa6487a9cfe3d58a7bedc5d00c8ea221df6e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763106744, "uuid": "3b5ccb0b-3a63-472e-83ef-d3d7f594a7e1", "value": "T1A753195AB8C19B15D9C112BAFE4E128E7323176CE3DE73139D246B20778B56B0E3B416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763106744, "uuid": "8652c71e-9d7a-48e4-991a-fc1c5af0e54c", "value": "1536:ZAnFmcfzVvsapDu+BMwiBA8oGeJhrs5AY7j:wfaa8A8oGerrsKQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763106744, "uuid": "ba3fba3d-a3b5-415b-9e0e-a0b250e8853c", "value": 62812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763106744, "uuid": "ec5161e9-1579-4e65-b6f3-b547f31b4bfc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763106744, "uuid": "e7bcdf5a-3fd5-4de2-8805-87bc50474771", "value": "wewe6.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88680b4c-c127-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763103598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103598, "uuid": "dd5ba850-6a4a-43dd-8dc4-a52126f7af77", "comment": "Malware payload", "value": "f980c222c6f1dc8ce9a0cf61bbb63ada", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103598, "uuid": "160e1517-9419-47ed-be77-9fb54a098e6c", "comment": "Malware payload", "value": "b3847b260a2ffcd1634e41eed6c3e38223c580bca61c26486056ab154919b506", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103598, "uuid": "69ed2d54-5a18-46b0-ab27-afef4e41100a", "comment": "Malware payload", "value": "e93e9c82ac16015a02046dc363a067d062128bb6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103598, "uuid": "60829a53-d640-4b67-b239-0b8e6b3df4a7", "comment": "Malware payload", "value": "05f501f9434343dc1579eb932afed0286b1f97b42cd6f0522f36a56f07312442c1cb347aa0e2f58b7363ef24f56da37d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103598, "uuid": "67d44881-2d72-4f9d-b98b-0dce4d2408fc", "value": "T1CD27234BEE48C96AECF65339FE32032734225E984703C17BA1A5F63D3E732C64A95591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103598, "uuid": "7cff3320-5a3b-4ffa-9ffe-335f5b140b40", "value": "393216:3J0msTO2aCAbtHdMqPXKrOa8BDmy/rpgVsji4U64Jvako6A:3JKTOqEpP0y/1ji434xhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763103598, "uuid": "a8610a9b-ed28-41da-862f-d551040543bf", "value": 21267251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763103598, "uuid": "25cc230b-9b74-4118-b990-2f14512aabf1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103598, "uuid": "a18d7f35-e10b-4d70-b664-c9db9ee7b0b9", "value": "TV-Garden_Ver_12.03.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8083d85-c135-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1763109664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109664, "uuid": "540d4090-7a21-4866-ba6e-21c520defd02", "comment": "Malware payload (AsyncRAT)", "value": "50408cc8b410ea49b8cc811d8f5dc601", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109664, "uuid": "90a60965-dadf-45a7-aadf-6b96d6409cd3", "comment": "Malware payload (AsyncRAT)", "value": "b3be15b1b01e66056b89228e21a9958aded4cf449b1333aae7a66d7ad731466c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109664, "uuid": "9e6f0cc1-0e4b-4729-89cf-dab94914e7b2", "comment": "Malware payload (AsyncRAT)", "value": "f32cfed1bc24471d102ecd7eb07876fb9caaa238", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109664, "uuid": "458d8df5-3b07-4203-8865-72479bf18e13", "comment": "Malware payload (AsyncRAT)", "value": "da2852caa93e75098d4e81d7e84ce8e1de0e9669dda834c0640aaeb3999d7b930123b938ebeda5024919d96da7df5cde", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109664, "uuid": "b8c6a529-5f4d-483a-99d7-14fb5f1c2e9e", "value": "T1BC8423F3EF2D6B2980E25776777DE43474E8785026AA4161FECF7285F8048840FE095A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109664, "uuid": "04c2b963-2535-47a2-ae17-5e4f3b1c608f", "value": "6144:o/1ufa50hBY5EiIpv/3lSb3QM8prm3EzUkHC/NtdhQGviyrFQoYrHQXxt5:ot+aUBYCt5V6QbqoiFtUGaUzYLW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763109664, "uuid": "9be4edfd-c7f9-48ff-851a-322171df81b3", "value": 396801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763109664, "uuid": "b5fde8eb-ff89-4e21-ba9f-b8955208f46d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109664, "uuid": "860eba7c-3c77-4603-88d9-0324b3d3be3e", "value": "Acknowledge New purchase order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd4a0fe-c127-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763103580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103580, "uuid": "27399017-af9a-402a-86ed-471528751a98", "comment": "Malware payload", "value": "001de2df69d8ddb9bcff6df943299718", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103580, "uuid": "04befe6d-e4bf-4355-bd1e-4ee5541e1943", "comment": "Malware payload", "value": "b4f9bbfba9d235142d89fdf3c38e8d73090e672224c97f101f876e0036480f6f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103580, "uuid": "b4f7bb50-594b-46d1-aa70-40c7f3b80d4a", "comment": "Malware payload", "value": "d5f9def7e633984d02ec1fe9d30f32780e1bdb4d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103580, "uuid": "b24a312d-9ff3-4005-a7bb-78e4d319c66e", "comment": "Malware payload", "value": "3db4e624adb18c44bcb3d07bf2e148e113fa999870b62ac30aa693775edfd4869f15770575708e5f2c50c79b168898bd", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103580, "uuid": "5b3b4f7f-6bcb-4eda-8af6-b94b13b33f14", "value": "T1AC561243F74598BEC0F64232457A46A24167DC268E83C7836A5D723CAC7B9C85F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103580, "uuid": "6cad45e8-e6f1-488a-9099-c3a1348ea38e", "value": "98304:vjBaMtDVjAur3qyONKCFH4/6sf8Ky3ve7u3jCn0QaCVBM8LeYGOxbY:VaeVjtCJq98LqoCZbM8LefOxbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763103580, "uuid": "1d81831a-c82b-42e7-bdf4-5d1ca5f2d3e1", "value": 5979631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763103580, "uuid": "3fdebcbb-184c-4a04-b55c-b56c74cb644e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103580, "uuid": "9e405db7-0f22-4654-a9b1-125972f0889c", "value": "Onsko Wznawia\u0107.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92905740-c106-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763089442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763089442, "uuid": "e6736d9f-2fd6-4477-9aba-d0955af41b06", "comment": "Malware payload (Mirai)", "value": "8c79f1fe64025b96123486934cf7b342", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763089442, "uuid": "abcf3b63-0852-4b4b-b49e-d12c94f20566", "comment": "Malware payload (Mirai)", "value": "b531116efc96a8a5427be1e539665488e6be457266733ffcba34851c32a83fcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763089442, "uuid": "3df72771-edbf-4d88-82c7-e006ec31f461", "comment": "Malware payload (Mirai)", "value": "1b1b0fa4efc8cdc8e3bd20df98b77217c774cc8a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763089442, "uuid": "34beed4d-88af-4440-a8da-f33dd1d83ed9", "comment": "Malware payload (Mirai)", "value": "a23ff5aa58aefc60f615daf2032cf0f7311b9065d6ee7aa75b8f7e7c1c75e9ba9822c7cd59d6c71de0133e213c672a62", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763089442, "uuid": "da75d8c5-3e7e-4b63-bc79-6afdf4364cde", "value": "T11EB39CDBF24701A0C8624AF007CB4BED3E2723815F27C5E72C6A657969791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763089442, "uuid": "d3077028-7e96-41ea-93c1-c2288e0b5c47", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1K/LWy:c9sSyzz36YaWWgg1Kq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763089442, "uuid": "a41cd91b-8555-4fb1-a52a-11f1b8fa5be2", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763089442, "uuid": "0935bc51-f3f9-450f-815e-eac21213613e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763089442, "uuid": "f0b18be4-ee2f-4158-a4c2-68061f58778e", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a157c7-c0f1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763080370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763080370, "uuid": "3b3b00ce-a076-44f8-b7cf-83920b1ca34a", "comment": "Malware payload (Mirai)", "value": "fa6e21ffd1cae76a785d34f7640a2a60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763080370, "uuid": "37edd2d7-31b6-4012-90a2-d019cf05cee5", "comment": "Malware payload (Mirai)", "value": "b5f97c4c0ff408de365da6735bf940d1a6a7f7465be68509db8e313f3dcf174f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763080370, "uuid": "e367c8ed-b9ab-4fea-93b8-fc78ad1c7ab0", "comment": "Malware payload (Mirai)", "value": "9433f655555de68693e58b9e7f24990c5117896a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763080370, "uuid": "5b4f3107-af2b-4511-80b8-f64dcf8d411e", "comment": "Malware payload (Mirai)", "value": "04e378ef8f67cd49223e32ff99a4784ec2263517ff802e668e61e23ca765efc3658161b37426921f5a986b14809fb071", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763080370, "uuid": "d48edacb-3c7a-4e86-bca7-98b7fcbf7e6a", "value": "T1D4D30846BC519F13C6C612B7FB5E438D772A17A8D3EE720399256F24378B85B0E36242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763080370, "uuid": "56754f82-2273-47fa-9e81-cd44f1a2ae43", "value": "1536:Hg4MnNF54p8sMCI4tKV2wqET4VRp/+biHz7Ol3jwywXIkTaOl2uF79BHV90TOsQ1:A4QnsMrUKVz4B2mTDaA759QtIFz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763080370, "uuid": "43cc0c2f-888c-4c82-9349-682815359d69", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763080370, "uuid": "3b417696-5059-41b2-afaa-f6b95910a504", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763080370, "uuid": "0bf24531-50a6-4e25-ba4c-d310b3db3649", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef8dc1c5-c11f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763100335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763100335, "uuid": "eae0a361-381e-42b8-9755-cfba10ae44d9", "comment": "Malware payload (Mirai)", "value": "b1f04a5e5bdb7559076be6eae1fc9174", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763100335, "uuid": "71375711-01b1-404a-84c0-7baf153e6c35", "comment": "Malware payload (Mirai)", "value": "b62b59299e34229ebfdbf7ac7caf7dc21854fbd551f4f5934d79b500e70c4258", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763100335, "uuid": "84595f7a-288c-488f-be76-e4e105ea5b9a", "comment": "Malware payload (Mirai)", "value": "ec712c146891bca35a6cbc4c9eda742f612775fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763100335, "uuid": "f2c84e8d-1c1b-45bb-b20b-1d3399b80ca3", "comment": "Malware payload (Mirai)", "value": "40dc5f7f0861848f385cf03ab6b528e2150b8a212608767797b429943d5787227818a73fa5d27be1a56f99a065f49ade", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763100335, "uuid": "fbb3f9ff-43c1-4d9d-b5ef-0e172141c754", "value": "T17763C70AEF550EFBDC6BCD370AB90B0135CC654A12A43B393578D82CF55A54B4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763100335, "uuid": "d0a3e173-c373-4c7c-8c1c-41e7388d46b2", "value": "768:cRonSHW30/h5SRITARdxeJdcxoLxklf7fk8l1x9Jxe9Zxq4toztm9GD6wwx2r6IB:cmnAGIKHK09QftpXQeBZEYVzxNRN57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763100335, "uuid": "b92c9673-207d-4957-af1c-255f24654d1c", "value": 68472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763100335, "uuid": "2b692ecd-1e7a-4a34-a9cb-330ab43e7cd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763100335, "uuid": "17ceb450-46da-42e8-86a6-a909607868ce", "value": "wewe3.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa0e56a-c12a-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763104952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763104952, "uuid": "12a9a888-aca2-4295-9f3d-ff6c00697311", "comment": "Malware payload (RemcosRAT)", "value": "d305eca9083540a5928eca794be5b360", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763104952, "uuid": "8f9bb479-5e3c-4eff-86ed-236c7a085e9e", "comment": "Malware payload (RemcosRAT)", "value": "b635119dae399800a2a46a92507a5e0dab83cfaee1d48ab70c342a74c0f3c9cb", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763104952, "uuid": "c7d1e87c-fbfc-4c48-a960-9b30733025d3", "comment": "Malware payload (RemcosRAT)", "value": "80c6de7d0c80f4e9af8e03f4ceb97eab9f78f3ac", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763104952, "uuid": "af2d8516-9cf9-44b4-ba47-6a1572accdf9", "comment": "Malware payload (RemcosRAT)", "value": "e04f701f1e8ae6e4651c88c75b2fc1b51e55539ba3fcdaf9b310a778959c012b8f9ce712aaa7595cff40e929e5073c28", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763104952, "uuid": "d540b9d5-1354-436d-8419-d5cd1bf927a9", "value": "T16C852240FEDDAE52C9AC143990FF97295A729C2EA940504737BC77699B3D32488C2F4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763104952, "uuid": "304892fa-15f2-4503-8df9-77e5563fe289", "value": "49152:rPcF4LxlhMWE3PsRK364UaV4Mc0NqMoLD1sIMDDLaT:rPBx1E3qK3tV46Vc192DL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763104952, "uuid": "96be6231-e7b7-45e4-859d-e008b1495715", "value": 1782784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763104952, "uuid": "99d482ad-8ae2-4380-859e-6955037f7aa1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763104952, "uuid": "c89a14ab-434f-4205-afd9-c15252dfb680", "value": "SecuriteInfo.com.Other.Malware-gen.23194299", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad9210ab-c163-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763129430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129430, "uuid": "9e751ccf-4e87-48e0-a966-061144b1abf5", "comment": "Malware payload", "value": "d3d7fbb578ecb454a8d9137bbef19a91", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129430, "uuid": "5ad92fca-6882-49a0-b31a-55a72ca2d018", "comment": "Malware payload", "value": "b73ce6a89654bebc9b3629b523b58e566ac5cada28de4b3d7c7ba072d20dbf77", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129430, "uuid": "73e8ed08-7043-410b-8d99-23a640d28aad", "comment": "Malware payload", "value": "eb1ff6ed1d59ca0e65568ad4b26de07adf83f28f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129430, "uuid": "2fae96a1-12f9-499f-a598-c76771b9a115", "comment": "Malware payload", "value": "46d6d3b3b62c7bf0a2605b607a0f2fb038dbe75683d25bd4c9f4ee697154f3b89fc3b6151d3828904fc61a83412cd59c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129430, "uuid": "db8d418b-ad61-4e98-8384-9d579d28c104", "value": "T15E24962A3A219FFFF568873107F38A7087D5259626E09746F26CD71C1E2028E685F7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129430, "uuid": "3cc4a677-6819-4871-a726-88d8b9e98568", "value": "6144:WsqHVHKYMRu33czvnreG3/i1423RHzfWo:gVXczvnreG3/i1423RHzfWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763129430, "uuid": "94cd973e-10d3-41ba-9881-cacc457cb04e", "value": 224349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763129430, "uuid": "d2b25e02-6fce-49ba-90b9-3c0168468ee4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129430, "uuid": "d3a79c64-4386-4c03-b83a-fbfe61e2b6b8", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12bbeae7-c15f-11f0-a129-42010a9c0007", "comment": "Malware payload (StealitStealer)", "timestamp": 1763127452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763127452, "uuid": "e580e5ef-4cd8-48db-8f00-9b6a1918ad9c", "comment": "Malware payload (StealitStealer)", "value": "0d196dcf55000f5cc7eca36f88bc543d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763127452, "uuid": "49818bb6-7546-41d1-a5ba-117faa0b1c41", "comment": "Malware payload (StealitStealer)", "value": "b78fbb3ca78914e9603aedd5a67f012a48d7de59a6892d8644f6ad6794520089", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763127452, "uuid": "29633306-b321-4572-889c-e05621772065", "comment": "Malware payload (StealitStealer)", "value": "97ba0fa72a2a50233138ae902146a12393a4f40d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763127452, "uuid": "d0309bf4-169d-46f9-87c2-cdd8ff563166", "comment": "Malware payload (StealitStealer)", "value": "71f7b8952834170157d4a22e12d909e83ee24c6e06ec7a3bb3da9c2efc9eb91bd734994177d1788c3cfd8153819f5d85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealit", "colour": "#F97DA6", "exportable": true, "hide_tag": false }, { "name": "StealitStealer", "colour": "#512474", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763127452, "uuid": "120ee060-8e17-4a38-9f29-fe3e0439e51b", "value": "T1C0283375E62C0C43C8A1A535DBC0F2B13E6E5F060845AC2157E8BEDB79B6C106BEE653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763127452, "uuid": "c618957d-dd78-4a77-aaae-d7178817ce36", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763127452, "uuid": "2b878554-9cf6-4a23-8eda-5513845fabee", "value": "1572864:mQoA3TczLHvUA35KMAGAxshDbqFs2ziiV+/X4moQqxhQS6KlPB1HVkPt2rph:mw3wvPoLGjq/OiYXfq4S6CPBNVkPtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763127452, "uuid": "c225d5a1-f7fe-42e5-927a-3c49f15b68ab", "value": 95000115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763127452, "uuid": "fef047e5-cb77-411f-a53b-cbbcd7f78b45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763127452, "uuid": "b44e8282-5391-4492-ba10-9ebffd5d0ce9", "value": "VibeSync.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d2b4e9-c135-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1763109625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109625, "uuid": "37848055-b8c1-4851-8ed6-0f2914872beb", "comment": "Malware payload (XWorm)", "value": "3959665e5016b39bd6778817bb1eaa46", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109625, "uuid": "561eea36-5985-4161-a0b4-59d387cded58", "comment": "Malware payload (XWorm)", "value": "b98faa45be4458501602fdae5a53c739da1f80cb3461df9993151532db65357b", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109625, "uuid": "fe44b1a7-60a1-450a-a5b4-eeeb75c12850", "comment": "Malware payload (XWorm)", "value": "bb43989eb4fec5b954dbbc4aadacf5086daa3422", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109625, "uuid": "5e27c2e6-9a86-44e6-80c5-80da432072ac", "comment": "Malware payload (XWorm)", "value": "0ab34e0d11632fc33e78b8c4de1275538ec09ba29c09fd0a0c51f7b459b60f1842e499c575437cf20839d7565d4fd102", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109625, "uuid": "8e47634e-b72a-440a-9e9f-508f989a8c48", "value": "T1AF731248FE871B1099BDF2617C1FCA72D5092BB480D728EB007ED937CDC61D66609CAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109625, "uuid": "9f3ee511-9162-42a6-a884-71d13fbd4b53", "value": "1536:T8kYJOB3Xwiz0bzX+iJjoGhl8qR/lAl0PABFkD/x9R3sMiMTmXD:T8kYwdgVbb+iRl8qR/lOFyR8iK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763109625, "uuid": "c130814f-aece-451d-b370-f18fe835cdd2", "value": 78626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763109625, "uuid": "9a85d1a2-70ea-4ddd-9058-fe87b069b866", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109625, "uuid": "a376ffa6-9d67-4e94-af1f-c8f3daf1dafd", "value": "BANK RECEIPT - 30% DEPOSIT for invoice no.pdf.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ce1ea6-c0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763081371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081371, "uuid": "ddb3cfbf-e15b-4536-8830-0b2c251f4444", "comment": "Malware payload (Mirai)", "value": "480865c5059bcaebf89d5984ebd7b9c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081371, "uuid": "e723c306-a8b2-41a1-adbe-bb62fb49f660", "comment": "Malware payload (Mirai)", "value": "b9a1ee9a83baf6d29cbe3b282542149b407ae9d7cfa4dc6b39f079950ab1d794", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081371, "uuid": "1242e2ec-0f62-49fb-9a5a-6ab162ba29c3", "comment": "Malware payload (Mirai)", "value": "65c6124662c0c8a832c8f779550c26ed1cddda5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081371, "uuid": "e5797532-4226-4bfa-9d5b-26fdc0c42df7", "comment": "Malware payload (Mirai)", "value": "0923957e4a739eb9adf4241956befc9566d74808bb14fe6a03f929b2df9c09754d2c591c94ff1307813a79ee5a30e014", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081371, "uuid": "97921a01-d857-4a06-879e-b2cd871c21bc", "value": "T1F6230791BC829A2BC2D41379F5BE998D3360B3E8D2CB3227CD614B107AC551F1C66FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081371, "uuid": "a1f9cab9-64c6-4108-8317-1a3bb507e812", "value": "768:5PwCxmKFReSIn9ygAGxc02k8c6ZQ48PHAmWun/RWFQ/MmUB1mA2EDEy0eYjW9THK:5DmKF7Gxyk8cqoHAmWurAufsG5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763081371, "uuid": "d311ed85-e858-405f-a12d-b1729dcef549", "value": 47096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763081371, "uuid": "fe6ac0c9-7380-4e3b-9254-d3d0fe0cab45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081371, "uuid": "1e708d9d-9874-4bed-8b28-9e26b2832256", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756182db-c12a-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763104855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763104855, "uuid": "fda4b3aa-33dc-426b-8d9c-2131838b487f", "comment": "Malware payload (Vidar)", "value": "8c2d167472767a7cdb62df96f4b20bcc", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763104855, "uuid": "d5fe266e-5059-4466-9d8b-83d99155a3c4", "comment": "Malware payload (Vidar)", "value": "ba892c8122ae4800f6db2437b1f74539c77380f88edb4ba0b592067bebea9660", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763104855, "uuid": "2f932857-1eb7-402c-b777-8191639bdf9d", "comment": "Malware payload (Vidar)", "value": "ae75b7b03d865907a4569db0b556c07e53eaeed0", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763104855, "uuid": "944fced4-a4e2-4fca-b7ac-d2ae602448ef", "comment": "Malware payload (Vidar)", "value": "e3fb2db9a4bcb41afbad26c85d675dc14e1954b468032588ae178927b0630186dc10823bea0b273ffd53b2e331751cd6", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763104855, "uuid": "a776c364-25f7-44a7-97df-7ad8181bd53e", "value": "T1A136AE177EE9496AE05DE231CCF356A666367C48673173F32A203E3A2E327C10975B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763104855, "uuid": "55476463-33bd-4c76-b17f-d66711e40f47", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763104855, "uuid": "15dadd47-c58a-4f95-a599-f421833213fc", "value": "49152:6+Me9hEivzvJm2z7G7bAM64YmIY4OiZrq1DfP+rsNADtV6v+L0uSwiPSCmDS+5uy:6KE0SYmP4OiZrq1DfPHNADtV6v+LC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763104855, "uuid": "86aa8081-b530-4fb6-a453-2c4058643fb7", "value": 5223936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763104855, "uuid": "f38de9a5-2844-4ea1-b55d-5ef8702cc214", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763104855, "uuid": "3201205b-f11e-4e51-98b0-e527c3331e3b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d2d587-c122-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763101498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763101498, "uuid": "7ab6dcac-4fdb-4a64-b6b9-6b3a04856c6c", "comment": "Malware payload", "value": "81c3602c1c1c13bad1ab9cf7a22fa64b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763101498, "uuid": "7616612d-bb7b-4d7b-b218-cdbab87f5edc", "comment": "Malware payload", "value": "bc26db43a304ee2ceb68700cd04484e93b6788efa5f22137a2fee328916e658c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763101498, "uuid": "396e017c-0ac2-49cd-9827-99b791608741", "comment": "Malware payload", "value": "76ea06a2e295a4223fa18f2549926efe146a0011", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763101498, "uuid": "345fa996-6521-4a70-bb5c-6400aae5408d", "comment": "Malware payload", "value": "b86b206b6a52366738c79a96cafed1016d6715d4300b6520bba5575e17ecf8fdcd7f29de73ce145fedf8546674908eb2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763101498, "uuid": "f2e515cf-5772-4bdf-8f20-e3003849bafc", "value": "T135183312E74CA81BD173F5328EBD2267924A0E5D9542FBA72915F24D19F38C08F9BF84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763101498, "uuid": "087ad7e7-011c-42ee-ae3b-c381803490b5", "value": "1572864:xaGvEwrEnRsgOllkVKWZuy6QNFTTYACuwUwa7IVw9tAEgvLIfDU7yzfKcHXpjcFO:xb8+gOlaVx2QL3GvUwaywUEgvErDrtSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763101498, "uuid": "b19569ba-1cb1-4203-b1c2-f327f17d334d", "value": 85498059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763101498, "uuid": "9fa37a96-f36e-4446-9e54-829dcf988667", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763101498, "uuid": "7a4d67c1-6b9f-4083-aa6a-544cd414dad2", "value": "Proton-VPN-v5.13.19.0-MOD-OTR-(Getmodsapk.com).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6daf315-c132-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763108400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763108400, "uuid": "45f699a8-c446-46d8-900a-4b5721f7ff4a", "comment": "Malware payload (RemcosRAT)", "value": "803d6cea505a415e0ce9cc79d208d80d", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763108400, "uuid": "432b76da-7e8e-4ddd-849e-f7b209e38b86", "comment": "Malware payload (RemcosRAT)", "value": "bcb8492b4db50efd9be8c234b769db40bf43b176eb5eed693e399e9e64809c58", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763108400, "uuid": "169bee80-4810-40bd-b707-61ae1e3abe6c", "comment": "Malware payload (RemcosRAT)", "value": "5fbfa6bc7b293974e3c80f43433ed5d87be649f3", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763108400, "uuid": "af500eb4-dc75-4e2f-be29-c0854b28e7a0", "comment": "Malware payload (RemcosRAT)", "value": "36f9d5d806edd58036f27d8198cac90396948c526cc2308e05cd28688ecadb0709e0d74dbbfc369f5b58fbe2fd982137", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763108400, "uuid": "0c0a9dab-9372-458b-8d82-9c2e1e4ce796", "value": "T1D863F571DB97A7850D4E2B4DECA4A541CEB88104D32604E4BECE0349659ACDCE3EFE39", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763108400, "uuid": "dd7ccf1c-c0de-45a0-a2d9-c73d1aae8105", "value": "1536:b8xkyRhUk7IjMdzUWs1zYPTnNNZOrpwrnbBq:gPhX7NzKMrNNZOr2Zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763108400, "uuid": "6934bfd4-fcf5-4a31-8233-f6e417c3260e", "value": 73202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763108400, "uuid": "e87545e2-6da0-4710-8460-c8297b2c3106", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763108400, "uuid": "6bb15e22-3f0a-46d4-88fb-61e945ea75a0", "value": "SEB3463434754745743626235645223523532523523523.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832885d4-c11d-11f0-a129-42010a9c0007", "comment": "Malware payload (Gafgyt)", "timestamp": 1763099294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763099294, "uuid": "a403c19b-2326-4328-b749-a9087bdbf9f2", "comment": "Malware payload (Gafgyt)", "value": "6c58403b3d2f04d40a1ef43bc02423b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763099294, "uuid": "a4ec2a43-b1ad-44d7-981f-2b287d8d93d2", "comment": "Malware payload (Gafgyt)", "value": "bd10423ef0f50e9e7bbb588c7cf3aaf9a838cc93cbe80c0e81fa549d1a4ac657", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763099294, "uuid": "6bca8f22-2ae0-4ce0-9ed9-9ebfc452b0b5", "comment": "Malware payload (Gafgyt)", "value": "241cadc217523907017d1eb94521f6fac6141641", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763099294, "uuid": "8b6cbec0-752e-4e4d-9b8c-946b0425565d", "comment": "Malware payload (Gafgyt)", "value": "c43d4ff5758f27e401f11cc70704c6c5c46d7eb4029a5aacd8cb309e956c4d9ef5136e7710f5f62bb96bdf32e52ca133", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763099294, "uuid": "1dabf5c3-866d-45d0-8644-864a1d990f63", "value": "T190135963C8BA3D18E15E8475F8616B791763E85AE9470EEA5037C23AD043EDEF4093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763099294, "uuid": "2b9b5afd-93ab-43b6-a7df-8f6b26a2ccd6", "value": "768:JokR2oPwwA1dEpI2kv9KrcLi7qaJQfopdxouCq+JRRf0iqKI:OktXAv+lWKrcLi7dJQwpEuCqRxK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763099294, "uuid": "cbf22219-29cb-46f7-a074-c173a958d7ba", "value": 42384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763099294, "uuid": "a9e44173-d79b-4564-885b-180f30211a4a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763099294, "uuid": "c29be710-b2ce-4fbd-bbd5-6f0d7bdaa0fb", "value": "wewe11.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e91903-c0f2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763080966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763080966, "uuid": "5d265192-dfe4-4257-a267-a57353349100", "comment": "Malware payload (Mirai)", "value": "9e4f9014027f1b48e4df0eb557f7cf47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763080966, "uuid": "2c722264-f096-4097-86bd-7483d664881f", "comment": "Malware payload (Mirai)", "value": "bf31ccf6b8097d847357bbb335a425f0424d3186b15879542631fc73c9bad8bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763080966, "uuid": "629ee039-d95f-4153-bac5-4bb1772a6995", "comment": "Malware payload (Mirai)", "value": "a83cf252032de24ffad54889a1a05f1f37b43eea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763080966, "uuid": "b6a9cc65-5aff-4dfd-811c-82259ceb4adc", "comment": "Malware payload (Mirai)", "value": "45196b83ea4a578be1be61ccc6e5be97c9261c2d91220772b4eab83c1944cc99346accd4a74c932ee566ad0ea3af112e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763080966, "uuid": "bc9024ca-8a2f-4364-ab20-9a8155b790b1", "value": "T14973E646B9419F12D4D631FAFB9F418933536FA9E3FA7101D9206F9023CA9DB0E72612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763080966, "uuid": "31089022-3041-4ad3-be01-f97ecadcb93d", "value": "1536:/snUlD+GqCZK2W7qB0eyLMH1a6SwPe34RybkOEl29Vi8XAE6W:9lD+GzZ9WWB0eyLc1VSwPe34RyRnXAE5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763080966, "uuid": "99527cce-ff9b-42d5-b54b-cf92b938020d", "value": 74236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763080966, "uuid": "a0ec10f1-bcee-4e7b-82c9-4115e2c72c06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763080966, "uuid": "1531b279-9906-45ee-968e-fb206146b490", "value": "nshkarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c910ccb0-c12e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763106713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763106713, "uuid": "92da0658-f1d1-453d-adba-e2d94d814d40", "comment": "Malware payload (Mirai)", "value": "8de4775598e443f251d7447103d994e3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763106713, "uuid": "a4b5931f-277e-4200-94f9-06befa2804bd", "comment": "Malware payload (Mirai)", "value": "bf44e39abd56992c7df220c5f8ea3cb63da79265d6c6b4604ff470c2dcf66ff2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763106713, "uuid": "1e561722-5cbe-4c46-a128-bb916179a6fb", "comment": "Malware payload (Mirai)", "value": "7ba2ed34c77304db10ce158448252d6af5dacdbd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763106713, "uuid": "508858cc-9b87-424c-a9f3-ca7379e50c7c", "comment": "Malware payload (Mirai)", "value": "e773c0a111b0078c333f4f881b1674391be784a3be23730660bf4d556ec43ecf750fb39d5cf58e1bcea296510697d076", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763106713, "uuid": "de0f39c1-a2de-4cce-8983-3fb34a170370", "value": "T156D2E1624E61ADF782B05E33E8F2CE460D4917BDD0FAB453634A4E6C9D936136FB1042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763106713, "uuid": "1f934677-cde5-4b7d-b9ea-85176b3e6564", "value": "384:B7bphgVNeW/LS74dx6SsmdbbARj6QGO+geF1Fn/UryNoRmys1YeDnbWI+zYPKghR:x8Vv9ddoR/T8rn/U7RBeetzQ9q3UELK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763106713, "uuid": "94ce77c5-48bd-46c0-ba49-4af7d7c6ab6b", "value": 30828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763106713, "uuid": "37140a42-f8b3-47c2-9926-d46ee7343e52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763106713, "uuid": "1e7a4bf6-9f16-406d-9453-179f2cb401a7", "value": "wewe6.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8cbd7af-c192-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763149743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763149743, "uuid": "2de11e89-0715-4c3e-81b7-ae679156bdc9", "comment": "Malware payload (Mirai)", "value": "b6b55923010b90d7c573e3b068de8aec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763149743, "uuid": "0f7f1450-5131-4910-af20-cb7275c1fa70", "comment": "Malware payload (Mirai)", "value": "c01d401349d6718867dde1e2cb817f4a8010ae85634456959b7a6873e86738b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763149743, "uuid": "fb1c7adc-1067-4e6a-a827-fa8c139b50ce", "comment": "Malware payload (Mirai)", "value": "1d189ef6007b2e2480677619300db508e14c4e30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763149743, "uuid": "abb94079-afad-43a4-ba2e-ea271c1c699c", "comment": "Malware payload (Mirai)", "value": "9c2e33a46db08dcc58cbd655c367bc608ab6549c1563b1b79b4bbc21f4c59f1b21fdb355caaa2ba8aca4a2ebb65cef42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763149743, "uuid": "ff4fcfb9-2024-4c60-98f0-e94f662ada92", "value": "T184D3B40E2E228F3DF779C23487F74E30A75963D626E0C685D2ACE5115E6034E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763149743, "uuid": "d03f413a-6bcd-4cbb-a861-92399c1b7f47", "value": "3072:Mq3iHXV6m7tWa0bgj4kztcexQfBFwEmZjQsVVjukq0WrsHaTgTYdD13JvsZ2n5vr:Mq3iHFb4aWo4texuZ5SQvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763149743, "uuid": "1c91ec99-7534-4373-b6d1-bb30e96da93e", "value": 134496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763149743, "uuid": "d808adbe-956a-4205-a786-974a1ddf47a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763149743, "uuid": "9250020a-97f4-4595-a095-7b810891039d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3d5274-c1b5-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763164621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763164621, "uuid": "4384fc3b-9cbc-4259-909b-befad76e9600", "comment": "Malware payload (Mirai)", "value": "bbbe0b42d42dee5cf8ab5f18c0b30252", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763164621, "uuid": "07f9cf7e-8d11-443c-981d-b9538b0d2c7c", "comment": "Malware payload (Mirai)", "value": "c0f5ebc81a9ee665a071c886d4b449e157e0e175cf8a5091e9e34633be705684", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763164621, "uuid": "30b2c58d-fe6c-42d2-9978-06a07a8ac016", "comment": "Malware payload (Mirai)", "value": "0fa964b3948fdbdabc7856fabce432c459df8d1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763164621, "uuid": "e8fc8b76-20e4-4e86-8fb4-1c4bf85edb00", "comment": "Malware payload (Mirai)", "value": "9764ad15effb8e7bc4665373d94311a00a83f99dcd8d0558c61c1a2dacb4afa05f38e721180dd542d95340dee69cacda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763164621, "uuid": "e05b703d-db31-4f1b-9b38-93122395293d", "value": "T18CD3AEA7B74721A1C8A302F407CB4BDD3E6322826F5B98E3BC5F753B18790DA4506B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763164621, "uuid": "c2e1270b-f773-4b16-b882-8e1c0b1555df", "value": "3072:Dd4hS9rbJTfwFDPVdEDVJKoEuz9uhTgocKqX:Ddz9rdTfwloVJ7nKqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763164621, "uuid": "077ec30f-700a-49e2-9479-c1823ae8b18d", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763164621, "uuid": "ec70186c-339b-4652-98f7-726353513887", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763164621, "uuid": "9278efa6-1c8d-4db2-b7a6-c969d9b7cb0e", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85592223-c182-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763142677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142677, "uuid": "353edc7f-9693-4095-a515-292e96657bb2", "comment": "Malware payload", "value": "049c63dca09449b66ee6074f76fc9977", "object_relation": "md5", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142677, "uuid": "53eaf3ef-b524-4ba5-9713-5178ead7c423", "comment": "Malware payload", "value": "c115a38aa9cca5625a4856827aa07cbac8d4fc461056afb15b444b7fd58becd9", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142677, "uuid": "c1d133db-2e64-43c0-a994-00336b05f3dd", "comment": "Malware payload", "value": "ef0c36b12f2a95c0accc2ded9321227acd08d262", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142677, "uuid": "d75bba3e-5ca2-47b0-b052-5604da8857de", "comment": "Malware payload", "value": "b0868c3ce58b1bdabfee9c5c8d547ec78e52572246a6c3a468f5fa990732e869a4c186160364ee08adf62a9a5e4131a4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142677, "uuid": "d2bbb10f-f89c-4285-8411-aaea9fb06726", "value": "T115F5334A75C2C475E972C0BCD8927395477BFC3910B8D88332BE0CEE6FAA5D086557A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142677, "uuid": "a6f77c63-78f3-42f9-ae14-941ff29561f5", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142677, "uuid": "76372718-3c62-4d9b-9b05-dd0592020e3c", "value": "49152:C9lpkgTcD+pKbJqs2Je6SxfuHsrJ1n8go689t5ilTE3EKAlg0Rt6yBiud:MUgQbZOZSxfuHsrJt8P68EhE3EKA3L6e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763142677, "uuid": "3a3d11e9-52a7-4107-94ec-cdde7b0ab328", "value": 3390963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763142677, "uuid": "be977c19-cd71-4ec4-aec4-9728d60a48aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142677, "uuid": "d3918db7-4530-40e7-b9a6-f336f5f9b422", "value": "Oaeh9vExc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a516659f-c1b4-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1763164205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763164205, "uuid": "aa2c1970-c9ec-4755-9781-6037e84a6804", "comment": "Malware payload (AsyncRAT)", "value": "c6526d1fad91c6ac3e660fbb0c1e9551", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763164205, "uuid": "cb758a4b-6177-4f89-8ddc-87d4c492699f", "comment": "Malware payload (AsyncRAT)", "value": "c1aa12637df40f20d250bb37024c7097cab81c8282142c23024315050edb040e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763164205, "uuid": "5b222375-eab1-426e-a1ff-2bb204d01cbc", "comment": "Malware payload (AsyncRAT)", "value": "1ff1cb9fdfb47e77135c1d0ad648169005fbac53", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763164205, "uuid": "b4d655fa-9b49-4f19-9859-cb8890bfcfe1", "comment": "Malware payload (AsyncRAT)", "value": "0c0fc652aae265176f772314a675a09fdea0ba0e8a8a21941507bfd1d1390b447110a3bce86059cfffc6c05168b14e57", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763164205, "uuid": "5ba0f71b-e3f8-448a-a253-69336a6e1030", "value": "T1A153E8013BE9802AF3BE8F7469F7718106F9F5AB2D12C55D1CC914CE0922B869951BFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763164205, "uuid": "92a94cff-c954-4051-acbd-32070c0fd387", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763164205, "uuid": "858b7e06-dac0-4e7d-bc83-6b9c16c7f87b", "value": "1536:PmImx6tX2kNff4sKu+UYFxiIMBcAGwbXAPgQqwR+urPlTGBx:Pm9x6tmkN7Ku+UYFxrwbX7wkud6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763164205, "uuid": "56387c29-efaf-4d02-98dc-e560bcdf557a", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763164205, "uuid": "29582485-3806-4f4e-811d-38cdd3325d4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763164205, "uuid": "00291709-7e73-4031-8532-b64dab4186b7", "value": "C6526D1FAD91C6AC3E660FBB0C1E9551.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69145749-c161-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763128456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763128456, "uuid": "e42cdef5-cf0c-4766-af40-bcd4da1fed12", "comment": "Malware payload", "value": "e25c61ae720a872701f2fc366a871394", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763128456, "uuid": "45a4740f-5def-41a5-a2d6-9407fa0bb573", "comment": "Malware payload", "value": "c23f6c59660be0080ec7e6977514b041dec8a66d1e04361bd73708dd9c964189", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763128456, "uuid": "702cdaeb-f240-47e7-ba2f-b0db4c8d9736", "comment": "Malware payload", "value": "0243d675b4ad94dce071568a98e94b2d18688269", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763128456, "uuid": "5cac315a-fbc8-425c-8e8a-9f288ab7bbdf", "comment": "Malware payload", "value": "431254ca679c28b4a565a7fd84738d9531a9a35fcc56cec26c22b09c76d0c6ea2d3cb9f64359b06572bfb7778b1d3f75", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763128456, "uuid": "35e189d4-af1d-4a5f-aa10-e6a22c950c96", "value": "T1872265CE0A0D1C23EBB70F2953744ED04A6ED4C38B91E08D564F6B73986A3D3A19AD94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763128456, "uuid": "d0192c7e-45e0-4602-8d64-25edde36a906", "value": "192:mYQkB4fiN9FiiiiiiiiiiiiiiiiiiiiiiwDiiiiiiiiiiiiiiiiiiiiiiziiiii9:ukufu9FiiiiiiiiiiiiiiiiiiiiiiwDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763128456, "uuid": "c1b076ea-7a8e-4a79-b825-153f6619f10c", "value": 10311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763128456, "uuid": "074fb3cc-3dac-46e8-ab72-40e1f17d1818", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763128456, "uuid": "39ad4134-0b51-4640-841b-d7abce658593", "value": "NEW ORDER-PDF.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ceb0c3-c149-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763117980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763117980, "uuid": "4aa74686-fda1-405e-85cf-13142b731093", "comment": "Malware payload (QuasarRAT)", "value": "99a9db36cee68a161b64061f2d01de35", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763117980, "uuid": "0188de2b-867e-4408-bcbf-f4f5ff0701a2", "comment": "Malware payload (QuasarRAT)", "value": "c27e5eb9e88677550596d1678ce44d9b4f6dfa69751402e4a5986c297d7b9ef3", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763117980, "uuid": "fb8e8df3-0e47-4f65-b596-3dd10b25c4cb", "comment": "Malware payload (QuasarRAT)", "value": "c17681d135aeb249b4c5f5589c99be5ff948f113", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763117980, "uuid": "3f9f46c7-c7b4-4cce-8f7a-e9adf06c6e63", "comment": "Malware payload (QuasarRAT)", "value": "fb799d42ed664a7a6e20e1a23e81762d15b905ff116494429a425fa03a45bf5b1b94bc06aa190a3ba36c04b722edec66", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PERSISTENCE", "colour": "#94A9B1", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763117980, "uuid": "66f446ec-3cc8-442f-80d3-07ee3caf3b86", "value": "T133D43A8336D71CBADA632B7890D753396739FE604B374B7B4608C6322D231D0AE5A764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763117980, "uuid": "cf81302e-949d-4db0-ab44-236dbebdfd2f", "value": "45d5865eb6beea32be47e1a203bcc876", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763117980, "uuid": "e8865110-a05c-4973-969c-7bf65530d370", "value": "6144:2CvVfeOZgeNalRHaUNOZ0zJJJBJq8CaAasASX+MTzrlyie866BHUWq+9yN86IpKh:yuN6CaAaxSXJkcQFPSH4b/Qtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763117980, "uuid": "9c848b1b-6097-4c22-9ad8-2442e1077d49", "value": 598326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763117980, "uuid": "4453c721-c773-4550-b188-4643c60f890e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763117980, "uuid": "f6995953-7617-4c76-90c0-73a1349b4e5f", "value": "lq.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003b5acc-c110-11f0-a129-42010a9c0007", "comment": "Malware payload (Arechclient2)", "timestamp": 1763093491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763093491, "uuid": "9bc58daa-58e1-4754-ac10-4ba165cb5aed", "comment": "Malware payload (Arechclient2)", "value": "b6f1e7b3d2ff0a955dd38bbd18b7cc4a", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763093491, "uuid": "3570e257-ca3b-430b-b8c6-60e672072bfc", "comment": "Malware payload (Arechclient2)", "value": "c2992e4779e3fde475b2bb86021c6f7731ac6a1f7cd21648365b615a6bed0955", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763093491, "uuid": "86f97e25-60ac-4f18-b3d2-182c0009e535", "comment": "Malware payload (Arechclient2)", "value": "3ea39e4ff78e8cf28bafc1fc5907bf9938c1d607", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763093491, "uuid": "595a2cbd-d20a-499f-9577-ea2937709346", "comment": "Malware payload (Arechclient2)", "value": "089c4a307ee752a92f2c9783c79d245576efccf240ba52db0a14dcc03661f88ca1139cee07a8a9546d764b4a61cf3ad7", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763093491, "uuid": "919a0b1f-8fb1-475e-b6f4-94dbb2be4c8b", "value": "T1DC7733B09A1908D8F574723341A4690CEEE2743357E7F84F96B8F2631A9F6E1587BC90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763093491, "uuid": "1044aee7-c61e-4b7b-b047-692cea82df8d", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763093491, "uuid": "b5d8b429-b6d5-4312-aebe-9cdac8b93279", "value": "786432:Fpy35mIWk0GbMzbLZndX7Qcwj/R7ALT+YDlHI+U2nT6ISllL3IJ:BvZnRFwj/R7ALTJDlHVU2nWISlJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763093491, "uuid": "40ca414a-ec73-4e26-acda-39b6281250eb", "value": 33749983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763093491, "uuid": "f429f9a8-e56f-43d0-b30d-6369f88fe544", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763093491, "uuid": "e7d15af6-2181-4f9d-9060-c204b29054d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cdb9f0b-c159-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763124919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763124919, "uuid": "91243b0d-1908-4069-90fa-2d6ac6255df3", "comment": "Malware payload (Vidar)", "value": "e4e661819d318f0134c138b3150b8a0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763124919, "uuid": "6ffa49a8-80f4-438f-8de3-dfb2c6b0c415", "comment": "Malware payload (Vidar)", "value": "c3b5eea41fef74df5e90f71007896efb51cad01ac718fd31334eaebaa1802b57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763124919, "uuid": "96b81343-36d2-47f5-9bc1-91ab8d42f14d", "comment": "Malware payload (Vidar)", "value": "3adf5c36153a828be1ee69e7b17327ea36784b42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763124919, "uuid": "14ab966a-7983-4dc1-8b89-9ea140a21f2b", "comment": "Malware payload (Vidar)", "value": "025a2eb31f45e4534433a9ceb268476c53a4d886204b72564849e38ee9fbd8da480ddf03286a48043d22e4811533db90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763124919, "uuid": "15d48206-7037-4a20-b45e-7729b63b1987", "value": "T1B9067D673DA249F5D029D234E8A745E1F638BC29073233D35E607A752EB2BC25D32B64", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763124919, "uuid": "194903a4-c5d1-48e4-8b5c-4e8395a3d97a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763124919, "uuid": "095250ce-62b2-4ffe-84c1-6c434fcb1161", "value": "24576:udB78YrCMW0Co0FsxtXd/NsxABEnsCEDkDQ7R4Z2hTGTz/MIj6itTJu9FoY4wyiJ:uzDrCMWfWxt3s6CEOe4DmmEoqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763124919, "uuid": "6dafc18a-0263-4e58-a821-c23beb3a1daa", "value": 3793784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763124919, "uuid": "fd960939-3185-463e-8023-c7163b3d2de2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763124919, "uuid": "e88f7723-8102-4c1d-bfd2-12652feb2bbc", "value": "electroforming.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff7e4b74-c14d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763120119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763120119, "uuid": "7680ccce-e9b5-4940-aecd-021ed438bf4f", "comment": "Malware payload", "value": "48120b9ba54f511b4c705ba1d22d5389", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763120119, "uuid": "e9a73c87-dfb8-4592-bd5e-f516591d7f08", "comment": "Malware payload", "value": "c413b2e2c71ea31bc366c95b3554a36ff1d662b365c7f06768d53d44e441f7d5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763120119, "uuid": "dadc4d5d-f6ed-414a-a306-a28b33f6c4b1", "comment": "Malware payload", "value": "c2d8120645e238ac3905236e4d2bb4b75b4ee540", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763120119, "uuid": "da275d75-0cf3-43de-a02a-3714bc151c50", "comment": "Malware payload", "value": "575945eaf3606509e3fc9d9aa632e50c7aaf8f9b0044470fc99f2d08f533e59d58c32920018f59538570fc714c124dec", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763120119, "uuid": "94600a26-af89-423f-a1ba-93e15df3a868", "value": "T18E773390B911D41EF50E6873CD2EB1A0E1271D04AB0588DF7799F21CD83A1B9A7BE74E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763120119, "uuid": "e6d6f018-921e-42e4-ab3b-de0afb6af9d2", "value": "786432:cNfNTR0R4KI89pZsU6YUQMqjaqxa+sfls4JnTWvbC58:mvKZpGUO+xaLflsOgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763120119, "uuid": "06ad8451-3b1f-43b4-835c-9c135cd80bae", "value": 35508224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763120119, "uuid": "8724747d-8939-4404-a902-91d2af29ee37", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763120119, "uuid": "96f5e05f-a2e4-465e-9776-aeefab096d1a", "value": "5f8f70.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c0502e-c129-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763104533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763104533, "uuid": "c5a59d17-0741-4a23-9754-374f23c404b5", "comment": "Malware payload", "value": "0e25199307b89eda3b1d5e00f2e7c660", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763104533, "uuid": "24255763-a9a8-4a33-9df5-e221780b6407", "comment": "Malware payload", "value": "c683ea7e57cb9ff91393da0b28371863f315421b03905da49474e1382b441759", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763104533, "uuid": "a0b60117-9b1d-4acc-ac5f-418e5d88922f", "comment": "Malware payload", "value": "e86c2d22a7730c63597fedf68a60746b4bc7cc76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763104533, "uuid": "fe3ceec7-12ba-41d7-9bf6-e7a48f7b8119", "comment": "Malware payload", "value": "c09f61d6b39e50d06c8739bb10bc83a1717de5a73928a469fde64c594af5a6e0fbd6246a642a0a8c7a3ed2fab954adbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763104533, "uuid": "b364f2cd-20ff-4a93-afd5-83398389ac6c", "value": "T1DA461204F7A5061DF466FAF62D21711146B3BE479815C649E3B33088EA76E43CE6C2EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763104533, "uuid": "e0f5630a-b363-4fe4-8f27-b84acbe6e9a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763104533, "uuid": "ec2bdef2-bc85-4294-ae40-453c9f6ed96e", "value": "98304:7h/evJLeTmDDi9UeK7kqXf0FGxLCbD3ha5Uc6v6O3xUM3/L9LI/cbt7/Cp/z2OIn:7h/ev5eTeW90kSIbDoUcfOhzT9cEt720", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763104533, "uuid": "76398613-73d9-4f04-ba07-f8612f954819", "value": 5858856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763104533, "uuid": "0f145498-5591-4f26-a799-bc7f589887cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763104533, "uuid": "0c5b6352-29af-425d-b4ea-7ed9607198e2", "value": "Remittance Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85937c43-c0fc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763085125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763085125, "uuid": "2678cfe6-efb2-4939-ac98-6eee210ad33c", "comment": "Malware payload (Mirai)", "value": "ddd7e318924069d9363cc00082f496ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763085125, "uuid": "d5ba93e4-f09c-4574-a4db-b8819251f703", "comment": "Malware payload (Mirai)", "value": "c6914f62bb9235122a7439258b16d4f5009ed8f3a309f0ceee4170319c77c5bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763085125, "uuid": "f18aad90-3f6c-4402-add8-4c31e34a17f7", "comment": "Malware payload (Mirai)", "value": "e587840da333ddec58dafb6e4f685a2b3be9d8c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763085125, "uuid": "129f07cb-5f4a-415c-b958-362ea8bbce37", "comment": "Malware payload (Mirai)", "value": "0a6ed5fcb16d27fd2204f79006bc1c67afa272ae4e4ca4c71623353212504b5069f1be67ae184077d3eb6684b3a2ec28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763085125, "uuid": "75c6abb8-861d-4fda-b187-099294c771dd", "value": "T102D30A46F8819F16D5D211BAFE1E128E37131B78E3DE73029D246B247B8A87F0E3A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763085125, "uuid": "d5f322ac-7a3d-454e-bd60-d38ac177e442", "value": "3072:LM49i1qKT895mEGVmjX75cQ6uL0ZRF/KXOjar2H+nQS:LM4s1qKTs5mEueXX6uORF/K+jaK6QS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763085125, "uuid": "6b743088-6dd8-40c3-9e93-0a5b242f58cc", "value": 141692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763085125, "uuid": "1e25a3cc-3abb-41c0-b2b8-85d6ea8efeb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763085125, "uuid": "b7c72fab-fc74-411f-aaf0-f8f2235dcd13", "value": "nshkarm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de316c9-c107-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1763089810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763089810, "uuid": "72dcab78-a68b-47d3-a167-9525bf5973dc", "comment": "Malware payload (PureLogsStealer)", "value": "7ff7c48e2e1272d2c50be26ee0acbe9f", "object_relation": "md5", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763089810, "uuid": "0ca645ed-217c-4325-bf98-f9479d5df7e0", "comment": "Malware payload (PureLogsStealer)", "value": "c6b8ab1cd6e8a23606749037171b56beb97ea639e5f46a13b30fdfc229a350a3", "object_relation": "sha256", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763089810, "uuid": "f35928ac-ed92-4368-84d1-c1a949ba404c", "comment": "Malware payload (PureLogsStealer)", "value": "91a2dc968631895c75d27d63168976e0c8ac9223", "object_relation": "sha1", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763089810, "uuid": "2e042d78-208d-4a17-83cb-ae9e3507f9c4", "comment": "Malware payload (PureLogsStealer)", "value": "e9b3025e480d04ad4a5a95772631c6f09244aa88a0e2289b3e8a4f8fc9a5cd8bc08377e4fbf9bc72ffa3355047aa2bbe", "object_relation": "sha3-384", "Tag": [ { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763089810, "uuid": "cba0a701-4a3a-45f3-9d71-9e3a7add49f1", "value": "T1860602118DC82FB5CFAC5A1C90FE160EA3E04A8E546A754AFB37BD4BAFF7544010B199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763089810, "uuid": "b1eba812-94df-4f98-9950-0246d7f30007", "value": "49152:V0NSiif5XqKAp/JkPROi0MDeZ3BzORIb5Ff6nl:7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763089810, "uuid": "5be29a67-94b6-4099-9101-a5285a3099ec", "value": 3693328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763089810, "uuid": "a41504fd-1766-4f55-8787-e8119d797e09", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763089810, "uuid": "6d652b98-611d-4b94-969e-1133f900bd27", "value": "MS202537-052..VBE.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4817897-c16a-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1763132448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132448, "uuid": "7fdb4184-f366-4301-a90b-de2549e86ecc", "comment": "Malware payload (PhantomStealer)", "value": "070990c15f9e332a72962db22fb227af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132448, "uuid": "c5d1681e-8907-476b-b576-7be27890cacc", "comment": "Malware payload (PhantomStealer)", "value": "c706b4916bbdcd3fd321932aa497d4680fcaee1c2b18c53e2642cb5658e08a3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132448, "uuid": "a287c9df-813e-48d5-98f0-1e60ceffe968", "comment": "Malware payload (PhantomStealer)", "value": "32b2e84d4156ea97889af4325cf0de5d9ea5b221", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132448, "uuid": "adb660cc-3299-4b1b-96d9-bda680847516", "comment": "Malware payload (PhantomStealer)", "value": "e3c42550be9506d769a2c22327691da8047ef070f17e46fbc0aabb0dc7f79c63d11d60a4146d01f6b8a536752344d681", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132448, "uuid": "d668302e-12db-44c7-8a43-52a5a3ec387b", "value": "T142452254A77CEF02F0E22BF02678D0B427B5BD9D9829C24A4ED47CDFB4A1B050A91797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132448, "uuid": "2b4fc8f5-417b-43f5-82a2-4f5e05fa7161", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132448, "uuid": "054318c7-c674-4cb9-b793-fd4aec792efb", "value": "24576:spcgn4Hi6H2CuaJ+VECiLH+hTo53lP/lr78oFaByrL9pcVxTsy3:C4CTCjcVECiySZJ/hpIyrL9pCR3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763132448, "uuid": "19fa9b1f-ffcd-4049-8f04-75e882fec820", "value": 1241608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763132448, "uuid": "eb9f385f-66b2-459d-ad51-27edfebc1cd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132448, "uuid": "929da2b2-abb4-4fe6-8c30-cc21f93dfdc0", "value": "Revised Proforma Invoice8268001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94925c0a-c135-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1763109631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109631, "uuid": "7b6305c4-e05c-409e-97f9-5f1d21ca90d3", "comment": "Malware payload (XWorm)", "value": "a300f858435aa785627cf11ad9746bbb", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109631, "uuid": "1df9cfa3-1d5e-45c2-9b3f-3afc2307b751", "comment": "Malware payload (XWorm)", "value": "c743fcbd8217a2d1a29c117ce8d3eacc2b76ab4828a7a54b9f161235aa011cb7", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109631, "uuid": "5ba6f59f-74ac-4beb-858f-ec23e110559b", "comment": "Malware payload (XWorm)", "value": "335546da4aedfffdc29f43920f155e7a3ee94253", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109631, "uuid": "ebc26ff7-d7f4-4efb-8919-bd01cb4f2133", "comment": "Malware payload (XWorm)", "value": "647880add4c6c05e59d2655de3b02036fb5292860c1ece929cc4361f66175d77d8e99368f35bc187f1e1d1bbda986ca5", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109631, "uuid": "b24b6e6e-2aa3-4572-b430-a3d548a32884", "value": "T13144C539C47048D9CA973263732E1E0D2C6F1E8EA5611A5AC252B3191D31EDAE7FD1BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109631, "uuid": "2333a68d-fbf6-405f-bfcb-221b2d8b16bc", "value": "6144:5xozvLI8g12IgdKZ/8hSnfvBVAkE15rpSrfIMa9be+GZG3NBNpHk2UDLRM953jHN:jhI2rfIMa9be+GZGtVTYuWDKVbYxv+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763109631, "uuid": "53486379-c59d-4801-abd0-fe06d30a3eb9", "value": 256675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763109631, "uuid": "7a02ae48-03b9-49d4-9925-ecdb2f2a49ab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109631, "uuid": "71a0a9d0-5162-4b63-a91f-71e37bd2acf2", "value": "BANK RECEIPT - 30% DEPOSIT for invoice no.pdf..vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6663e53a-c17b-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763139619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139619, "uuid": "66d37df7-65cf-47ab-ae3e-837fc6774130", "comment": "Malware payload (CoinMiner)", "value": "4fdb662d8d954c6ab0b47204bf6b9337", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139619, "uuid": "9d41ac0d-2b1e-451e-8672-358d4bcb487c", "comment": "Malware payload (CoinMiner)", "value": "c77304e40bc3afc5e5b5b1f94395b4b64fc17b8fcd255970bdcf0c7cc0a507b2", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139619, "uuid": "218c9644-a260-4f56-ae6a-fa6441e323ca", "comment": "Malware payload (CoinMiner)", "value": "098bbf5f540e6290ff5accf00c4ad32ca78b30d6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763139619, "uuid": "69d5fa99-3fc6-4bb3-9ad9-7c3262f91575", "comment": "Malware payload (CoinMiner)", "value": "8d6a7b0a46d2a912d6c5e59add1e58042ff98ea3a61dc9f1c9d946649616a83e09f2e6197772cecbb020a6c6cc697e43", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139619, "uuid": "01140f1a-c29f-4438-b8c6-73cd56239278", "value": "T181122A1B7E890061C3A14DF06AB84B9D4B7D542327D651FFF773C18A1F64345A0462AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139619, "uuid": "986bac83-018a-4b5a-81bf-48d71e138c8d", "value": "9db3169f0849392a7cd91364b6f1368b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139619, "uuid": "a1a64b73-97b7-41cb-a49e-095bac331be5", "value": "96:EI4iMmZ2ffYt695E/oBPyYdUDi8Z+Z8arEMensnrKFJxGE9b+z2FFhRC7tCEZZFB:EjgEffYwcoBPsZ+CYJKFJxTZ+zmFhyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763139619, "uuid": "4f0dd64a-4fec-4346-a4f1-28bb1ccff5bf", "value": 9728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763139619, "uuid": "3d8aded5-504c-4d80-b5e8-ab65df1b242d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763139619, "uuid": "108994dc-fede-43a4-9237-b6017cf3ac68", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2eff87-c194-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763150527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150527, "uuid": "f5de0701-9c89-41ff-9b71-cb9e2ba123f1", "comment": "Malware payload (Mirai)", "value": "2882e4d3f2314334b860daabcfe35413", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150527, "uuid": "4974eb26-2414-493a-94c9-6eafbde03165", "comment": "Malware payload (Mirai)", "value": "c8292ac47c7ec92abf0a5a19939afb63d0cad3de10ec8288affa150511be0ce0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150527, "uuid": "9577468a-1188-4ed7-bc07-c53c5b10fe6c", "comment": "Malware payload (Mirai)", "value": "51d9a4288e2f29633177293ca05d883dd4b269e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150527, "uuid": "fcbec079-03c1-480b-b433-961d9d6f7372", "comment": "Malware payload (Mirai)", "value": "280bf854a2787a0ff6b43c31b5cddaa5bfd16b18d188b77eb87ec6280a2faaefca0cdcbd91c894ed5438045955e8ab51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763150527, "uuid": "a3d44eeb-415f-49f3-a206-159f2e9ca1b1", "value": "T1F2F2F1B048A99666D5FF0AF3EC6EDAC163441B38D4EB303CB4249936B18AC18F6FD145", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763150527, "uuid": "13590270-00dc-4f62-ac12-35ea7c16b3ce", "value": "768:nJ5H0uUh1czicqNjWl8qTHuuZ3k3S+Y7hD6tvix8pGvEA3UWHt:nJ3w6ziIa+VmC9oI8SNHt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763150527, "uuid": "e0b26a5d-16a5-46d0-a659-2cef1a118387", "value": 35632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763150527, "uuid": "df603002-5e48-40a7-90cf-ffa103ac75fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763150527, "uuid": "c7f7d3a7-bee8-4f1c-b848-4379c524a04f", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd3bd37a-c172-11f0-a129-42010a9c0007", "comment": "Malware payload (PhantomStealer)", "timestamp": 1763135926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763135926, "uuid": "870589f2-1950-4058-8390-a5486c14a106", "comment": "Malware payload (PhantomStealer)", "value": "6247981fcd3d80f9cd93ba45f4dd49b6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763135926, "uuid": "024c9cf7-9460-4561-9e30-43e701444ecc", "comment": "Malware payload (PhantomStealer)", "value": "c87a4f4c99917154abddc5b4dd46c3c3664e740b4435911361ba8786c51e3f2f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763135926, "uuid": "a3fc4322-1fe3-4427-9d3e-fb440617e740", "comment": "Malware payload (PhantomStealer)", "value": "65ff62c47a1ba4417e4d49194ab52231da12b072", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763135926, "uuid": "db577c90-3571-45bf-ba07-6ca1912dcc5c", "comment": "Malware payload (PhantomStealer)", "value": "40d26b559ca94bf8c23ce54aa55e011f798e92d90e3cd4861f468182ab9901786501d456954d8206569e9e4b570113c2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763135926, "uuid": "bfaa9c63-b9e1-44be-8726-7cfd5b8e99e2", "value": "T199E61AEC574B37A18FED71E96F5B9BCC7B3A019B1CAD612C2299D2900F90CBD5C494A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763135926, "uuid": "4963fd11-0529-4c93-bfa4-6b03919db5a1", "value": "768:ikSFCwDlDIFJnEd/hF2CkikkzQLVib7nE25iPIcvCmWTgrNTcZPDbFJSGaQEasNR:i9JD0Ed/n2C42nd5+IpmtNT2PdBlm+s7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763135926, "uuid": "d4179761-4150-4581-b905-69b9316229c7", "value": 14938685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763135926, "uuid": "48df780b-373d-419c-a6e5-a6852848ec2e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763135926, "uuid": "ae3d19a2-ac34-444e-9d25-d982d394c555", "value": "stage2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac487b75-c122-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763101511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763101511, "uuid": "74019398-c553-4ff2-9c32-1fedd1532388", "comment": "Malware payload", "value": "170f8b0901281b99f7348dea8089260c", "object_relation": "md5", "Tag": [ { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763101511, "uuid": "f9160cd5-66a4-4ac6-81f9-30529ee3500c", "comment": "Malware payload", "value": "c888c1a84539d6ba272270fa32a43723c98fe13342057139e0145a58e11b3ef0", "object_relation": "sha256", "Tag": [ { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763101511, "uuid": "33adc56d-c882-4c52-a433-d815ac868c81", "comment": "Malware payload", "value": "15fdcfb2029647fdce7a1a18b13ef7762b115d20", "object_relation": "sha1", "Tag": [ { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763101511, "uuid": "c3cef6bc-4fcd-42e4-aa27-e9cc264be043", "comment": "Malware payload", "value": "88822e004753627b53912c347cfec1f5b4399997b66278e15151edf3524568912439aba5ca024b973c470c67dae7b0bc", "object_relation": "sha3-384", "Tag": [ { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763101511, "uuid": "b204947c-83f1-423b-85f2-d65c3c89af4f", "value": "T1EC8733608A0A0B5A6FC2FAF1A3FA2F95139790D4C847DE7D8C5447253B5B31706DEB0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763101511, "uuid": "093a73b0-6344-4f41-b98d-4f4b46821349", "value": "786432:CiEqVGcGhUI5+Np9E0ZU1t5an+j2NXDAeRE2+bvJm0lljlQjmtgMqBcr3:10cGh4T9rv+aNXveLJ15CMqBcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763101511, "uuid": "f3114fc1-08a2-4903-8356-1181df9d65e9", "value": 38011487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763101511, "uuid": "31714150-699a-4b88-acfa-f58c1d37bc23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763101511, "uuid": "d710b5c1-d9c5-4634-b2fb-07524b576e31", "value": "Proton-VPN-v5.14.44.0-(Getmodsapk.com).xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82516c54-c0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763081254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081254, "uuid": "c1599ee4-3c57-4510-b4aa-1e361f42d44d", "comment": "Malware payload (Mirai)", "value": "6eb4adff8573dfd7ea2b678119c7d8a8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081254, "uuid": "92b38f83-0ae8-4ebf-8a3d-e1222ffbbb8f", "comment": "Malware payload (Mirai)", "value": "cd471294ae1e3a358447d3be81f7425993fd8fc9b9e1c23d6d9bf6cbd1d3b29f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081254, "uuid": "81fb9607-9d89-4178-8ba6-ac9a932e1bb6", "comment": "Malware payload (Mirai)", "value": "dce637014a7d55e7c927fdedb3d409798fa346f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081254, "uuid": "e6d74621-61ff-456a-b996-4fc2a219b751", "comment": "Malware payload (Mirai)", "value": "353bed4cf5091f0bfe7e430d7f5f33682e567cca065cab67c897e888f3b7f13f324518f9df930f4c04850138a0f278b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081254, "uuid": "ddf69023-6c82-473f-811b-7cf7848349ef", "value": "T109431891BC819A23C5D4137AF56E56CD372133E8E2CF72179E214F613AC682F0C6AE95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081254, "uuid": "ca6a5109-c583-4b53-ac25-2b3e478255a8", "value": "768:raehM993TLSmRTIrL8Fvvhp9H0HrZQ8yoWXagcLVPWtuQ/C71mA2EDEy0eYjW9TF:/M99jmL8BZp9IFUoWKdYuvQ5KIqkypZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763081254, "uuid": "62885130-2a7a-46ca-b286-57aed5e35d29", "value": 56160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763081254, "uuid": "b4124277-b5d2-41d7-9a26-93d9d7b073b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081254, "uuid": "5b87573c-696a-4864-9106-45bb79c6d43c", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84d64977-c184-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763143535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143535, "uuid": "9e19f60d-bc90-4213-8179-c02d649474a2", "comment": "Malware payload", "value": "35e8f031d5d3a705bcd05780cd4ddc40", "object_relation": "md5", "Tag": [ { "name": "anti-vm", "colour": "#F09D7F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143535, "uuid": "ab2b2c50-4c3f-4506-a1f5-0b7ba28a5e1b", "comment": "Malware payload", "value": "cdf92c4151397f89ca1ffec4e938c78059d9197f29895d1a9b6157013ab1ecc7", "object_relation": "sha256", "Tag": [ { "name": "anti-vm", "colour": "#F09D7F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143535, "uuid": "459ba3a7-82bd-4c82-8ac3-2696b1c247b1", "comment": "Malware payload", "value": "155a0117ce74ec917484d7264ea6a38f19a24ebf", "object_relation": "sha1", "Tag": [ { "name": "anti-vm", "colour": "#F09D7F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143535, "uuid": "c214d4f9-8722-4e46-b81d-71615f939040", "comment": "Malware payload", "value": "948956492c05f544827c4892106555bb015fbc55b868c26912381f2bf82124db9ae1c591440c8d8d1c7979abddf34e0c", "object_relation": "sha3-384", "Tag": [ { "name": "anti-vm", "colour": "#F09D7F", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143535, "uuid": "9f3e23f5-3a77-42ba-a784-1aead37ad179", "value": "T1C0F63381635E84C3C62080B1EC78DECBAED689837B0DD5877092B9AAF61754C5CD79B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143535, "uuid": "8046be2b-7dae-443e-9a71-23dbc32a1fb3", "value": "d221b1dc8c3a08622f6512e7876527c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143535, "uuid": "4476b10f-875c-4801-ac64-2ad6509cd648", "value": "393216:tVNgSOIR2RVVGpP/1L2u+LR7POjeav+WwELv3:riX1VIpPtLl+N7G/v7wELf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763143535, "uuid": "f0b09c0e-22fb-4d32-a9c6-11096015187a", "value": 16737683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763143535, "uuid": "90ea0228-d144-48a0-8da3-9648b02e5ab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143535, "uuid": "282bafbf-b8ec-4f20-aad8-b345d150a01d", "value": "Notepad++.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b05df3-c0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763081236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081236, "uuid": "752042cb-a848-4ff7-b18d-ce5bc643986b", "comment": "Malware payload (Mirai)", "value": "ed3e0a3e04dbb68b4149ebc872c1a99c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081236, "uuid": "ef0dd030-2b0f-4a67-acb7-72e5d3b02fac", "comment": "Malware payload (Mirai)", "value": "ce0cf3970c88e7fea48c6c9c7d00c5f847d7c508a1caf4780e9519031ea1ba42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081236, "uuid": "7dad7244-f5e2-4742-819d-d51d239669d6", "comment": "Malware payload (Mirai)", "value": "979b816f1b9815f1041d66e53bcc4ebbd94fb113", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081236, "uuid": "a4d15d9f-4c70-46bb-a02a-bc081050df46", "comment": "Malware payload (Mirai)", "value": "29b7e15aa720add905476556159cd503e28f9d5b432575c6e60cac3fdc209fbe100ec8c350dc8b31b1b413ad93d87d24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081236, "uuid": "4f163787-632e-44be-bb8f-aad283733ce6", "value": "T1B6330A8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081236, "uuid": "d8321661-eea1-457f-bccf-5179e00c1fe7", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oGT:r/hqaJMcjeqK806MHdMfQXoHuCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763081236, "uuid": "09be2a59-7cc4-417c-81be-9c0da7b0ce77", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763081236, "uuid": "80ba57b6-2c2f-41b4-a562-5d67dc590b43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081236, "uuid": "59b50d94-c379-4c6e-8888-747328d6117f", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d190015-c169-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763131872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131872, "uuid": "12806338-c59c-42a5-b1e8-e3a0e51ba108", "comment": "Malware payload (Mirai)", "value": "7b82e75f62ddd977e3bb10312a35c12e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131872, "uuid": "9913bfc0-eb25-447e-9a79-a592ff623c5f", "comment": "Malware payload (Mirai)", "value": "ce2349d37e0c1bf59794ee20811b70b8bf938b9285db88f80a070df4a22429b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131872, "uuid": "098f5d6f-7946-4555-a0ce-49ad8519edbb", "comment": "Malware payload (Mirai)", "value": "38deb4cab5840c11091d30e7cdfa59d13f4495b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131872, "uuid": "aefde5cb-8e82-4d51-ba1e-ff94d7511a3e", "comment": "Malware payload (Mirai)", "value": "a52b39410005287912ecedf94fdc5f79e5b603bba56ba181887deb949427b0f8f97674346245e70a348322c8946632b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131872, "uuid": "7176f3db-4ed9-45b5-a10f-0f13ae464970", "value": "T1C213E036C3E6BF70D17058F19F2486C3223317B85B86B9A51492311862A74CF6AD87F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131872, "uuid": "0e5fcd19-c671-4d3d-9b23-9ce362b627df", "value": "768:6bS9on/6csVvbDyep+rm63CsRV4lx6LEqI01y14ZNO6UGs3Uozz:h9W/6caGG2Xyx6m6Qzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763131872, "uuid": "6e453a66-fdca-476f-ba6f-df80879fe2d5", "value": 41436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763131872, "uuid": "71209cce-1f46-40a1-bdd2-a8e504cd531b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131872, "uuid": "16bf1406-2a85-4a44-bb72-0e47d81bed9c", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ffea6c0-c11c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763098913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763098913, "uuid": "5486a4ec-cdec-4b2e-a03b-f9019007e66b", "comment": "Malware payload (Mirai)", "value": "145cb1a86e3dfaa585e733281fbbe2af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763098913, "uuid": "e2daf4da-a301-4c38-aab9-65aba69b7280", "comment": "Malware payload (Mirai)", "value": "ceb9a594029a875ef919a6eaa153ddbb162b0753044d812bd27c9690873455d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763098913, "uuid": "e6a45449-1f77-44a9-82bc-f34860aa48dc", "comment": "Malware payload (Mirai)", "value": "37624bd46218c098b985035162277339a10e248c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763098913, "uuid": "5ba1bc5c-76bb-4193-909b-ee74ef2912ef", "comment": "Malware payload (Mirai)", "value": "e1b7d062ae053b2c4d8426e040c640583814d091208b4051ad6802d2901950a58a322b19b6e5bdf3521e6546f2eb6586", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763098913, "uuid": "2d05a621-291e-419d-9239-64d92ae73d42", "value": "T15FB2D0681343CCA3C971993A9E7CCD47226E56FDD1DA3B34570065A9A6E31090BFCA3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763098913, "uuid": "ab2687f6-d772-4412-a946-58a72852b2f4", "value": "384:LDU1FJSUAnvWkIZmyRrHaLXA4tOO2dORHl2cLGHBkMqset4Jte1t+z/oqCPhymdo:LDU1//ZbRr6LwHbORHl2kIVq7iterio2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763098913, "uuid": "12b39f0f-021f-48f9-91e7-cd85e304ebb0", "value": 24216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763098913, "uuid": "357ebce3-c32a-4015-8c05-7e7bd9ac375a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763098913, "uuid": "08488db4-19ed-4cb2-bd53-08af22c96733", "value": "wewe5.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbd83881-c152-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1763122179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122179, "uuid": "284c1224-b9b7-4c2a-984d-ec1768d3c6ff", "comment": "Malware payload (XWorm)", "value": "b382297b1f0ebe5d9ef1f3ee7f776520", "object_relation": "md5", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot8024716497", "colour": "#C22CC5", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122179, "uuid": "3ebc2038-6539-439a-a574-a5e038b81aeb", "comment": "Malware payload (XWorm)", "value": "cf098f81d68387d3491794c4f87c2812f5c0af3c5e7262cf90b40882975c930c", "object_relation": "sha256", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot8024716497", "colour": "#C22CC5", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122179, "uuid": "8983a9cb-b1f2-42d1-89de-57ada99ea3fc", "comment": "Malware payload (XWorm)", "value": "ebd16d7046ddd57d5e6e6d8d556880182223d065", "object_relation": "sha1", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot8024716497", "colour": "#C22CC5", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122179, "uuid": "1659f849-96d3-448c-af4a-517aa509ba6e", "comment": "Malware payload (XWorm)", "value": "3e5346c901811ea32925384ead7302a389cd8f253d9e14046a6a539b24f731955fd7e34be25cf481f5df8e0351e89b76", "object_relation": "sha3-384", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "api-telegram-org--bot8024716497", "colour": "#C22CC5", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122179, "uuid": "dab4d75b-b75c-4666-8071-b4f5295f7860", "value": "T1B404A37EE9E17D97025F6FA1BA722EFC02462D45FD310E7A845812A11CEE343BEA541C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122179, "uuid": "f125853b-9e52-42b5-8402-6f54f9b04180", "value": "3072:kBSWTd3Xus4g0IGixJvl5ug1mElSpSVAZ:6Tlu7gfdug1mElSqAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763122179, "uuid": "f4aca531-61a7-4e5d-a8c0-f87660229651", "value": 173483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763122179, "uuid": "abffd288-09cf-4a37-93f3-8fabc461f439", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122179, "uuid": "d9b37bda-5a17-4277-9bb4-400627022a8e", "value": "cf098f81d68387d3491794c4f87c2812f5c0af3c5e7262cf90b40882975c930c.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7e0dea-c153-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763122558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122558, "uuid": "3cefe273-12d0-4939-a938-b047f846f15f", "comment": "Malware payload (Mirai)", "value": "a7651a5bd001c5eae55f5c85a731bfea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122558, "uuid": "78183ff8-46d5-42ff-8d41-86feefb5929f", "comment": "Malware payload (Mirai)", "value": "d025b87c4b51bd661b8e84abfa8c18e837c96afbc45d9ed7c6994714664853bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122558, "uuid": "77b173bf-6273-48da-b8c1-2f894073251b", "comment": "Malware payload (Mirai)", "value": "40cef6438e688a594d58062d275326bcd94398ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122558, "uuid": "e14591db-35f7-4037-80ae-84a3112f134f", "comment": "Malware payload (Mirai)", "value": "88e9f7a7dad5fdec0dfe98dc8a7eb0c4cb984021f1caca3509d081f3525b4d68a0bf567c428384896a187c46549442f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122558, "uuid": "b3f93016-aefb-447c-b19d-de0cc753cf0c", "value": "T1A2C3E659F8819B21D5C625BEFE0F528E33135BACE3EE7213DD145B2427CA95B0E7A402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122558, "uuid": "6bfcfff9-c38b-462a-b84c-1b14c59055e8", "value": "3072:QVtmYTUAFypswlkektKrWgseaotFr6tU1oZdh1gixfZn5CM7:QVtmYTUAFcsweel6LeaotFr6tcoTXgoy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763122558, "uuid": "78fd9e91-0906-4653-bcc0-1f451dd5f327", "value": 124400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763122558, "uuid": "63894f3f-c466-4593-b475-93ef90bc15cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122558, "uuid": "d5521375-8f9f-4cd9-bd7e-150a85d30050", "value": "pppoeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d122cc-c164-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763129879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129879, "uuid": "4513c848-62c3-4477-ab44-4c0c713e952d", "comment": "Malware payload", "value": "641cca68609e07f46d1d4c452dc3664a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129879, "uuid": "3826eef4-e52c-4167-8b41-5ac892546ac3", "comment": "Malware payload", "value": "d1c47329cd0bab9d5d7d9518869c2ae0d6da0d62a4dc052f07ed3c39057bd2d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129879, "uuid": "be830c12-0493-4864-b246-9264dc361ebd", "comment": "Malware payload", "value": "06af50452c4cdad481b3c59ec6517f0aba182073", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763129879, "uuid": "3cb697fa-872c-432a-abc3-80d557f798d6", "comment": "Malware payload", "value": "8007fd2d42f3ed8c1da0ecc7d5b95c4d3294e030200566a6b5f74f19b04dc6daf14e00a1d0c91f91a01c15f6b5e96e4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129879, "uuid": "535a8f5b-12df-4c2f-afa5-60c4fed8f64c", "value": "T1F0F3FA01B8114B97C5C32BBBB7DF42993B376B1897DB3301EA18AEB42F8679D1D29111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129879, "uuid": "1b3b4368-4cd4-4fc1-a092-8dcb5731fb4f", "value": "3072:XNJTXgOVAoZwzeaLQ2PWHWlZ+eYWrbr/+vzBGwnUZ8WYUr3yH+XR:/zgEAoZwzxLbOHWz+ebD+vzBGwnUZ8WD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763129879, "uuid": "cc516be0-9649-4309-90f2-cb463fa90502", "value": 171480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763129879, "uuid": "d8cbca56-9ee3-4205-8c7b-1e10462d72d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763129879, "uuid": "19947b7f-e60f-4def-94b7-7685e16cb0c5", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b5f655-c15a-11f0-a129-42010a9c0007", "comment": "Malware payload (KoiLoader)", "timestamp": 1763125491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763125491, "uuid": "e62e90d7-143a-4d83-8afb-975bcce10ade", "comment": "Malware payload (KoiLoader)", "value": "484a42c7fea99e95c66a0f3365a51595", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "theoremaoliveoil-com", "colour": "#EF97C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763125491, "uuid": "ca37d5fa-f4cf-4abf-b201-5e481cb88fb7", "comment": "Malware payload (KoiLoader)", "value": "d3e4dfd4d8b165b33574d231be9b1d3c31d243cb145c79987a5f2f59554f4b77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "theoremaoliveoil-com", "colour": "#EF97C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763125491, "uuid": "7f9efc0a-afd5-4936-ac91-c48e837ec93b", "comment": "Malware payload (KoiLoader)", "value": "767b157ab62347c827fcdeb2bbf02b199f038ade", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "theoremaoliveoil-com", "colour": "#EF97C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763125491, "uuid": "476eb0fa-93da-4052-ad2b-a1aacd9b6f3b", "comment": "Malware payload (KoiLoader)", "value": "5fffd8659f12d1e7aaac22616c23e730ec846df7abe484ea2f8dbc51ff746d10e5d42ef664b22c8b7b741ae9c421bcff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "theoremaoliveoil-com", "colour": "#EF97C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763125491, "uuid": "48cbd7df-1cf0-4adc-bab0-dd23a43a2a05", "value": "T16B447CC3B1A51178E532B2770C1FADC85634E4181BCAEECB636A7D1A3FB58414F61C9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763125491, "uuid": "1583ba74-8754-456f-b229-c8044fb2b2d8", "value": "66deda4204cb009d8c01c3f28c17567f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763125491, "uuid": "8feec79a-bb28-48e1-ad7d-ebf51eb76b54", "value": "6144:1cqVD6AjBOLIERTEGEwC7BtmcbB389+0iOwVfWw2wgKu+IUbwhuCv:OqVDzoKjCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763125491, "uuid": "e37d7877-7624-490f-822e-04449c38fdf7", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763125491, "uuid": "ae006c82-fa07-4039-9d2e-99ea723f85ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763125491, "uuid": "13cac137-76be-44ce-81be-a611bb4410bf", "value": "pieletJF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e75a74-c1b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763162791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162791, "uuid": "09141275-389f-41d3-852e-d1e86fe64805", "comment": "Malware payload (Mirai)", "value": "6e392aca92e0bf020c9440b2e8442cbc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162791, "uuid": "380a125c-d3e1-4457-add6-269d585b9dd5", "comment": "Malware payload (Mirai)", "value": "d3f10f6d5e3c2b912e20a40579c75536930b660f07129c21bbd9788ac4efc728", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162791, "uuid": "7fb38e5f-0676-4dfa-a63c-6272ecccffc1", "comment": "Malware payload (Mirai)", "value": "29a6ad5fe8140d0fe5409a34eb943b1680dd23be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162791, "uuid": "e0cda004-11e7-4632-8741-3d5ea6b37810", "comment": "Malware payload (Mirai)", "value": "467832309136999c68a349b3a337580d10b720324ed905fda7018325f3d6080eb615c4ed1fb2e93bf95b3900bb260ccb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763162791, "uuid": "d955ed60-ecf5-49c8-9828-7e55a3675904", "value": "T1E313F165E298925DE01F0171186BFE483E54A22F043C85F9FA9C921EC892B4CBF48367", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763162791, "uuid": "ce98ef99-97ab-4cf9-8903-07bed0b650d6", "value": "768:UcKmeLMxHfx3DKQsfnwGaE/NIpODDKnrC+6qD0T0FpWVizg9C4oMupWOgK9UQNvi:aJuJxsfapOfKnKqD04a0zgXoXWK9UQNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763162791, "uuid": "dafe27af-beee-414d-b4e3-647b2178b01f", "value": 45112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763162791, "uuid": "d64fe70a-f94b-4c8a-ac74-91a0511e48d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763162791, "uuid": "0ee880bf-70ab-4bd3-8d90-8762681e7737", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345ca0f7-c189-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763145548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763145548, "uuid": "3a9be14f-932a-4d95-9045-1588477e7f43", "comment": "Malware payload", "value": "18e839edbcd0a74c74b377f46bf6b45e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "ecd247", "colour": "#4470C0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763145548, "uuid": "e86945fc-a36f-4626-9aa5-b17d58ff29d2", "comment": "Malware payload", "value": "d485217891bdd5dde6ab8c256fd8618be941905fb4c89513e7c14b42c0ee9f06", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "ecd247", "colour": "#4470C0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763145548, "uuid": "53d20334-f223-4fc2-bd27-ac637ffbff1a", "comment": "Malware payload", "value": "08d0d0e0c9e0444b7fbbd86b198a66dbf8965221", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "ecd247", "colour": "#4470C0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763145548, "uuid": "01df10ff-c99d-49ca-b513-bb0cacc40e81", "comment": "Malware payload", "value": "a8540a88f3245b9d7d970bea2afcf64174bed4cc2096fa28536ae42bdfcd56649b18a2f24de12502cbbfa960c9d6d6da", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "ecd247", "colour": "#4470C0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763145548, "uuid": "fa4b21b1-ae55-4e0d-9be7-9ba2d7dc17f6", "value": "T11EE5D71BF6B610D5D1BAC038D553522AFC7134A6833C97EB92818E495B60BF8EE3E741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763145548, "uuid": "90d7fd73-fa08-40e0-a907-5919b429d822", "value": "97668444bed283e2d07fc00ab4c928f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763145548, "uuid": "10ef2c83-6f0a-4824-b17e-100aa27e71d8", "value": "24576:pN6ktuqNbPVxogkukK8IakCpG0zzXgKci:31NUgkRVIGVtc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763145548, "uuid": "0700a1ab-f7dd-4d82-aaa5-4d2d40128267", "value": 3130880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763145548, "uuid": "cd47fba8-a4ef-40e6-b8b7-b0437179928c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763145548, "uuid": "7103275e-d444-4e7b-8cc9-6182e3fb23ff", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2caaff0-c169-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763132016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132016, "uuid": "cac92970-1b38-4320-9288-36396ba34eb6", "comment": "Malware payload (Mirai)", "value": "ec73409cfdfca57734a674df578ec65f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132016, "uuid": "119b0f87-655a-45ec-b747-f2230afce4fe", "comment": "Malware payload (Mirai)", "value": "d7131bb5a45b845b7d076c815d2d2d9471167e4ce0c270fb6b1ef2f1751e4212", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132016, "uuid": "028538df-a994-413a-9e55-fcdd59a1dd95", "comment": "Malware payload (Mirai)", "value": "19af6380ca25a8c7fc87c825c3f5d46278e203e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132016, "uuid": "1af41797-8750-40c7-99f5-4c30ca1ef503", "comment": "Malware payload (Mirai)", "value": "86556bbf7719bbc61004eb457bcfb10ee240c7c913ab43866861da645b241b3a48b338ccf03036395602d18a44d22111", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132016, "uuid": "693d55f3-167d-4bd2-8d3b-5fa78f41d433", "value": "T15EA33A86B8409B11C6C15577FE1F128E331347BCE2DE33129E185B647B8796B0E7BA4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132016, "uuid": "6be930b0-89c0-47e9-944b-409887403cab", "value": "3072:i50T4fWX9UjjLhUnqU3IoUYwZaf4+vG5hV:i50T4fWX9UjjLOr3ICEabG5hV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763132016, "uuid": "1bfa276c-01ad-45a7-bd0d-ba4c2057f34f", "value": 100584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763132016, "uuid": "7623c7d7-c5ed-4e02-9ee6-3e8513adb680", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132016, "uuid": "defc3106-67b3-4997-9646-1355daa7af22", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d3d8012-c169-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763131899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131899, "uuid": "16fd8b19-87a8-4cf7-a76b-269ee01ab3d1", "comment": "Malware payload (Mirai)", "value": "dc848a1d77ba97ceeda9913c4201aae3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131899, "uuid": "19b503b1-f602-403c-ad72-17a3cbe5ed57", "comment": "Malware payload (Mirai)", "value": "d7827c3a2e270b59f29b005fd1aa37bed060bdb2467d463b42cda93dad93b7b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131899, "uuid": "95d6643f-370b-4c8f-afda-1e8a53213000", "comment": "Malware payload (Mirai)", "value": "e5b6620835f9336eb1defe2e34beacc9058d13ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131899, "uuid": "3317ffcb-a05d-4f90-b079-e645342916c6", "comment": "Malware payload (Mirai)", "value": "9ae493884a3f291e5c18bcae34cf63f4cc20523ae5f6d1242e5fe5ffee5233919c0528b5f3463690ca5408e395d1a3b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131899, "uuid": "50e22fef-728a-47b3-b4cb-32c3029638a8", "value": "T10F838C02B71C0943E1A61EF0393F27E1937FEA9101D6B1852A0EDF459131E335A9BEE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131899, "uuid": "6af275ee-eb0f-48d8-a5a4-6d9a0c7572fe", "value": "1536:YwR85vd3qycGJ+AgOr4G2VoiRRat0IJRl6lntG0Z9nX5hSt:7RQdLtcGs/q0I8b3X5hSt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763131899, "uuid": "3f78d2fc-5fd3-4966-846c-e32e8e0069d0", "value": 88668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763131899, "uuid": "7f375433-bf2a-43a3-8cba-e5cc356ac1bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131899, "uuid": "4fe82704-2a00-4b40-960d-6fe3c208240b", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf02bca5-c13d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763113139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763113139, "uuid": "e21572d2-efa4-4907-bf11-772ed23106d2", "comment": "Malware payload", "value": "0c12ce1405d2de54e2a87c470bdd0a67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763113139, "uuid": "83fff729-bbb2-4f36-a797-af24cf94f6fc", "comment": "Malware payload", "value": "d7e18b7363742f6dbf2d8cdf352d83419e2d19f1a1b80c3c7f9074816265d5be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763113139, "uuid": "fd84a690-ee52-4c20-934a-b9e8eee3f193", "comment": "Malware payload", "value": "57648a67f7f13187afdb4f24bbc6a60b170733b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763113139, "uuid": "72a4069e-8575-4572-95f9-d12dd55816a6", "comment": "Malware payload", "value": "0ca76e11753b145d045332179064219c6482a31caddc40cd0b3de4dcde05e3401bdccab7c28cf0ec55c134c577f6dffa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763113139, "uuid": "f1dea89f-953c-4eef-aabd-149630e23c72", "value": "T1F0E63707FA91596BC955923A896242C17B70FC486F1AA7CF6A54F33C6DB37D0ADB8300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763113139, "uuid": "d9dbda65-9080-4a44-bd6c-33c6943a4911", "value": "4fb21852370c7b61f98b9c32c7e11a6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763113139, "uuid": "a7a0f5a6-598f-4727-bac7-0e5c173e3163", "value": "98304:3+0hf1CS8d3J7EN7bt9O6SbXnfvbbwX1X7i1QxwdG/ZC:3+gf8S8VmM7LfdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763113139, "uuid": "710d0ca1-228f-4fd9-9610-667acde52399", "value": 14676408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763113139, "uuid": "5499af08-c1c3-4a87-a9c0-fa3617d8d69a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763113139, "uuid": "cd78edf1-40d6-4ed7-9ed9-72a75f686e43", "value": "DefUpdater.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48bcab5a-c153-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1763122389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122389, "uuid": "a17df230-1dc6-4471-95c2-7f317b3483c7", "comment": "Malware payload (AsyncRAT)", "value": "c69bece8c12d0c636b59f1d252075200", "object_relation": "md5", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122389, "uuid": "913ff030-0bd4-4bae-84a1-8e7b552b8225", "comment": "Malware payload (AsyncRAT)", "value": "da4374662fdd80ab25c5aa7110fd827f752996b2f1291928d17ef277ee4c945e", "object_relation": "sha256", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122389, "uuid": "c8e76c88-06f4-4a55-8dcd-71ee00161807", "comment": "Malware payload (AsyncRAT)", "value": "462af7ba5ed9807e199683f0a9bb4cbbf1675d68", "object_relation": "sha1", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763122389, "uuid": "0681d7e0-87f2-4050-8f3a-086d7881118d", "comment": "Malware payload (AsyncRAT)", "value": "7b4f08e8b6db8439778575b62c2d09ae52df418d83dc56fed2438cc7e7d77938758f86e60cddd7678a71e60a9fcf7617", "object_relation": "sha3-384", "Tag": [ { "name": "31-40-204-73", "colour": "#566E46", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122389, "uuid": "3e3943b1-ce15-453e-8e02-489ad98b8e37", "value": "T115F23C483BA14216C5BD6FF11DF7B2054275F60B9823EB9E0CD4D5DA3B63AC289103E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122389, "uuid": "bef556bc-9ae1-437c-be2c-fc0f5e49f7d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122389, "uuid": "4101114d-6cd0-4e2c-8bab-cd999f5c8d7b", "value": "384:GFsnXdqquPnEOv5IG8q1vz62dZA4OLrxyqYDFNVERZpkFTBLTEOZwEJd2v99IkuS:xU/rdkrxyqYDFNuiFE9jgOjhjbLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763122389, "uuid": "397937dc-e45d-4806-872c-cb1d14e5991f", "value": 34816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763122389, "uuid": "e2a7e687-9160-4e1f-b589-da75c0dd9c7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763122389, "uuid": "d8eb0e3e-7dac-410b-882a-fb1c4bf25e58", "value": "da4374662fdd80ab25c5aa7110fd827f752996b2f1291928d17ef277ee4c945e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddcf16cd-c147-11f0-a129-42010a9c0007", "comment": "Malware payload (KoiLoader)", "timestamp": 1763117485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763117485, "uuid": "eae6b75f-2d21-49e9-9fc0-833ac67e3775", "comment": "Malware payload (KoiLoader)", "value": "f60f7d3518c7b6648e613f0df3ec27af", "object_relation": "md5", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763117485, "uuid": "e97a0d02-4a23-44a2-b54d-4ddffde4cc79", "comment": "Malware payload (KoiLoader)", "value": "dbe192ea36ed20f78c54b322bda0bab81f647c4bb7df42cdad3ef74ebb8f56bc", "object_relation": "sha256", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763117485, "uuid": "cee46625-2723-4f56-bbbd-08cafc7ebea3", "comment": "Malware payload (KoiLoader)", "value": "3a57fa7bac04646431825fdbf060c4f9195bba0d", "object_relation": "sha1", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763117485, "uuid": "26d1950e-06b5-4d0d-acc6-1bafc3f760ab", "comment": "Malware payload (KoiLoader)", "value": "44b480f238b0d5c2970b867e8c2780af0b0a768e3352f8cb31d9e22a09c735c00a15ad99f64bb546abaacbd1037708f0", "object_relation": "sha3-384", "Tag": [ { "name": "KoiLoader", "colour": "#B75296", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763117485, "uuid": "99ec221d-60f2-4d78-91f9-81fff1aaa1a8", "value": "T127A47FEB57751C960DC7377CD6926BC3EF8B28B5016240DBFADD592EF08B15B806082A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763117485, "uuid": "02c0aed0-f78c-4c65-8ead-7418fc79449f", "value": "6144:O6jwVLswNLmneiHN8gVMmCTPVtyJCqJ223HuX1AYfvNUsJXa4N0PjP5J9be881na:g3W9kl6gc/Ld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763117485, "uuid": "c9d64d1c-068f-4b10-bb5e-f8fc1a1e1f2a", "value": 478124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763117485, "uuid": "510259c2-7030-4245-8219-424dcaa7aa9d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763117485, "uuid": "3d55e5c6-8c01-40e2-87e2-a80e5457b468", "value": "sd4.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b29f36e2-c182-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763142753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142753, "uuid": "e34c33ae-38a8-4a7c-82da-90dc575f78c0", "comment": "Malware payload (Mirai)", "value": "e799595cf3c7d8c5979700a118de4d37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142753, "uuid": "0208de99-5294-40b2-b529-af35a2f7fde0", "comment": "Malware payload (Mirai)", "value": "df256191ade26b37f9110521e076a0cec4dff1976c2329af6175357027f6e51b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142753, "uuid": "acf9df68-b9ca-4145-8041-8ea0a6679ada", "comment": "Malware payload (Mirai)", "value": "c59271996d7d4e6b12d7e8555559969125bf7a15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142753, "uuid": "7b392b5e-526c-4ff7-b96d-b26d271b7eeb", "comment": "Malware payload (Mirai)", "value": "7879068e63b6abe3167d82963568ae4bf5f374479cf5160082d6b51e032266a242c2288606298eb5ebac92085a18b28b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142753, "uuid": "e1890d4a-622d-47d0-8856-dbc9b74b5617", "value": "T175158C1AB2B2F27DD007C0304BDBCAB15132F0756A322D7B22C59B353EA6DE51769B25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142753, "uuid": "ef000952-7375-4fca-a049-080d9183a5c4", "value": "12288:xcuBNg4L6GYPTg1d8Hnxuo+ydbwjuDfl9m2sHaypa5VHXY9AI7mXOXY:xFBNgkuT7VxwEflE2t5CSI7me", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763142753, "uuid": "dc1e26c4-6511-4f83-af5b-a4e3ea72e136", "value": 954184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763142753, "uuid": "69c6832f-ba2e-45ae-af3b-33857d33a631", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142753, "uuid": "7490a20e-c6de-4a72-be3b-5ab62f5ea33c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe300e7d-c0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763081462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081462, "uuid": "5da42169-3bd9-4f11-9c90-c06a2adf04dd", "comment": "Malware payload (Mirai)", "value": "e9e3ef7db659e8970009fac41371eef8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081462, "uuid": "ed820465-53d8-4962-8435-df38454cd39c", "comment": "Malware payload (Mirai)", "value": "e01f01503a980e90f3cd4adf8cf86b5e611b212707d37199eeeaa3d0170d5afd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081462, "uuid": "e9d6f99b-cddd-47e6-a442-bb6743cc577f", "comment": "Malware payload (Mirai)", "value": "4f0679f48fa668e8faf63d3f6944a343d86c80c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081462, "uuid": "77098da8-295f-4b12-9255-89362f18fb07", "comment": "Malware payload (Mirai)", "value": "561b624b3ebba15a0ce04c60c14c53aa6b67121846befbfa5cd446d650e28a179eb7be4c0119bfd92ca249cd81ad3579", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081462, "uuid": "e148b333-606e-43a3-8db6-29c32b2bfc10", "value": "T1DCD32805730C0A47D1632EF03E3F27E1D3AF9A9121B4F640695FAA8A9271E325586EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081462, "uuid": "9719a759-d9c0-426b-b662-6393638b64f6", "value": "1536:kzaT03jXgblVuMNaTx0L3bgq/Tx0XxdcvAplyAXgK9X1Cxe22sq1F4pM5:VTLblgGuxkH0XtpVHN0p0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763081462, "uuid": "a0b58773-b4f3-421f-b7b5-9d52f421771f", "value": 142256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763081462, "uuid": "3bb9cbe9-5527-4b67-80dc-139f01ce8a99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081462, "uuid": "f5fecf07-0485-4ada-92ef-4b4a883ca271", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8450e63a-c127-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1763103591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103591, "uuid": "cff1ccc9-2474-4cb8-9a88-d2ef7411cdb4", "comment": "Malware payload (ConnectWise)", "value": "01075829dee6b90de87d0c3df2914db2", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103591, "uuid": "06673114-1b7d-4d91-8d29-40ebeb07fb6b", "comment": "Malware payload (ConnectWise)", "value": "e152fd89e93197cfcbcce2f6ccc5214675ca802ebd56aecf6d5e42da9fb3847a", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103591, "uuid": "160b9f8a-fb9f-4995-92b6-cfc8059330d5", "comment": "Malware payload (ConnectWise)", "value": "78c40432cb69f037a24e15962f2deb2bb8037b11", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103591, "uuid": "41505375-653d-499c-8f11-ed632446ef06", "comment": "Malware payload (ConnectWise)", "value": "4670b9d8452bfe8e47f27d4c760d3feb899516de67f098c5de54e999ad318de6066d8b69245d373147c6b1aac794cdfa", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103591, "uuid": "9d589c6b-edd3-4af7-92c5-7c9469b1c3fd", "value": "T1CCA6232063F89115F5B71F39E938A6B019797C25DE61806F23593E6D2A30E81DAB3373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103591, "uuid": "2dbfb19c-3a7d-44f3-ad48-bf24653e49e6", "value": "196608:WVMLruS0ALSwy9VMLruS0ALxVMLruS0AL0VMLruS0AL:vXRrycXRoXRFXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763103591, "uuid": "b9538cd4-3b00-4dba-b6aa-1949ea35dfe1", "value": 10035200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763103591, "uuid": "bdf4a3bf-b7ce-4c28-bac9-04c1e99967dc", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103591, "uuid": "befcb17c-fa3f-4520-8856-e453d67074c8", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7da1a7-c1b2-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763163201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763163201, "uuid": "93221f50-9a3a-45c2-adfe-b6ec826fae64", "comment": "Malware payload", "value": "705272c36e975058a0d80fa3c4473390", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763163201, "uuid": "dbf47394-fdc5-4578-a15c-7d9eb62e1c19", "comment": "Malware payload", "value": "e3321daf1333a29a72875335ca348f63c7d8e5b0b6f728d8ecd8967285aba521", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763163201, "uuid": "8747b353-c1fe-4f0a-9cd8-97370408024c", "comment": "Malware payload", "value": "0803ed4310c940301a3d23a66b4436cd0cef9cde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763163201, "uuid": "5a5524ac-5ca2-4af7-a2f8-dbac25f146ea", "comment": "Malware payload", "value": "db1e2525a393684b393b486482480bebeb9b239de67af383466b4870403b4971304f5188c49e403135d908842aea3e5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763163201, "uuid": "1fe009c9-3d60-45be-b576-1a07074f35e0", "value": "T12A512219D6076AF1CF4908B2158BE9BF9F30B674E872CD52FF609A21BA43D2E0544F16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763163201, "uuid": "fdc18060-c011-492a-a8e8-66075e423f39", "value": "48:6lpeVf6foV1lFk/Ek3bZHMaZGWD3abyNfbqUN6icRaL1dHx6:Cwf6foVqsk3b8Jf5RaL1dR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763163201, "uuid": "2f4235ce-8275-4130-a453-026c3ad04e74", "value": 3072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763163201, "uuid": "2d19f40c-596c-422e-b294-08d9b02cecdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763163201, "uuid": "d7784275-df16-4a8a-be17-c4b1ad8bb0fa", "value": "SecuriteInfo.com.Trojan.DownLoad3.40744.6436.7500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699ccb08-c167-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1763131034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131034, "uuid": "4c6d9cb7-2089-4b03-acdc-7c15d9669752", "comment": "Malware payload (AgentTesla)", "value": "7557881164c3d2b5ab5cf563dba1565d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131034, "uuid": "f64a5748-ba12-419e-8fa8-f3c2980b894d", "comment": "Malware payload (AgentTesla)", "value": "e483a5db130d36b8394c492a78f8a275858118d6f776bd669d7dcc5ea17c8035", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131034, "uuid": "717f2d51-da04-4448-ad00-d6ad1ad06fd2", "comment": "Malware payload (AgentTesla)", "value": "3375cd86dd4b462825a1a1363c2615d5428feed1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763131034, "uuid": "0e744f8c-aad2-4a4b-b9b9-511331998502", "comment": "Malware payload (AgentTesla)", "value": "02173d1ae83812c7cd10822c3d8a04baab765d8196d4cd4fc56703b2a3540a3a0e18dbd7f746529f03997bd660953573", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131034, "uuid": "82989db2-da61-4c85-84ad-0b7038d6eaf7", "value": "T1AD05232BA093C6A439785E81E1EFD8A93CE5F449A9B7413CF9A1DB13361422CD5C261F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131034, "uuid": "591d74eb-a85e-4ac8-ac1e-1e7f8d8b0fc9", "value": "24576:BKz8avNpv47F3ZDChyuyV0eBXWRY02YW2rqsx+CgcQe:BIHvUshyuyV0kwXZG7de", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763131034, "uuid": "dbfcf0d0-d2c4-476a-8790-5c90d2752617", "value": 806921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763131034, "uuid": "e1ae0589-3c94-440e-91f6-006d90c7fad3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763131034, "uuid": "0e809ef8-421e-4bd1-b0ac-bd90b1c9a55d", "value": "PBC_YD10_INV8035360426.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4c1b55a-c185-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763144072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144072, "uuid": "3ad99427-114a-4589-aa7d-28ea37658dea", "comment": "Malware payload", "value": "d646e56169d0760b259cee658cc6c426", "object_relation": "md5", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144072, "uuid": "06d2052a-a0ac-4833-ae36-608fbc134e9f", "comment": "Malware payload", "value": "e48ec0bd3f1c4ce9e13b2a010bdbdd0eac0b33511458478127762fc02d6a1920", "object_relation": "sha256", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144072, "uuid": "a95b56e3-d21d-472e-acbc-dd5f3a3ea85b", "comment": "Malware payload", "value": "9a7ac0f4f15c754d3a3512f147a192c77531688d", "object_relation": "sha1", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763144072, "uuid": "bbade375-1ab9-4a1f-a708-00aa4d90ec5d", "comment": "Malware payload", "value": "c390014bceada8807b6c289c6f49924dc5ad7327955979c578c00914aa7b270a8391d0fa8ad94fc604ce238d25c1856a", "object_relation": "sha3-384", "Tag": [ { "name": "AURAStealer", "colour": "#64E750", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144072, "uuid": "1ec8c395-9cb9-47d5-bb1e-693f89c6cc91", "value": "T18426AF13ADCB4866D099A2328AF64176B6E17CEC273127D31D507A3A6E323C01DF7B95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144072, "uuid": "48272a45-5e9a-4316-888b-7a170ff54b47", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144072, "uuid": "c6cad880-879f-4198-a4ad-fe3c669eeed5", "value": "98304:TkLt7UcmDVXAHmxbGv5mkDpD11u+y4OiZrq1DfPHNADtV6v+x6:TotHO4O7NADtV6v+x6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763144072, "uuid": "44a7ba3d-b725-4735-8408-1000b80c6d7c", "value": 4668992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763144072, "uuid": "6ae8dc78-1fd9-4816-a6fa-d1ed1092aa26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763144072, "uuid": "5f437397-f967-4600-a4d0-fb45a75f7067", "value": "e48ec0bd3f1c4ce9e13b2a010bdbdd0eac0b33511458478127762fc02d6a1920.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27f1021-c18f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763148309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148309, "uuid": "7ebecfff-1ab3-493f-b43b-5940f06f863c", "comment": "Malware payload (Mirai)", "value": "4723a5102892e21b7caf211a2e43b859", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148309, "uuid": "85c41ded-e38d-46e1-8e54-8cc4199fb919", "comment": "Malware payload (Mirai)", "value": "e5d91dc8f6a95f296444c3eaaf8456d308b004975f2574171b76a7fdb33b5a6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148309, "uuid": "94f46750-5825-4b79-925d-89ccec5e921f", "comment": "Malware payload (Mirai)", "value": "01d8d4d9df2a6a84000e79a7f80ce865839a6f8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763148309, "uuid": "854c67b6-1d81-46e6-959d-cc0aa3851e7e", "comment": "Malware payload (Mirai)", "value": "c2f6b9a70fec4ddc9a32341f193f08f08ba60c3624edb3ad32347d7e7ccca604fe1d63e9076d8b4f44359baabc3a2486", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763148309, "uuid": "ae387407-75ca-4cc9-97f7-7680bb2db187", "value": "T1D7F2E2C3A199B7BAC99FC377A62F3E4B9500384E215C8D639EEC10FA6197304597D909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763148309, "uuid": "ccafa7dd-9d8b-492f-a787-438747e9e421", "value": "768:uFcweHfbq7yjcOSF8szsGqLbItHbmzD1U+KEprhVcNL4bCmXknqgnbcuyD7U9URM:uSweHf+9OHszsGqot7mzD1jzANL4RXRK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763148309, "uuid": "cafd4da4-7361-447f-8a20-a080d8ff1607", "value": 36676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763148309, "uuid": "479a11eb-ba6b-456a-8566-fd71315fb0eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763148309, "uuid": "319c2c57-0f5d-4130-9185-62bdae9d3f4f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e90da6-c19a-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763153176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763153176, "uuid": "bd8abaf0-da04-4006-ae39-da07839dd53b", "comment": "Malware payload (SalatStealer)", "value": "f3736fcd135bc4ec4fd9447c6034ee3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763153176, "uuid": "20a360e8-e30e-40c6-bbe0-d4120026d5d2", "comment": "Malware payload (SalatStealer)", "value": "e5fd252ada8ccf7f1d9b93ea29337ac751650f8c6d954f4a718a22fbf81a1168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763153176, "uuid": "0b47e04c-ebbd-4e35-bdd2-3d332a293905", "comment": "Malware payload (SalatStealer)", "value": "99d3c763a96f6f3f6b4e78b7dbfe1fab7e6c271b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763153176, "uuid": "b462e129-de03-45d6-bed6-79e286ae81a4", "comment": "Malware payload (SalatStealer)", "value": "7991dccc35f7789886f7c5916de54c42cdf483d942a23e96e254c2f35fcc9787934bb372ed0860850413c829feda96b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763153176, "uuid": "262e5371-23cb-45aa-9300-4deb70e68e7e", "value": "T1F1F53387C8A2E8AECDAFFB723F998221D3540D3E6711158E7AC539BD242D819FC53119", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763153176, "uuid": "183c9a45-863c-413d-a128-4c501f3c5a0a", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763153176, "uuid": "ee39beb0-3a23-4982-b281-3988405b30bc", "value": "98304:Aw04j0skf0JKNpBhl/s0Tfiv8WNa7JEe4Md0iX7WSvfvzhQ:6u0skcyp3l/s38WM7JEe4Md0iX7WSvDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763153176, "uuid": "dbf6f635-3a03-4359-b0c2-3383b68b2486", "value": 3561472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763153176, "uuid": "93f8239f-2aef-4b27-8a78-7d59f854fbcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763153176, "uuid": "78ee7a74-70a5-41c5-b367-84e155c4df81", "value": "loader x.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8891234c-c0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763081264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081264, "uuid": "7755fc77-3510-4ba3-9f14-3f22b4d10f60", "comment": "Malware payload (Mirai)", "value": "a5b17bb4c39b6791cc6c923ec01c9fc8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081264, "uuid": "b10a2662-5c2b-4012-a125-dbcfb15e1d9c", "comment": "Malware payload (Mirai)", "value": "e6d505dac29fe184470afedad007eade3325fcb4d65f93003fd2f3d1c5fdc71b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081264, "uuid": "bad3bd72-0650-46ac-bbe7-15d9f385d2eb", "comment": "Malware payload (Mirai)", "value": "16c2092ad8c72b6a0b1237419d6535f6e8530a4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081264, "uuid": "e5e88e5e-e1bd-4742-946c-4999c98da93a", "comment": "Malware payload (Mirai)", "value": "bf5c606a998d414bf56dbdc39f0409e91a403d7db2a0736b705625ec393907d53791d1558c0d80bdc5180025b3ac90b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081264, "uuid": "0e3f1d6a-b845-4a93-b121-faf0dc59bbdd", "value": "T124C35B42FA418F13C0D61779B6EF42493322A79593DB73069A249FB43F8679F0E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081264, "uuid": "1215b4a0-6b60-4a81-8488-a12405181218", "value": "3072:cowpuQyNSG2eRa1styK9flTQPHotrScVM/9OAvjik:cowpuQyNSG24a1styKdlTuItrSmM/9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763081264, "uuid": "01bbfdb6-18d5-4fa3-b760-8876e5d602bd", "value": 129940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763081264, "uuid": "1e0b08c3-bdbc-4b89-a1e5-ba58415340f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081264, "uuid": "07149e83-5d81-4ea2-af40-5eb233ee73a6", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f67931-c184-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763143316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143316, "uuid": "640f4b05-be2b-467d-a3ef-64e9fbdaf2f9", "comment": "Malware payload (Mirai)", "value": "0a682ddd1a72ff4dab745d79a7a418c3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143316, "uuid": "615090a8-3038-46f8-996a-00b312d6cbcb", "comment": "Malware payload (Mirai)", "value": "e8fc9de9dfee334acfba8240362c17afa62d1a91bfca18c909fed02ff898c1bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143316, "uuid": "d757704d-1d21-4083-9ed8-ff983649a99e", "comment": "Malware payload (Mirai)", "value": "67c6c594960fb58620bdce2c06e454f0918b7abf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763143316, "uuid": "0a0a3604-1b2e-4d37-876a-627c472f31ae", "comment": "Malware payload (Mirai)", "value": "1497b108235381a8f5edc5cdff1159c054c445d141ec01a5f0bcfe68b75643f0f3a2d957095e5966f2833f6012fef77a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143316, "uuid": "5ec67d45-21e1-4098-adf5-3cbff2db44ca", "value": "T153141B02D5518B53C5C61BBABB9F425937336F2493DB3301AA28BFB42F86B9D1E2D111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143316, "uuid": "ceac5cb5-cbbc-4962-9786-f660c831ad86", "value": "3072:xCVRhhtQmNIpa5Xan/qlPmgH3MO4IHxEndw4mWltY2ZTOAE4Cs2:xQZtxNYaFXPmgH3MO4QEna4mWltY2ZTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763143316, "uuid": "5e778d80-b412-4953-9b9b-5b82e0333e26", "value": 193643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763143316, "uuid": "09fd704b-bf3a-4e99-832c-3b9a4f545221", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763143316, "uuid": "32895589-5c18-44b1-8b0e-0647a2ac20b2", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4135537-c0ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763078814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763078814, "uuid": "0e9e154a-8378-4450-8b3a-f9c7e6b618bc", "comment": "Malware payload (Mirai)", "value": "ee4beb89b58b02d9cc6b8e374fc88a5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763078814, "uuid": "2cc1abc4-a635-4617-83eb-e1eaeadc7f2a", "comment": "Malware payload (Mirai)", "value": "eaeea354102e2a4d349d5dc5cc21f600ffd449c1e770532e4176b7550866f0bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763078814, "uuid": "ab2faabf-903f-473a-aa5f-432fe59ef311", "comment": "Malware payload (Mirai)", "value": "363a4e563c307b932e783e4989306574cf88c216", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763078814, "uuid": "7c86743c-ac8e-4648-843c-8682ff4ca8f4", "comment": "Malware payload (Mirai)", "value": "20c0b9db767fe453359eb8c2f812dffe021cd5a428f65ca35aca05cfa3ea9100a7898e5f4d03029c366c4b44aecaa001", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763078814, "uuid": "15710dee-b478-4860-b456-447f9db2f990", "value": "T138534B9EA801CD3CFA0AEA7ACC1B4F05F525772456820F17A7AAFE935D710B48D2BD41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763078814, "uuid": "fd6055c9-5727-4529-bc2b-dfe3e9f6af48", "value": "1536:dgCgicUwqiVbJE3H7vvvvv1mxnGCCm1Y+l1DGe6KI/8CAOaTPM:dTgickEJEX7vvvvv1mxnGJKYAGeITv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763078814, "uuid": "424932a2-ac3f-4c33-b261-3b61ad26c9d9", "value": 61612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763078814, "uuid": "7e410a0f-cedb-4142-8635-834c9bd45c04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763078814, "uuid": "0e11d344-3e5b-4595-bc8c-56975a184b31", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75c1e942-c0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763081233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081233, "uuid": "5673cc6b-302c-4fcb-906b-dba781a44ec1", "comment": "Malware payload (Mirai)", "value": "35c937eefd3ffcd0a1c216e90dc06050", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081233, "uuid": "cf39f725-1bc5-4e5b-a314-d10d41c02854", "comment": "Malware payload (Mirai)", "value": "ed18c8d78c393b471b4b2c6a842333b4d83133c105067f56cf519d55648f077e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081233, "uuid": "e482e56e-4b29-4880-b6b0-4f329e45681c", "comment": "Malware payload (Mirai)", "value": "a85dbd9e552ebae873a29c0bb5bd3d21d290b357", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081233, "uuid": "1296275f-ef0c-4fda-8a2a-8e3073d74661", "comment": "Malware payload (Mirai)", "value": "70de8ee25c3ed9997db7c1d8cf9043618031b31329a3dcf3ba496758d45a1ae1ada1b7d39fbd5a821ec715dd78e270c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081233, "uuid": "b7c45624-babc-4d7f-823e-7f4b7915431a", "value": "T12C230271850E8EB524303C72DE99D393B6E12AB1C6673013D6290A3C2F79B131E57E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081233, "uuid": "94b35f2b-a840-4346-94e9-4f829c47a51a", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3J9q3UELbUXfi6nVMQHI4vcGpvp:DECFd+A6YHAx8LRQZp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763081233, "uuid": "cfc562bb-f4be-4283-96c8-a8f4a3697286", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763081233, "uuid": "f4e7a839-4d99-4055-83d1-b05b0ba6cb23", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081233, "uuid": "3fe96087-4675-4507-a638-2b3ab238bbf2", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35bd5bc5-c12c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763105607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763105607, "uuid": "4bb499e3-824e-4aa2-adc6-b3f2556a55ba", "comment": "Malware payload", "value": "7a5eeafbb78a8022ef509ba8c989d42e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763105607, "uuid": "4736c4b0-bd89-4cd5-ae7a-cf4c40afaa67", "comment": "Malware payload", "value": "eedaa3342fe2e10a780aa3019e0d24382488b74095dba9d2f171f5eeba85d173", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763105607, "uuid": "15d5a77d-2bc7-4730-8eec-49eb2ac4e6fd", "comment": "Malware payload", "value": "c844c44e4f70fdfeb7aec3684e1c743d3329a07b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763105607, "uuid": "81959824-9c8e-4ab6-82e1-f03fa0296360", "comment": "Malware payload", "value": "8e600cd3f60353a7fe40cc168854e30022abeb685ea50fc9717c2e87f336aa4843cdb2963287233a9fe1f03fa0a3f543", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763105607, "uuid": "90c2e1ec-994b-4a62-b729-4dcd1351bdf3", "value": "T116331A85B9819A17CAC1067BFF1E438D7B1A6398E2EE3303DD16AF51378B92B0D67111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763105607, "uuid": "e9147f97-6229-45c9-ada2-82cc3f49f9ad", "value": "768:bTsrodWHCzQrun+08VZJ/sgunWMMc1/PmfH0uyPdSrVmVGvLKI:0roECznx8P9spkcV+sjPd4aGvLK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763105607, "uuid": "2088c223-2d1b-4b16-ab3b-ee481cc564c5", "value": 50520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763105607, "uuid": "755fd7b4-830a-4d5d-a6ad-67037d8ade94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763105607, "uuid": "aaf1f8a1-1f6c-46b0-9b77-29cc7ada4cbf", "value": "wewe4.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa991ab-c125-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763102635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763102635, "uuid": "a30336e6-5b89-43d3-82c6-f96607153969", "comment": "Malware payload", "value": "4a12d56a51821c76f8bdd49895f66d0b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763102635, "uuid": "35baa8a7-c162-4aeb-85a6-6147344ec26c", "comment": "Malware payload", "value": "ef51bdfcbad8791d75e60b9450caeaf6f9941839024fcdfe7132b223bb450cc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763102635, "uuid": "1ba3c233-805f-4122-bc90-477d71acba85", "comment": "Malware payload", "value": "8706b354e392491b2e2189323b44c0a89914e410", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763102635, "uuid": "f740c976-c79a-441b-b461-ec58da546b09", "comment": "Malware payload", "value": "5585973325cbd8ec02e785f75fcb131e8940b93d78036c6b7c4f663e106cdddf21c839cea759af0c54016fdaf3819f92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763102635, "uuid": "3bd543c5-1843-4c58-944d-4984084933f7", "value": "T1CAF2E8B4B407B2B8D6FE1038F54B35F52C531284369CA3E7A06A0675EDF67492CA6E0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763102635, "uuid": "0087b1e4-9fcb-4a72-a2e5-aff698664ddd", "value": "768:XYsF1WEFPf9uHMHHMbuzW403wHHHHHHH:XYwDfssn4uzrswnnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763102635, "uuid": "1161a3fb-968f-4cf4-b317-746559c957ac", "value": 34432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763102635, "uuid": "fc1101dc-3288-4c5f-8562-b9920f0d4f34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763102635, "uuid": "bedb9887-5df1-487e-9b3f-d5fb9979f92a", "value": "wewe12.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "230495f9-c159-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763124903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763124903, "uuid": "bed392b1-49fc-4a70-beb5-3ddec06867bf", "comment": "Malware payload (QuasarRAT)", "value": "bffff31debbdce89c57fe3b6850e85fa", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763124903, "uuid": "2bb144fb-1543-458f-9120-01bc5da76256", "comment": "Malware payload (QuasarRAT)", "value": "f08898bfe90ebe0c2da9e201136d64db0ec8e788710eef6fb60ce28744257db1", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763124903, "uuid": "b64ca85f-bfde-42aa-a10b-12469d32145f", "comment": "Malware payload (QuasarRAT)", "value": "de435bffa11806b6a4d95ba7a0fa6ca8babac52b", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763124903, "uuid": "7b905005-4061-44db-b22e-0add4e32195e", "comment": "Malware payload (QuasarRAT)", "value": "21be8aaf31815bccc079f3fd994f84ec8de102c1a47b1e219726da6bcd0192d33afe036fb2468762461063f976fcbf8a", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763124903, "uuid": "b1d4815d-9640-4364-80c9-b4b6a067e551", "value": "T182421B156ACBA49DF037AF32AFD875DBCE2A73363E1C35FA948417124822E41DE705A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763124903, "uuid": "bade7045-5d54-4c9e-ace5-00f3f4889a6f", "value": "384:1iudkzBJ4e0XQtddiWwR2bb48GULLXl56:tqjY3wLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763124903, "uuid": "af395deb-48e3-4184-9873-2b899b1198e6", "value": 12537, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763124903, "uuid": "de644c70-34f8-4a39-8a64-499b6f641211", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763124903, "uuid": "c7d423ea-25cf-4301-87ae-f510d43836c6", "value": "temp.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1824765-c133-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1763108821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763108821, "uuid": "2907b0fc-300e-4f42-960c-a389799560fe", "comment": "Malware payload (AgentTesla)", "value": "ee3aef9da50368f1d260460060df0c50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763108821, "uuid": "c17b7c20-d798-4b74-8b21-423e571ff060", "comment": "Malware payload (AgentTesla)", "value": "f0df5544a4ec53a95b35ef08f392682ed64fdd7780e0e461abe72b7cab46c6fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763108821, "uuid": "8f5caf55-e0ad-431d-bdfa-e9e8bb22a38e", "comment": "Malware payload (AgentTesla)", "value": "72f283a66d04819b12ad82c77a0797f574a03418", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763108821, "uuid": "ce1d06dd-d1f3-4beb-a109-5585d0262511", "comment": "Malware payload (AgentTesla)", "value": "df0d83e542a7dde56446a2d49adb7b1a656ca8ee444df0d6467c0b37b3727ecb2bc171099ec5e8845802b414dc4aab6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763108821, "uuid": "9b23e069-291d-4800-8790-8cab0aabb699", "value": "T125E4236F80947BECFDA4670A25C22B4E97BA4DCA02ADD913F5C0A06B536D14A5CA35CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763108821, "uuid": "22a74221-17b4-4707-87f7-6a0850424de6", "value": "12288:gdyqcs8dlbAHVtnnQXlR02IpjlXvfClTJGCV6XB/XGczUioDM39Tpaej:gws8d0PQXQnPXvfCpJGC8lWczrb+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763108821, "uuid": "c3c9f0fe-d20d-43ca-b086-310c569a7534", "value": 669778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763108821, "uuid": "99628afe-f079-42fc-8ac7-1817d69a57e5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763108821, "uuid": "b5146002-bf16-4042-adf7-2fdbab960ffa", "value": "RFQ#20251114.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e3e4d6-c134-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1763109016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109016, "uuid": "d3a902b6-24b8-4f16-8d3f-ab52e224cf52", "comment": "Malware payload (ValleyRAT)", "value": "a390c96c9501fa5f3f447d8547fd8140", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109016, "uuid": "72ea09de-0826-428c-983f-eb89fe067b96", "comment": "Malware payload (ValleyRAT)", "value": "f320b0222a719de0b9b5c67fc856f391ae3a6af171205b8373914e63eed11ff8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109016, "uuid": "3eca08db-fee6-4d44-bba0-0b1617fef87f", "comment": "Malware payload (ValleyRAT)", "value": "b8711c80d241785a2187fd8c4ca0e3e12f55ced5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763109016, "uuid": "ccb466f8-bff2-4e00-a79a-fc1739e47573", "comment": "Malware payload (ValleyRAT)", "value": "f4e56057fb9195870695e3b8d02b48876202410bf31bad46d8146b50bca5d437add94cbe85dadb0a6e4c5b8887e18545", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109016, "uuid": "86ef1b00-50d4-4b2b-9805-0e5f754cea6c", "value": "T136A47C0A32A844F6E9678139C9938A06F77378560721DBDF13A0477A5F237E1AD3E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109016, "uuid": "c2800329-f16f-411b-842c-8c04b94c52e5", "value": "aa4eb9fdeff2aa13951b349b94f4f6ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109016, "uuid": "0835ec0e-7b11-46e3-a70d-54ce6492114c", "value": "6144:D7ygx3/bZn5E43kQ8RCS85ITkSdkrTWz8DvumZQPxQol0XAD35m0ampO83rvdcak:D7JvbZbkTCSIXceKQG5+YVU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763109016, "uuid": "0a1a8250-8e7a-4c11-99a4-858005e45d92", "value": 465408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763109016, "uuid": "89b11853-2425-422f-a02e-6e871909b3da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763109016, "uuid": "9cd6be27-9370-4a24-96cb-34e591331124", "value": "f320b0222a719de0b9b5c67fc856f391ae3a6af171205.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e2e275-c173-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1763136014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763136014, "uuid": "73c7ed44-4d73-41e3-aced-5e49b18cf72d", "comment": "Malware payload (AgentTesla)", "value": "77f16af3864e6a5d5dae57fe2fe57d2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763136014, "uuid": "db45637b-5ee9-4320-9988-dc62b4f0a0ea", "comment": "Malware payload (AgentTesla)", "value": "f3d45c511e1370ec1223d30a9078532ae0701b6e8aabc5337d7af67931713a8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763136014, "uuid": "29b23b4a-c8fd-4f56-915d-739bfc9d5c18", "comment": "Malware payload (AgentTesla)", "value": "df2ae12450695e8c752d59385aa630e2cd90bc2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763136014, "uuid": "90819c1e-4e3f-4e7d-b639-6af0b4d95363", "comment": "Malware payload (AgentTesla)", "value": "f7b1eb06a576d0354848d731ddf3ee9cd71f8674d4aeed4a8fe95baf5ec286485913db27f5fb5d161325bb0da4dc7d59", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763136014, "uuid": "671ff0fe-95f2-4d20-ad92-c7946272c846", "value": "T18845C01363DDC361C7B25273BA65B701BEBF782506A1F56B2FD8093DE920122521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763136014, "uuid": "844124bc-8d91-46ca-8b3d-d8cd8cfff7f3", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763136014, "uuid": "d9f5ec8d-9f48-453c-b55a-09aafbf3ac9f", "value": "24576:Xtb20pkaCqT5TBWgNQ7awvRBDBRchYhWlfYg4CI6A:UVg5tQ7aw7DEhkW6X5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763136014, "uuid": "b6efa0af-783f-4a8b-96db-a7df6f27d29a", "value": 1193984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763136014, "uuid": "28c59dd9-cf7e-44ee-aaf5-5ee61611db27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763136014, "uuid": "3f45fdc3-2c24-4e4d-8432-fb9345dfd60f", "value": "z1dhl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0310e444-c198-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1763151907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763151907, "uuid": "f4427c0d-20b9-462d-b861-7078e3b63672", "comment": "Malware payload (RedLineStealer)", "value": "0a379ff8452cbf06254d0c94814338fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763151907, "uuid": "99e95698-8d7f-4c3c-b848-ff038a1566a3", "comment": "Malware payload (RedLineStealer)", "value": "f57942d4a1f1dcec2520d78db5ee4ca7b217271bc52f275c24a4238212eae506", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763151907, "uuid": "b61bfb15-38e6-44c6-ab29-a0aa64b7efb7", "comment": "Malware payload (RedLineStealer)", "value": "08ba33c189f7d7cd98bcea1c428df9315822e01a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763151907, "uuid": "4bc0eff5-774a-4bf2-8aef-cba07d51a794", "comment": "Malware payload (RedLineStealer)", "value": "f8ed552e2a5b6b1b5a083bd84af69fcb30e2fe9c485515b43ceeb9251ec3de0eb3d2deaa02cf82c4365a54650fec1e36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763151907, "uuid": "81df104c-a636-431c-8e54-61040995b7a0", "value": "T195645A5823E8C910DA7F4775D871D67093B0BCA3A552E70B4FC4ACAB3D32740EA50AB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763151907, "uuid": "6d944c92-c1bf-4402-9f82-b91a3ed89d66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763151907, "uuid": "b81e955f-8ee9-4f6f-930b-3829ff068dbe", "value": "3072:GcZqf7D34Np/0+mAYkygYQQ0gYiKB1fA0PuTVAtkxzP3R4eqiOL2bBOA:GcZqf7DIXnSjQB1fA0GTV8kRYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763151907, "uuid": "d94f77c0-20f7-4552-b35d-db112068a26b", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763151907, "uuid": "264d4b3e-db34-43b1-8e71-0569405316d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763151907, "uuid": "39426d26-5355-4180-bc1d-e5a9303bba2c", "value": "0a379ff8452cbf06254d0c94814338fd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8421a4f5-c0ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763078680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763078680, "uuid": "a183c115-dc1b-4179-8c66-f0020b0a9b0a", "comment": "Malware payload (Mirai)", "value": "659962f9e519c47ff3e28dff9dd00399", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763078680, "uuid": "25be41f3-1be0-4e36-ae76-ab5c4481e8d3", "comment": "Malware payload (Mirai)", "value": "f5b7ca0b46638e239a0bac1172d04c5389c0dac20d4ea633d3ee7bcea235c5d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763078680, "uuid": "9555c66f-e26e-44a3-80ce-66b056cf62f0", "comment": "Malware payload (Mirai)", "value": "82fa071bc79b46e615c5f4f237489eaf959aca57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763078680, "uuid": "e63ed020-5a78-4832-8bb7-1da0d2624df4", "comment": "Malware payload (Mirai)", "value": "f0c415e5dffcfb5110b8b3db352c3a6b7480fd8604866db8a24460a0defd2e4bcb4567e649820d1e628083a14ae8224e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763078680, "uuid": "9f032cbb-e61e-4ff5-ad44-9b6073562c27", "value": "T121338CBAC42EADD4C44812B4E8358A795B13E10093562FFB9A49C5B4D087DECFA0D7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763078680, "uuid": "a7984c71-4f57-49f1-81e0-cf5c5b791e38", "value": "1536:0aSRwt7B++6s9psCngwxOek45MBsCjZuybVR:0ZRG++v9pHLONOMBsSuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763078680, "uuid": "6b675b6d-3c41-43dd-9c4d-f5c02bd604bc", "value": 54888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763078680, "uuid": "ac922104-5b54-4270-8288-0c45bd5f5235", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763078680, "uuid": "867c49f5-fcd8-4f2d-9d63-c8f02cc6a0a8", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb70107-c189-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763145750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763145750, "uuid": "322ff274-0f83-46f4-a673-2d9caa821671", "comment": "Malware payload (Mirai)", "value": "f9b8484f627564334388a0f2d3fba392", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763145750, "uuid": "aab6ca11-e38a-4c51-a883-40d6a9f92c91", "comment": "Malware payload (Mirai)", "value": "f5f3636fdfa1259801a835903beb222e08558399d5c0a4fdefba391a1cda73cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763145750, "uuid": "e68ce298-591c-4bdd-b69a-d7217eca98dd", "comment": "Malware payload (Mirai)", "value": "d11a8116bc8e49a37aa5087686d2c1e6d1e150bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763145750, "uuid": "dc02ccdb-1995-4edc-a86b-efeb49553dc4", "comment": "Malware payload (Mirai)", "value": "6ae4c7f651b1270f574b6f8e2b8009a9739a690f52aab214da1bfca8f8ca9eb474bb9a2e4f8c7152bc28db210dbf84ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763145750, "uuid": "15481e5e-f2ce-44b5-a926-90a6e1e6b285", "value": "T123B3B51AAE218FADF7A9833547B38F21975D37C736E1C645E25CE6001E6024D246FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763145750, "uuid": "d40ec267-f96c-4ed4-8615-8da9227a8aa6", "value": "1536:yfrim8Lte3SXAd4EA23rA+JijVFnoI3u50edyeOou+2gGuN:aWPLt0H4EA2EZVFnoI+55u8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763145750, "uuid": "554220f3-3997-4a28-acf3-42d18a12c86a", "value": 109176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763145750, "uuid": "c4d1f15c-4139-4290-b2a4-dcb6e6e5b3c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763145750, "uuid": "4540aba0-3140-4fbd-87ed-611d7a231e82", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a366c991-c141-11f0-a129-42010a9c0007", "comment": "Malware payload (GuLoader)", "timestamp": 1763114810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763114810, "uuid": "b7bb4f31-cdc4-41f7-94c3-cd4ba39615d4", "comment": "Malware payload (GuLoader)", "value": "429825a9ef954d8205c4ca03b95af0e6", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763114810, "uuid": "2ff3cf2d-2b9a-4b18-88a0-c8237fc6ce15", "comment": "Malware payload (GuLoader)", "value": "f69f2129af2df7a755d805d48d05dbfe3af3df218d1995eeffb27d153ec8e089", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763114810, "uuid": "6dc4245f-d6b2-4671-9630-806708f33747", "comment": "Malware payload (GuLoader)", "value": "d2ccc98aee1de7a975913b00d8a364e2f27202e0", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763114810, "uuid": "04e26a4b-f569-4e58-8471-acfdb95058f4", "comment": "Malware payload (GuLoader)", "value": "a0bf1f8e4675dabf19704f907e6c031d74c04a7629838ae63303584cffd238ada519bec47b43e23bf1cfc10de3051e52", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763114810, "uuid": "19418104-c7ae-477b-bf42-30565eef254f", "value": "T1A7055B30ED24171A5F4717AEFC651B62CABD8619861680F0FAEA034D61068FCE3BE775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763114810, "uuid": "cc7b4365-4ca0-43ce-87e1-08bd86d19a00", "value": "24576:SrjGrer6vrkhrqrzrt/rXrDrkEr5QrdrzrOqrurIr9gr3xs:SrjGrer6vrkhrqrzrt/rXrDrkEr5QrdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763114810, "uuid": "49d66bc3-fbc3-4c4c-92a8-99c7cf19f033", "value": 853832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763114810, "uuid": "89145610-2c77-4089-b701-92d065c43437", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763114810, "uuid": "87724eaa-360a-46cd-b6bd-1a9f15aea641", "value": "TRIAL ORDER_PO# 3729_Shipment_Specifications_passed.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2a9ac3-c11f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763100279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763100279, "uuid": "f83b98b2-a49a-4ae0-8e48-6dd21ca6fe08", "comment": "Malware payload (Mirai)", "value": "9208c323e02d23cb84d83424f581b324", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763100279, "uuid": "5fba9bf8-06f0-4035-9075-083715bd856d", "comment": "Malware payload (Mirai)", "value": "f6ed60dd00dc251f600eba9b392de9e5de5694c168d06d690d8f8e9db19080cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763100279, "uuid": "a673c66c-08b2-4f01-9a7d-9e0100e255c5", "comment": "Malware payload (Mirai)", "value": "ae1f89de86215a0cfe4d1719222b6beb084ea3a6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763100279, "uuid": "12c2effa-fcba-431f-b8e1-54ce5123bed2", "comment": "Malware payload (Mirai)", "value": "d02419a3f1f5765b393a62da5639f3707ff61de41ea826da08d1cc39100f46c7c2d5544533a1330cc5e4966dcc3b7bf9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763100279, "uuid": "241c736b-060b-4f17-bad1-73a0699017b3", "value": "T197C2CFBADAE16CDBDC2C4D77958D0370DD65B07133EB4B96C7000CC4A96689B288A4B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763100279, "uuid": "6ce1049e-763d-4468-b2cb-eea3ab7cb2bb", "value": "768:qsx7svKlmMkBC8ofS2r0sdpl9Io3vrhWI:hwKlviCTS2ACp7vL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763100279, "uuid": "862fe20d-2ec8-43ea-8a3d-2b6214266281", "value": 27536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763100279, "uuid": "c70ff2ef-e13f-4d92-867a-1c3ae0b3a336", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763100279, "uuid": "9921b847-d727-4644-85fd-735fedad0afd", "value": "wewe3.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "789dc628-c127-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763103571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103571, "uuid": "9dbacaf8-345d-4b6c-947e-71985fb52bdb", "comment": "Malware payload", "value": "322c323b21c1fb5a44639e0560869687", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103571, "uuid": "7aa5653d-7252-4a5c-bdfb-4cd3612b1c4b", "comment": "Malware payload", "value": "f6fc64c1bf2e4e0ad9af93ca866e01f93de7f515624ddc02ff38f91054d743f0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103571, "uuid": "1ee459bc-c442-4138-83fa-9e5ce2fb6cb4", "comment": "Malware payload", "value": "f75c95442921dce80be810cc0fde7bd9a6f98d67", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763103571, "uuid": "16518428-cf2a-4807-8f0b-f7c61f36006d", "comment": "Malware payload", "value": "95cc2ea783c55186479ace779f4696c2a66426e8eec542fb6182c03d88742d1d0bc19f8e1583532bbb1f2a99f44240ae", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103571, "uuid": "4c901734-12f6-4e1f-9a72-23c7e3d6856e", "value": "T1CA573381FF65CA2EC87785324BAA133537265D15CF839B4B6444372DA9B3ADC0E09BC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103571, "uuid": "13731f9b-edb5-471b-9a00-d3391cf58daf", "value": "786432:YW7rzt2vgaJMpMVKwhL0rHi1QedhxQGkYaKNUyEy1+sl:YC92vguMpbKLr1nhdSUUEosl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763103571, "uuid": "f56b921d-c6e0-4900-a901-6cd427d2552e", "value": 27517208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763103571, "uuid": "2d1fad60-4538-4f5f-a0df-1d394253f812", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763103571, "uuid": "9f695233-d844-4fc9-905a-3b955c0506c2", "value": "1win.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bddad6d-c0f5-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763081941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081941, "uuid": "335102c3-cc6a-484e-8c8e-46af98f94e31", "comment": "Malware payload (QuasarRAT)", "value": "c235bac162e2407056114d266bb4d905", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081941, "uuid": "3e130a4f-f8ce-403b-8084-b73fbded0635", "comment": "Malware payload (QuasarRAT)", "value": "f7d6620bb4563813c9ea7ee6c336b33e8dae30bc4c9a5128ca21b93e64f988ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081941, "uuid": "019edb3b-4a88-4496-9d4c-df2d9c20816f", "comment": "Malware payload (QuasarRAT)", "value": "8f183f497154dd31f05f01bc3e8523cf0e41c05b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081941, "uuid": "620e0225-e650-4d35-b1b1-46f9a37793c0", "comment": "Malware payload (QuasarRAT)", "value": "63c35a3295c5df06a3ee5a6bf3554cee3cec49c2a36a97e019851b6455ec8a27acceb90f5a5df1f68723de3da66b41f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081941, "uuid": "66f5a8ba-8f85-4e99-9b44-ef8e716d0173", "value": "T16EE56B143BF85E27E1BBE677E5B0041267F0FC1AB363EB0B2581677A1C53B5098426A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081941, "uuid": "ca2b2f05-863a-4aee-b83a-9f9976642f69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081941, "uuid": "de6200df-a716-4215-a7ab-f65bf1ca6062", "value": "49152:/vge821/aQWl8P0lSk3aKA3Z+nXsRJ6lbR3LoGdTVhTHHB72eh2NT:/vr821/aQWl8P0lSk3DA3Z+nXsRJ63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763081941, "uuid": "b68b26af-6ec1-48dc-b5d2-19d2d57b4004", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763081941, "uuid": "377ac5a5-a0b1-4438-9235-15ac1dd50a13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081941, "uuid": "b354a5d2-4c49-4bdf-aa17-01cc8fbecc2e", "value": "newest.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae22580-c0f3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763081349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081349, "uuid": "9b754bec-d0b1-4ec6-aa8c-2c95c8836888", "comment": "Malware payload (Mirai)", "value": "a69e7edc3518e93c78c91dbb1cba5013", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081349, "uuid": "24f60994-0018-461a-80c9-30830e4f6651", "comment": "Malware payload (Mirai)", "value": "f82d59b7b556ecf1df8af3b53c4d9fba66cc60b3a97d8a2f36e614f9f2b64663", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081349, "uuid": "4b3fca98-15a9-49e7-b343-cf8cae8e95a3", "comment": "Malware payload (Mirai)", "value": "ecb3b40ce70221241a2baf81b755b4730fb01b5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763081349, "uuid": "ea3b12c6-ca96-4ba2-8495-34156bd265c7", "comment": "Malware payload (Mirai)", "value": "4d18a8d5a1816e9d1b2ccd1dd97a1cc8b149b36d7a7c66cbb874204f58a400d4f5dbe04dd9958ddf691ffa42a5ba488e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081349, "uuid": "2ed29750-f573-4e47-baeb-354cf487ac57", "value": "T1B582DF30529B75F9DBE10431EAEECEC697260BF8D1FC36D216996F7C898140651F82CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081349, "uuid": "3ca43fbb-9b6f-4a28-b170-596df08d6081", "value": "384:MjWzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMao0hymdGUop5h5lJ:6GV0P6+kom0tVAoNvm+to1hs3UoznlJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763081349, "uuid": "5ad61b7b-332c-4317-9bd4-0feb612bc1fb", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763081349, "uuid": "ea6a8f4a-3dbb-4e17-9c90-3a4a710e9247", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763081349, "uuid": "98c48932-efec-4f49-8c58-3aadfaae3789", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78411cce-c1b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763162841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162841, "uuid": "cb19b319-07f8-45a6-a75d-0650f73e6768", "comment": "Malware payload (Mirai)", "value": "52fc7ab7566fc6da7b556ee1bb0a6e0a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162841, "uuid": "424d9991-e103-47b4-8f63-2051cc8affdf", "comment": "Malware payload (Mirai)", "value": "f966f9950cc52d25d8c78f6f69431ced1cb3c9231db7e9305e32888b061ce2bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162841, "uuid": "bdd4553d-df1d-497e-b83c-7b3917124f60", "comment": "Malware payload (Mirai)", "value": "852aa68d3c7d97339bea8ae5e86d7dc2f1b4808f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162841, "uuid": "f2df2344-ba2a-42b1-9b4d-bae66da09c41", "comment": "Malware payload (Mirai)", "value": "c43e4aa4d85c0db5cafd079fa5b84025cbf72bf32fd93e7f7125d62cfa98440d8c1548a8b4e644c481aed769c359aa6b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763162841, "uuid": "5c5f7adf-8a15-4e25-ae45-8f6d40a6d7d2", "value": "T1A9C33A81F8C28A22C6D7137AFA6E128E372263E4D3DE7203CE256F21778651F0D67951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763162841, "uuid": "e0b65cda-f366-4cbb-b89f-b8811e4db0f9", "value": "1536:zs2mQNUpjotU0va/uozOD0BjjYblKxMh4jTvzlkzSfSJDm3pBxbcxvU5:zBPEjot0/Qth2rliSfaUIU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763162841, "uuid": "8c17458d-147d-4ef3-9b40-192fe7d7a4c6", "value": 120300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763162841, "uuid": "115e7e85-f746-4f93-9be1-b14a95e918cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763162841, "uuid": "6deebc1d-8984-468a-be23-282f226d1eb2", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3222e0e6-c13c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763112473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763112473, "uuid": "62edbd15-af21-4a4a-b97e-ca8444be934a", "comment": "Malware payload", "value": "8780a17acc91c4ee18bf73cf2579fa3c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763112473, "uuid": "f832dbb7-24d5-47af-8b6f-082263afc092", "comment": "Malware payload", "value": "fad9079a7f7e8ef442126026096506dcbb374dfbef9de81dbbbd1b65209e73f4", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763112473, "uuid": "b538d573-5e87-4846-8d1b-8dc5c2072514", "comment": "Malware payload", "value": "9886a535b69208555abf9af73df43072bba80e20", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763112473, "uuid": "a0de206e-17ca-42cf-a457-351b1fb7b45a", "comment": "Malware payload", "value": "437a946f16edbc5b2dcbe1fa60bb19ae209a873ae94a17c40509bb3b8fd8aa640784812153fbe2f32caa764ab2294031", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763112473, "uuid": "0830d832-0d0b-4db8-ba42-0b2a1b015c7b", "value": "T172472347EE48CD5AECF6527AFE32432338226D9C4303C57B6594B63D3E735C28A916A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763112473, "uuid": "937f9639-6f7f-4ea0-9db4-34acbad79071", "value": "393216:US3RTRQ6jriVfITWMnC4mgcOkwSFyRrCzUk/oTYLky1aGirVBjl+WQG6Dtljl:VZi9aBCtOfS2+z4TYXRcVB4W8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763112473, "uuid": "74b3da28-268f-4c2a-9e19-c5ec74e282f5", "value": 24908604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763112473, "uuid": "ffaa9573-9f5d-4711-a713-75d6a84f9b69", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763112473, "uuid": "167f9d8b-2947-4627-beb5-942463269be8", "value": "jbl-atualizacao.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58609477-c1b1-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763162788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162788, "uuid": "b7c74642-1ab9-474d-b199-ad44b6356329", "comment": "Malware payload (Mirai)", "value": "8e180d2dc2e131c1fa818c23e3a1779b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162788, "uuid": "38529698-d432-4646-937d-8f983f9e810d", "comment": "Malware payload (Mirai)", "value": "fbe97ea7d5fad0c72fe5249bbfadff0d9c0f5ec90b0bcd4b1ad354bba51abba4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162788, "uuid": "66d6ba0b-18a3-49a7-acb2-6741888c2c7d", "comment": "Malware payload (Mirai)", "value": "52e2cd370398431a4cbb2d1532622b3246b1ebe0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763162788, "uuid": "4c5b4df8-05ca-431f-83fc-e9c859903eb7", "comment": "Malware payload (Mirai)", "value": "a082981ac4c17715bd4aaf95cc614a9f0fd5abe316983096e82118ee10c8f5927dedf57b43f514b0aa8e999960b783a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763162788, "uuid": "55a49312-41b0-4dbe-99f3-5e5fb7651447", "value": "T16323F1A0C0475F72C631D83399B75696B2A957B4E0FA205767C007FCA68A75340FB6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763162788, "uuid": "bd1b9790-1598-4b68-9316-b056acc93c17", "value": "768:Dre8ALAYBcTdObHSuRWwRd0/+EhWU1Hbnhgujd30dtHJCoSs6q6wBs3UozG:DibPSEbSuRWMUFrR10vHJCoSs6aszG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763162788, "uuid": "519de27e-3958-44ce-a8d6-4233b5e1f4d8", "value": 47356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763162788, "uuid": "0f8fe444-94db-4473-ba6c-ccdb597f6619", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763162788, "uuid": "7da4c5dc-8feb-4ca1-85ac-a2c59df8209b", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93f07ec-c131-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763108002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763108002, "uuid": "d19f8c3d-b4d7-42ed-88f2-e3bf12450706", "comment": "Malware payload", "value": "1667de74964dbaab2f0fcf925722dd89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763108002, "uuid": "c95d5708-89bb-41f8-84c5-d0d93c99610a", "comment": "Malware payload", "value": "fbf34caa60f1d370d4b3cabb4d08dce2da250b3610f106134d0f5dbdbaa2f717", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763108002, "uuid": "d10dd71b-0236-4ffc-b9e4-5a330a38e819", "comment": "Malware payload", "value": "f1660196adbca8be67337f8debe185c14cffc5b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763108002, "uuid": "d427c2b0-94f7-4908-b040-448b8847ff68", "comment": "Malware payload", "value": "80df818eeae0942e307755a1d8ba9ea49e1fa4f22f5148a700e3bf7672fb4639fc90e3e573f778b7280e5911284aef74", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763108002, "uuid": "f8870ab6-adb1-4579-b4e4-e43785785587", "value": "T1C353944A2E318FEDF76D873447B74A21A3A833C626E1D684E29CD5105F7024E645FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763108002, "uuid": "e7f73513-c390-482c-baac-180740a74da3", "value": "768:hCi9wTJVGjOR+DuXam7Fl/bvxiez6oCi3PTWF0wfk1CHoxQl3Fyj4K1en/SDITPb:Jwma4xm7f/85iqnkb2c1en/SDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763108002, "uuid": "adeddaf0-7f61-4bf4-9b73-e0315b002e98", "value": 64856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763108002, "uuid": "d4c2f5b8-b926-4b21-84f3-27e37e198759", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763108002, "uuid": "1fbd2a7c-a9ce-44b9-92a9-7f3341651adc", "value": "wewe2.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fed27c1-c16b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763132709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132709, "uuid": "945e0843-4700-40f4-b4dc-a214ca880dff", "comment": "Malware payload (Mirai)", "value": "f51677dc12dd44f6ab9dfcfb8c1cb027", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132709, "uuid": "8321ce30-2305-4add-be3b-9e4a0864d566", "comment": "Malware payload (Mirai)", "value": "fc027d234fba52180a5d7e9f63f9455b8452a21daeb7b3bf311ee302cc7bcd4a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132709, "uuid": "75525a30-775a-419f-8067-a27dd33e15fc", "comment": "Malware payload (Mirai)", "value": "561eb7f35140282526fe47f432e16c6708ed0ca7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763132709, "uuid": "fba4cc8c-7392-4fb7-99ec-b5a1e1d5c14c", "comment": "Malware payload (Mirai)", "value": "c1e8cb04c0b5441e7d4ed4fbbd8a9e28bcfe8c6bf274c24194790948f0f6b2205388c1d1dedff0d6c146eefacf3f7734", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132709, "uuid": "41f00124-0cdb-4158-8a53-f7ec6c43925d", "value": "T1E0F382867F913FFFD81FCC3606949B0A129C490962A5AF7B6A38D408F64B11E59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132709, "uuid": "093d8e9a-b0cb-4a8b-9ef7-837baff59f25", "value": "1536:brSooNdGrqRHOXv9dScd4aeGpuxbDrW+yvaQFq1mJ8sElclQrk:/SB6rqRHOXFsU4ar8vqaQFnRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763132709, "uuid": "dce9e8d6-1e3d-4930-9998-ea0640922338", "value": 157408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763132709, "uuid": "5c188402-61c9-4267-bc20-577908290838", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763132709, "uuid": "ac743cc2-4a51-4215-b3de-3ff4d6ed0970", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d3d0f0a-c10c-11f0-a129-42010a9c0007", "comment": "Malware payload (SheetRAT)", "timestamp": 1763091956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763091956, "uuid": "1ca17c88-ca37-4f4b-afaa-a5a4d9a6cd50", "comment": "Malware payload (SheetRAT)", "value": "a63e78f27cb65893b5b01cf16b0bfeb1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763091956, "uuid": "39185dbf-2377-4e3f-9254-75f5cd911a5c", "comment": "Malware payload (SheetRAT)", "value": "fc5c91700fb838ff8b8c95de4589abb550f4dad3699ff599fe27377f287a9c30", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763091956, "uuid": "82b0af0e-b5c1-46c0-8d28-a0f33aae3752", "comment": "Malware payload (SheetRAT)", "value": "911026c6e4ce5d4de453b39a6622e206beb9ac7e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763091956, "uuid": "0cad8e39-d882-4715-94ae-81a35f422618", "comment": "Malware payload (SheetRAT)", "value": "7ec014dfe88d2c5f29d0fd72ed7cb797ec74c7c29966727f2f6cd4e9e3d2f8bb4245af2867dcca4a72d8e82d39bea807", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763091956, "uuid": "83a64990-23f2-4605-b75c-271c0b77dc39", "value": "T19B051B077D478EA0C2065B32C4A71450976C96823323D70F7EAB1365FBB33BE654A6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763091956, "uuid": "9fb75041-b851-4bf1-8a3e-5f0e3356f379", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763091956, "uuid": "a627b9e3-600e-404a-9710-c2d6b9070151", "value": "12288:z7c9rJOR4QwLVTA9rV7j8cQ4DQINWi7a8sFoFw7:z7c9rq4Hxsr7pQMHWWa8LF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763091956, "uuid": "7443c99d-6f7d-4ca8-a3bb-10181dbd9e44", "value": 806400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763091956, "uuid": "79a82e17-a28c-4c14-a656-9a2ac5cf282d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763091956, "uuid": "c7dd96dc-d0b1-4937-9d9a-d6cddb3a01ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2401964-c182-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763142726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142726, "uuid": "1dd1efa4-4f5f-4af8-9501-f98f7e84a501", "comment": "Malware payload (Stealc)", "value": "a4082e6929cbd767b475f56315b6876c", "object_relation": "md5", "Tag": [ { "name": "86-54-24-139", "colour": "#7A14CA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142726, "uuid": "1bd2e4bc-a5af-4b2f-9ad2-60f105f3cefa", "comment": "Malware payload (Stealc)", "value": "fce8baabee544ce0b1c14404b1eb0b84d1ec63d50636d3b598b265ce967e275c", "object_relation": "sha256", "Tag": [ { "name": "86-54-24-139", "colour": "#7A14CA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142726, "uuid": "67891b97-56b5-49c1-9a98-698f9de4547f", "comment": "Malware payload (Stealc)", "value": "e9e855548b7c5f2c51483ba621d69e2621103160", "object_relation": "sha1", "Tag": [ { "name": "86-54-24-139", "colour": "#7A14CA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763142726, "uuid": "a93a2bab-524b-4916-944f-eee256bda557", "comment": "Malware payload (Stealc)", "value": "252bbac4ffc864aa6eca5d264a5fcfacb75d432c3bc6fd0da59d33aea352014d90a85494bc17e4133d823d788cbd0e7d", "object_relation": "sha3-384", "Tag": [ { "name": "86-54-24-139", "colour": "#7A14CA", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142726, "uuid": "a6461342-931c-4096-bf53-f068eb3906ef", "value": "T15B469D177DE80969E759A236CDF645963A3EBC48273133D329207A3A6E373C04D36729", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142726, "uuid": "841ab495-2440-4004-b702-732d2cb40ff8", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142726, "uuid": "ea367c50-f097-4e4d-afdc-8416d58790c5", "value": "98304:w6SFu037w4OiZrq1DfPHNADtV6v+r/VCXoM:w6SFpk4O7NADtV6v+EoM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763142726, "uuid": "a9854854-ef95-440b-bb33-8e8d8c593d5a", "value": 5486144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763142726, "uuid": "2780b44a-8764-4664-90ee-14cec02248f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763142726, "uuid": "8a094d6f-193f-4a07-a994-39ae8403f8b7", "value": "pesda0YqPL3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16680b3-c11c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763098942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763098942, "uuid": "c61c55aa-ad17-4214-801c-3f3340fe9b3e", "comment": "Malware payload (Mirai)", "value": "0dcde988e567db6f1a712146fe8f52ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763098942, "uuid": "d172d7ea-1402-44b0-b1a6-8576966aa734", "comment": "Malware payload (Mirai)", "value": "fdd169c9bb15577c7a65fc91a8f8620b545e799c3eccd53f7b5e77a845d97cda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763098942, "uuid": "5fd87156-83d2-4fc3-a142-a4f56d7b42c3", "comment": "Malware payload (Mirai)", "value": "d22965acddea232f1d4c5ba2a85f0fd53b14da8d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763098942, "uuid": "43929c51-7122-4d09-b0ca-1e03626ecf33", "comment": "Malware payload (Mirai)", "value": "9da241bd69ef792879712e04e9a56d7f8b248374ef29fbf670b8b72d928aeca8544c8af27de79a84b0688a41a0e69761", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763098942, "uuid": "6834a93a-a0fb-4fc8-b8dc-1cad83770511", "value": "T11E231A85B9819A17CAC0167BFF0F43897B2A6398E2ED3303DD256F50378B92B0D67111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763098942, "uuid": "dfd76834-f203-4e6e-bc5f-15c8aba0775b", "value": "768:p8s0TdG6bQrHn+P36JJozA3nmQMwx//TEw62nu/PSyev1/e6gKI:L0T3bmG3KSzsowZbEY2PShvY6gK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763098942, "uuid": "c7a09362-b7f3-4d7f-9272-985f9eae99ab", "value": 47380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763098942, "uuid": "b6092e63-7fd0-4df6-87da-d63c69dc2eec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763098942, "uuid": "1afa8f71-d3eb-4668-97c4-43ce6b11cd70", "value": "wewe5.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0178724a-c1b3-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763163501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763163501, "uuid": "4ea47419-897b-471c-9904-a71e30a8fffc", "comment": "Malware payload (Mirai)", "value": "27ce39a0344d5a92969ced06aa725ad6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763163501, "uuid": "5be3ab5e-f017-4ffb-9d1e-3b57fc6c26d3", "comment": "Malware payload (Mirai)", "value": "fec6c7781463fad19e950ac37f5927de1308eb4b7cb4b2df03cef602fd30de2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763163501, "uuid": "58270766-75a8-4e9a-9a89-84689f56833e", "comment": "Malware payload (Mirai)", "value": "8ebdc3e0926fba18ac5c3febc2c8f61ab846d8aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763163501, "uuid": "98de8bfb-6ba9-42d5-a47c-36356dcac776", "comment": "Malware payload (Mirai)", "value": "b52ba6e2be6901319c2621e4a145de11afe3782123e9ba07fd0660eeacbab48f116116b6a2f427698ba535044ef9b9eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763163501, "uuid": "bb2bdd01-ea8e-4da7-ae21-bbff570741d6", "value": "T10A932956A8818B11C5C4237AFA2E028D3317277CE3DFB3169E219F2477C695B0DBB946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763163501, "uuid": "6cc93a1f-851f-48a3-9fe7-759e672ed99b", "value": "1536:AZna2MOfBsuJS4VSHSduvR1wl3fUR5DeBaf2zeWV78ci+S2NaptQ7gnOkYHwx:iBwnjw5cRFeBaD/2NaptQEOk7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763163501, "uuid": "2fa4c1c7-1c73-4103-be65-120bef183738", "value": 95364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763163501, "uuid": "7483e6df-9ba3-4b05-843f-d609e089c00a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763163501, "uuid": "e925364c-2b88-48b6-882b-706c85d0031e", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da60dad3-c194-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763150551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150551, "uuid": "87bbef5b-99c4-48ca-b740-e7f5b9fdb931", "comment": "Malware payload (Mirai)", "value": "9ac82d343afcf9e2b0161629a3f05305", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150551, "uuid": "c969b293-fce9-4491-9a23-7eb2ea93286a", "comment": "Malware payload (Mirai)", "value": "ffb92184504dbd2ebf15ca59062fd13fa11771ed4d45f12783f3ab33d6dc1f42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150551, "uuid": "2834a3c8-873b-466e-9e19-fc88dabcf5b3", "comment": "Malware payload (Mirai)", "value": "6659cd80e77572bf2c0e2fe8a1609404c2a28b7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763150551, "uuid": "4c68bbc5-fa34-4e06-b725-88c0a74ff90b", "comment": "Malware payload (Mirai)", "value": "ec393dcb3981f3f9637028bd1b6e9ec3345ba224bdbb5d10fbfe2898a7a17b43f627e1af72ac671ed09a3123281544ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763150551, "uuid": "54ff7be4-ee0c-4822-878e-efe87d40334c", "value": "T1A7833991BD416622C2E1237AFB6E428D332563A8D2EF7217DD226F107BC791B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763150551, "uuid": "caaa1f9a-3e90-4463-86fc-6505d1db897f", "value": "1536:lS4jfHvqCK/3r1XrMGruVZpiHH5lJyTprxsoXrIR31qo4W0RWVTFOFDIvhi0A42T:lS4mpbZgea3M5CgoXEF1qHW0O7AJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763150551, "uuid": "9a4a46ce-f7bd-4bfc-977c-7f926171e4c0", "value": 83600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763150551, "uuid": "dbae3ed8-c4b2-4fc1-8887-78bd010e84fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763150551, "uuid": "78d2c361-1f69-4df4-9dab-4e2b0891c710", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837ad91d-c0ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763078679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763078679, "uuid": "ae4f33a9-696e-4a3a-a4a3-cf552b1036c9", "comment": "Malware payload (Mirai)", "value": "4bad8c579bfe1e7c8a54c105301e5e9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763078679, "uuid": "4efc6da3-7131-41b6-a03f-e6dcff2f5600", "comment": "Malware payload (Mirai)", "value": "ffe536b3d11dd297b8155ecf55695ef88518cc6e35976efed155b6328444bfb5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763078679, "uuid": "e5b0a1bd-58f2-4d29-81bb-242b0fb26d82", "comment": "Malware payload (Mirai)", "value": "f141b9f221bcb293cd943b0c744b120ea75a4a52", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763078679, "uuid": "905d866c-71f7-4b6c-8785-e366e6b30bdb", "comment": "Malware payload (Mirai)", "value": "ffd011cdfefe740319a69cfff5453681848be0429024a078100db2cea04bfa4c3ccabdcc05d41a2b157d9fe9b71988fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763078679, "uuid": "6b3fd02f-97a4-4efe-928c-22352f0296ec", "value": "T123830746B9419F16D4D632BAFB9F814833536FB8D3FA7101D9206F50638A9EB0F72612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763078679, "uuid": "87ee076c-a355-4118-a53d-c325d1313e4e", "value": "1536:uknlQ+iHARwZ+zBdMgi70Hoi377If/M75DlE4lc7diElPDyMVW:XQ+igRc+FdM77Eos77If/M75qPlrpVW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763078679, "uuid": "1f97e158-12ef-418f-84d5-a758a1dd0d6d", "value": 82564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763078679, "uuid": "43c9a455-e043-4f19-8781-0143bcaeb349", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763078679, "uuid": "16f74112-e893-4931-a28e-39fb898d7e6a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }